Well crap, I got hacked......

[slipperyslope]

Ok I use IIS(don't hassle me about this)on my work computer to run a website for a local band. My employer doesn't care. On Saturday my machine was hacked. Nothing really damaging. They just uploaded some webpages that said "F*ck the Government" and a file called root.exe.

I know it was probably capturing my keystrokes.

Anyways, I cleaned up the mess. My question is, Can someone make an account invisible in windows 2000. I fixed the backdoor this joker used to get into my system. I just don't want him to have made an account that I can't see under computer management..

Jim

 

[JohnnyKnoxville]

Yes your box is 0wn3d !!!

 

[slipperyslope]

Johnny Knoxville,

Damn you are helpful....

Jim

 

[MrBond]

I haven't heard of anything like that (invisible accounts). It'd surly show up in the registry if the account was there. I'd change all passwords on the system as well, just in case. (although you probably already did that)

 

[Delphiki]

No, you can't make an invisible account. Make sure you go through and install the latest SP's, patches, etc and fix up all your permissions though.

 

[slipperyslope]

Already changed the password especially since some of them had to do with my university accounts, the funny thing was that Norton was catching alot of what he was trying to upload and quarantined it. Norton probably saved my ass in some aspects. The reason I ask is because if I have my hard drive thraashing and I open up the security settings on some folders I see some account and it disappears very quickly. It has lots of letters and numbers.

Jim

 

[Wedesdo]

They are using a script... that just shows how stupid MS and their ISS stuff is - a script kiddy can break in...

just download all patches, restore from backup, and try again.

Nothing personal, it's a SCRIPT!!!

 

[slipperyslope]

Delphiki,

What had happened was that I somehow left the examples folder with "everyone" with write and execute permissions. He couldn't get access to anything else. It was more of an annoyance than anything else.

Jim

 

[Delphiki]

<< The reason I ask is because if I have my hard drive thraashing and I open up the security settings on some folders I see some account and it disappears very quickly. It has lots of letters and numbers. >>



That's normal. Each account has it's own unique ID associated with it. You'll see that the account doesn't actually disappear, but turns from numbers into its name.