Re: mysterious attack on Windows 2000 servers (Help needed)

From: Brill Pappin (brillpappin@rogers.com)
Date: 09/15/02 

From: "Brill Pappin" <brillpappin@rogers.com>
Date: Sun, 15 Sep 2002 13:16:48 -0400

> I assume you've checked the firewall logs. You could also try creating a
> readme.bat file and removing permissions for anyone to access that file
> [including system and administrators].

In fact leave it harmless so it doesn't delete anything, and audit it, so
you can see who/what is executing it.

For all you know you've got someone inside that's doing it... or even a
previous admin who has a backdoor... you where hired after it happened
right? so who was running the system before you?

- Brill Pappin