Hacked Win2k

From: LW Irving (lirving@coffs.com.au)
Date: 06/22/02


From: "LW Irving" <lirving@coffs.com.au>
Date: Sat, 22 Jun 2002 14:49:01 +1000


I have a win 2k server SP2 all patches applied, it may have been compromised
with Nimda when it came out. The problem is on the RAID array which store
data and has the company website on it.

I wrote an ASP website, which works everywhere else, when tried to run it
said could not find file. tried a number of files and find that it can run
HTML but Not ASP.
Went to reinstall FP extentions got series of error messages saying that FP
could no filnd the folders.

Tried to FTP in. Loged in OK but file listing corrupt, ie. filenames in date
colum funny character for filename.

Upon further investigation have found a series of folder with either no name
or strange names ie "Kuibus Rulez" or "Tagged" or "respect this tag"

Also heaps of error in HP backup log where the system could not enumerate
this folder or file therefore not backed up.

Anyone seen any thing like this.

I am starting to think I may need to format the raid array. and manually
restore the directory structure ??

Any thoughts on this would be appreciated

Regards
Wayne
lirving@coffs.com.au