Help me stop the hacker...

From: Agustin Chernitsky (agustinchernitskyNOSPAM_at_hotmail.com)
Date: 01/28/04 

Date: Tue, 27 Jan 2004 20:30:27 -0300

Hi everyone,
Well, I was hacked 5 days ago. This what I found so far:

1.- Possible hacker entrance (almost confirmed) thru MSSQL using brute force
attack, and a weak password on my side for SA (no comments please).
2.- Hacker copied some files to \System Volume Information\mstemp.tmp\_tmp.
A scanner svhost.exe, a speed tester named sc5m.exe or speed.exe and a
pskill.exe to kill these processes.
3.- My server is behind a FW, still MSSQL ports 1433 is open (now closed).
4.- Even though I changed all my SA and admins passwords, he manages to copy
the same files to: c:\system volume information\mstemp\_tmp.
5.- The hacking seemed to have stopped since I closed the SQL port on the
FW.

Interesting facts:

Every time the hacker executed svhost or sc5m, he was under NT
Authority\System (MSSQL runs under that, but not for long!). The timeline
was the following:

0.- Logged on to MS SQL.
1.- Process 3368* created a new process, 2520, which was CMD. exe
2.- Process 2520 (CMD) created a new process, 3120, which was \System Volume
Information\mstemp.tmp\_tmp\svhost_light.exe
3.- Process 3120 exits.
4.- Process 2520 (CMD) created a new process, 4275, which was \System Volume
Information\mstemp.tmp\_tmp\speed test\speed.exe
5.- Process 4275 exits.
6.- So on, etc, etc.

*A very interesting fact: Process 3368 doesn't exist!! I checked all logs,
and this process was never created or destroyed.

Now, how can we stop this BAMF? Should I reinstall SQL? What about process
3368 (this is what bothers me most)???

Any ideas are welcome!

PS : X-posted to win2000.security

Thanks all!

A.

Relevant Pages