Finding server vuns

[aiex]

One of my friends got his server attacked yesterday and some spam put up in its place. Just wondering if any of you guys know a good way to try and find out how they got in? Would a port scanner tell you where the backdoor was so he can close it? (its running server 2003)

Thanks for any help!

alex 😀

 

[Pepsi90919]

vuns? buns? runs? juns? Z4QQQ batman symbol?

 

[Goosemaster]

put it between a transparent prxy and that'll definitely give you some info. check logs, but odds are, they erased their tracks.