ASP error script and trojan

Web Server Talk > Web Servers reviews > IIS server support > IIS Server Security > ASP error script and trojan

Last Thread Next Thread Next

ASP error script and trojan

Eco

05-29-06 10:30 PM

Our web server is found that is hacked occassionally. The server will have
the following issues.

1.  webpage directory will be added some *.htm file, part of file contents
are shown as follows.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Hacked Mr.Trojan-Msn: Trojan@Trojan.Gen.Tr</title>
<meta http-equiv="Content-Type" content="text/html;
.............

2. ASP error scripts will be popup and the the main web site cannot be
accessed. The website can be accessed again after close the error scripts
window manually.

According to our webpage designer, our server is infected with trojan. But
we've scanned and can't find anything through virus scanner.

Actually, what anti-hack or anti-virus software will install on your IIS
Server? Any comments?

Below lists the web server info.
- Windows 2000 Server w/ built in IIS 5.0
- All windows secuirty / pack is always be udpated.
- Symantec Antivirus 10.0
- hardware firewall only open http port for this server.

[ Post a follow-up to this message ]

Re: ASP error script and trojan

Jeff Cochran

05-29-06 10:30 PM

>According to our webpage designer, our server is infected with trojan. But
>we've scanned and can't find anything through virus scanner.
>
>Actually, what anti-hack or anti-virus software will install on your IIS
>Server? Any comments?

You have been hacked and don't know how or what might be happening.
Flatten the box.  Wipe the drives, reinstall from scratch and restore
only known good files.  Lock the box down this time.  Use the security
checklists at Microsoft.

Jeff

[ Post a follow-up to this message ]

Re: ASP error script and trojan

Eco

05-29-06 10:30 PM


"Jeff Cochran" <jeff.nospam@zina.com>
???????:447e7363.151700453@msnews.microsoft.com... 
>
> You have been hacked and don't know how or what might be happening.
> Flatten the box.  Wipe the drives, reinstall from scratch and restore
> only known good files.  Lock the box down this time.  Use the security
> checklists at Microsoft.
>

Thanks for your reply and I have some questions.
---- Wipe the drives, reinstall from scratch and restore only known good
files.
You mean reinstall the whole box / windows??

--- Lock the box down this time.  Use the security checklists at Microsoft.
security checklists? can be found within Microsoft site??

[ Post a follow-up to this message ]

Re: ASP error script and trojan

Bernard Cheah [MVP]

05-29-06 10:30 PM

a) Yes, as you may not know what other backdoor the hacker has installed.

b) www.microsoft.com/iis/  for start, then google MS site for "IIS Security"

--
Regards,
Bernard Cheah
http://www.iis.net/
http://www.iis-resources.com/
http://msmvps.com/blogs/bernard/


"Eco" <eco@hotmail.com> wrote in message
news:Od0LCmbgGHA.4892@TK2MSFTNGP02.phx.gbl...
>
> "Jeff Cochran" <jeff.nospam@zina.com>
> ???????:447e7363.151700453@msnews.microsoft.com... 
>
> Thanks for your reply and I have some questions.
> ---- Wipe the drives, reinstall from scratch and restore only known good
> files.
> You mean reinstall the whole box / windows??
>
> --- Lock the box down this time.  Use the security checklists at
> Microsoft.
> security checklists? can be found within Microsoft site??
>
>

[ Post a follow-up to this message ]