Re: HACKING Attempt on FTP Server
From: ComSec (comsec_at_operamail.com)
Date: 08/27/03
- Next message: sam: "how to deploy X509 certificates to 300 remote hosts?"
- Previous message: Walter Roberson: "Re: one time pads"
- In reply to: paul vudmaska: "HACKING Attempt on FTP Server"
- Next in thread: paul vudmaska: "Re: HACKING Attempt on FTP Server"
- Reply: paul vudmaska: "Re: HACKING Attempt on FTP Server"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: 26 Aug 2003 20:55:05 -0700
paul@vudmaska.com (paul vudmaska) wrote in message news:<c02e4c1b.0308241028.34d20bfa@posting.google.com>...
> I've have the unsettling feeling that someone has infiltrated my
> Windows 2000 Server box. I'm fully patched and all but just some
> curious things are happening.
>
> For one: i get this message periodically in event viewer:
>
> FTP Server could not create a client worker thread for user at host
> 81.48.157.134. The connection to this user is terminated. The data
> is the error.
>
> With different ips. (a french location above) Not my own. None have
> access to my server. I hope. Does this mean that the user at that HAD
> access, or is this a popular scanning routine?
>
> Then when i go look in my ftp logs, i find that some of the days are
> missing. They are just not there. Maybe i just did not use ftp that
> day?
sounds like you might have been accessed by your logs being
deleted..if i were you i would scan for a trojan..and take steps to
remove it if found.
also change your password and install a anti hammer..blocks login
after 3-4-5 failed attempts if that was how they gained access...also
check your up to date with patches
check for any obscure files , folders, scripts etc
also from your logs data (from day 1 of suspected attack)... do a
search for files created on that date.
regards
C
-- http://www.how-to-hack.org
- Next message: sam: "how to deploy X509 certificates to 300 remote hosts?"
- Previous message: Walter Roberson: "Re: one time pads"
- In reply to: paul vudmaska: "HACKING Attempt on FTP Server"
- Next in thread: paul vudmaska: "Re: HACKING Attempt on FTP Server"
- Reply: paul vudmaska: "Re: HACKING Attempt on FTP Server"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
