RE: FTP and IIS HACK!!!

From: Rogvi Knudsen (rogvik_at_online.microsoft.com)
Date: 11/06/03 

Date: Thu, 06 Nov 2003 15:24:49 GMT

Disable posix install into a new dir, update machine with newest IIS rollup
Other alternative: pref. reinstall from scratch; sorry

--------------------
| Content-Class: urn:content-classes:message
| From: "David Little" <david.little@rxisoft.com>
| Sender: "David Little" <david.little@rxisoft.com>
| Subject: FTP and IIS HACK!!!
| Date: Mon, 3 Nov 2003 16:41:39 -0800
| Lines: 26
| Message-ID: <093c01c3a26c$68e5e390$a301280a@phx.gbl>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="iso-8859-1"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
| Thread-Index: AcOibGjlm9h3hdSQQwmOrRB0Aiaatw==
| Newsgroups: microsoft.public.inetserver.iis.security
| Path: cpmsftngxa06.phx.gbl
| Xref: cpmsftngxa06.phx.gbl microsoft.public.inetserver.iis.security:6792
| NNTP-Posting-Host: TK2MSFTNGXA11 10.40.1.163
| X-Tomcat-NG: microsoft.public.inetserver.iis.security
|
| I know very little about hacking or the like. I have a
| problem I hope someone can help me with.
|
| My FTP server is getting modified by someone or
| something. I am running IIS on win2k server. I have NAV
| Corporate Edition 2.7. I have a hardware-based firewall
| with ports open for FTP, SMTP, POP, HTTP and Terminal
| Services. I also have Exchange Server running.
|
| Basically, my FTP site in IIS either has its Home
| Directory changed to some odd path pointing to a COM1
| directory-This directory cannot be deleted. Sometimes the
| FTP server is stoppped and a version of serv-u is started
| on its port of 21. One time, my FTP server had its port
| changed to 51 and the serv-u took port 21.
|
| I have tried POSIX - keeps telling me that the process
| cannot start and FPORT which has been useful to track
| serv-u.
|
| I don't know what else to do. Everytime I seem to clear
| it up, it comes back.
| _________________
| David H. Little
| Chief Technology Officer
| RXI Software
|

Thank you
Rogvi Knudsen
Microsoft

Note: The information contained in this message may be confidential information subject to the terms and conditions of a
confidentiality agreement between Microsoft and you or your employer. You are not permitted to disclose or publish
confidential information. In addition, if you have received this message in error (i) please notify us immediately by return
message, and (ii) any use or distribution of this information is prohibited.

Relevant Pages

  • RE: New User: IIS Missing
    ... | Content-Class: urn:content-classes:message ... | Subject: New User: IIS Missing ... | My pre-loaded Windows 2000 does not have it and I need it ... Please subscribe to the FREE Microsoft® Security Notification Service on ...
    (microsoft.public.win2000.new_user)
  • Re: SBS Monitoring Issues
    ... David, here's the output for checkdb: ... Now, though, companyweb and rww are also absent ... >Companyweb disappearing from IIS doesn't sound related to ...
    (microsoft.public.windows.server.sbs)
  • Re: New attack vectors and a vulnerability dissection of MS03-007
    ... It seems that another vector for this attack has been found as David ... Does anyone have any information on patching desktops without IIS ... Thanks to Packetstorm for always providing great security info. ...
    (NT-Bugtraq)
  • Re: XP Home file transfer to and from an old Mac computer?
    ... A Mac will work. ... IIS is needed to make the FTP server. ... The best live web video on the internet http://www.seedsv.com/webdemo.htm ...
    (microsoft.public.windowsxp.general)
  • Re: I_USR requires Logon type 3 - Help!
    ... On IIS v5.1 (Windows XP). ... Locally" if you want that account to be impersonated by the FTP Server. ... When IUSR tries to logon to the FTP server, ...
    (microsoft.public.inetserver.iis.security)