|
| Looks like SANS (http://isc.incidents.org) is receiving reports of other
compromised IIS servers. Might want to check your servers.
Handlers Diary June 28th 2004
Updated June 28th 2004 13:53 UTC (Handler: Jim Clausing)
IWAP_WWW account on compromised IIS servers
Request for Information: IWAP_WWW account
We have received information about compromised systems with Internet
Information Server. These systems had an administrator level account with
the username 'IWAP_WWW' added.
Please check if your server has such an account and let us know what you
find. Until we know more, we suggest that you consider a server compromised
if you find and administrator account with this username.
-------------------------------------------------------------------
Johannes Ullrich, jullrich_at_sans.org
|
|