Re: Hack Attack
- From: Peter <Peter@xxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Fri, 12 Jun 2009 00:09:01 -0700
I guess i knew in my heart that what you all have said is correct and a
rebuild would be required. Ahh well who needs a vacation anyway.
--
Best regards
Peter
"Leythos" wrote:
In article <44757D19-690E-415F-A8AD-FA14EC11D98C@xxxxxxxxxxxxx>,.
Peter@xxxxxxxxxxxxxxxxxxxxxxxxx says...
We suffered a recent hack attack and someone managed to get in to our server.
We have removed all Trojans etc. Changed the regional settings back from
Russian, keyboards etc et al Replaced firewall etc. I am left with one
issue, when the server boots the logon screen ( Cntrl + Alt + Del) is set to
Russian KB. I cant find where this is picked up from i dont want the password
to be just numeric. Any Ideas?
Peter, In all my years I've never had a compromised network for clients
that we manage, but we have worked on many networks that were
compromised.
Any good security person worth their weight in anything will advise you
that you can not, under and conditions, be sure you've cleaned the
machine.
Your only path is to backup all data files, not exe, not com, not bat,
and to then take the offline files and scan them from another system,
using a different product than you were using.
With that done, wipe every server, ever workstation, and the rebuild
them in a clean environment, do NOT trust any backups unless you can be
sure the backup was from at least a couple weeks before you learned you
were compromised.
You mentioned you replaced the firewall - What was it, what brand/model.
If you really had a REAL firewall, what makes you think you're any more
secure this time?
What makes you think that the changes you made have secured your system?
Please, wipe the server in a clean environment, rebuild it from scratch,
ONLY connect to the internet to download MS/AV security updates, nothing
else. The start rebuilding your network.
--
You can't trust your best friends, your five senses, only the little
voice inside you that most civilians don't even hear -- Listen to that.
Trust yourself.
spam999free@xxxxxxxxxx (remove 999 for proper email address)
- Follow-Ups:
- Re: Hack Attack
- From: Leythos
- Re: Hack Attack
- References:
- Hack Attack
- From: Peter
- Re: Hack Attack
- From: Leythos
- Hack Attack
- Prev by Date: Delegates page not availuable in Outlook 2007...
- Next by Date: Re: SBS 2003 Data Drive Space
- Previous by thread: Re: Hack Attack
- Next by thread: Re: Hack Attack
- Index(es):
Relevant Pages
|
