My Windows 2003 server was hacked through the Serv-U FTP server and now the
W3SVC is not listed in services nor will it start from the command line with
net start w3svc.  Did an sc query and get permission denied.

Any help would be apprecitated.

Mike

[ Post a follow-up to this message ]

"Mike Moses" <Mike Moses@discussions.microsoft.com> wrote in message
news:5D5B535F-2E2F-4B93-84F6-B01F647DD674@microsoft.com...
> My Windows 2003 server was hacked through the Serv-U FTP server and now
the
> W3SVC is not listed in services nor will it start from the command line
with
> net start w3svc.  Did an sc query and get permission denied.
>
> Any help would be apprecitated.
>
> Mike

a hacked server that is obviously still not fixed is best flattened and
reinstalled from scratch.  trying to track down any of the many possible
back doors or other junk the hackers may have left or damaged is just too
hard and will never give you that warm fuzzy feeling that all is clean.

[ Post a follow-up to this message ]

On Sat, 11 Sep 2004 15:07:06 -0700, "Mike Moses" <Mike
Moses@discussions.microsoft.com> wrote:

>My Windows 2003 server was hacked through the Serv-U FTP server and now the
>W3SVC is not listed in services nor will it start from the command line wit
h
>net start w3svc.  Did an sc query and get permission denied.
>
>Any help would be apprecitated.

This is way too obvious but...

Your system is no longer owned by you or controlled by you.  If you
want control back, you need to remove the system from the internet,
reformat and reinstall from scratch, patch fully before you reconnect
to the internet and only install known good data from a backup.

Jeff

[ Post a follow-up to this message ]

What version of Serv-U, and how are you sure that Serv-U is to blame?

"Mike Moses" <Mike Moses@discussions.microsoft.com> wrote in message
news:5D5B535F-2E2F-4B93-84F6-B01F647DD674@microsoft.com...
> My Windows 2003 server was hacked through the Serv-U FTP server and now
> the
> W3SVC is not listed in services nor will it start from the command line
> with
> net start w3svc.  Did an sc query and get permission denied.
>
> Any help would be apprecitated.
>
> Mike

[ Post a follow-up to this message ]