Terminal server got hack and resolved but one more issue

-

out terminal server running server 2003 r2 got hacked via remote desktop. hackers install bunch of crap, made gust , many other local accounts admin. use kaspersky , malware bytes scan , did find ton of junk including mass email programs well. use super spyware. password has been change more complex one. after scan , removal of malware, had manually disable guess account , remove guess account admin group. after while gets enable self , guess account part of administrator group. use tcp view check connections found nothing suspicious. other app process explorer check none ms or unknown apps running haven't find thing specious.

anyone here got idea or ever experience of such event? love find solution quickly.

 

 


please refer window  2003 hrdening guide

http://technet.microsoft.com/en-us/library/cc264467.aspx

http://www.virmansec.com/blogs/skhairuddin


Windows Server  >  Windows Server General Forum



Comments

Post a Comment

Popular posts from this blog

more indexes

-
i want 2 indexes. likes can't mssql. i have example fields: school class number i want school , class in index can this: school class number 1 2 435 1 4 4535 1 5 265 2 1 8234 2 2 8493 4 3 943 4 2 493 4 6 934 but how can in sql server management studio i declare unique constraint. borrowing segio's ddl: create table dbo.orderrows ( id int identity (1, 1) not null primary key ,ordernr varchar (20) not null ,orderrow varchar (20) not null ,rowtotal decimal (11, 3) default 0 not null , constraint uq_orderrows unique (ordernr, orderrow) ); above under hood create unique index on column combination (ordernr, orderrow). tibor karaszi, sql server mvp | web | blog SQL Server  >  ...
Read more

ActiveDirectory

-
hello togehter, is possible disable bloody warning?: event id: 2887 event source: activedirectory_domainservice event type: warning event description: during previous 24 hour period clients attempted perform ldap binds either: (1) sasl (negotiate kerberos ntlm or digest) ldap bind did not request signing (integrity validation) or (2) ldap simple bind performed on cleartext (non-ssl/tls-encrypted) connection directory server not configured reject such binds.  the security of directory server can enhanced configuring server reject such binds.  for more details , information on how make configuration change server please see http://go.microsoft.com/fwlink/linkid=87923. summary information on number of these binds received within past 24 hours below. can enable additional logging log event each time client makes such bind including information on client made bind.  to please raise setting "ldap interface events" even...
Read more

Virtual Channel

-
on condition rdp decide protocoll extension necessary? use standard gdi , if there movie playing, switch dynamically window ms-rdpev video transfering? or full session send on additional ms-rdpev. , in cases host rendering , in case client rendering? thanks in advance! hi, the remote desktop protocol video redirection virtual channel extension used redirect audio/video streams terminal server terminal client . protocol specifies communication between application playing audio/video on terminal server , terminal client. regards, wilson jia this posting provided "as is" no warranties, , confers no rights. please remember click “mark answer” on post helps you, , click “unmark answer” if marked post not answer question. can beneficial other community members reading thread. ” Windows Server  >  ...
Read more