Re: server is being hacked

On Tue, 05 Feb 2008 16:23:18 +0100, Sebastian G. wrote:

joseph.rosario@xxxxxxxxx wrote:

every month I am finding either one or two services that are hack
services. I delete the files and clean the service in the registry
then between 1 and 3 months a new hack is on my server. I have
symantec 10.2 and symantec for exchange and a barracuda on the outside
of my network. Can any one help to find the root of this issue. I use
the normal tools like rootkit revealer and aports for scanning my
ports but still they get in. I check my server a few times a day and
usually I catch it within a day but that might be to late. My updates
and patches are up to date. I am running SBS 2003 sp2 and exchange
2003 sp1.

Ok, and where's the question? Or the problem? Or the news? Sinceyou don't do
anything serious to recover from the compromise, such a sequence of events
is reasonably expected.

Good post.

Are you through fucking your Mother, I'm next!
.