Hacker broke in and deleted files from folders!!!

[WebHedon]

Hello all. We just had a little attack on our organizations win2k server. I noticed on monday that when I tried to open the website I have been working on, which was saved in the Inetpub >

http://wwwroot

folder on the server, all of the folders and files except for the _notes folder were deleted. Oddly enough, right inside of the Inetpub directory are now about 5 blank, unnamed folders, but when I check the properties of the folders, they each are exactly 1.08 gigs. But, we can't open the folders, rename them, or move them, and I think they are blank so they elude the searches for the files.

We think the hacker could have gotten on via one of the employees' laptops which they use for business and pleasure, but we aren't sure how to prevent it from happening again, or how to trace who did it, or how to find the missing files.

Has anyone ever encountered anything like this before?? Please help if you know anything about this.

Thanks in advance,
Jesse <-- WebHedon

 

[lullysing]

I work the abuse department.

Right now, one of our customer had left an unpatched win2k box outside of his firewall, and it got owned. Then when we told him his mail server was being used as an open relay, he took the box and put it BEHIND his firewall..(and nothing else).

Then all of the sudden, his other mail server in ANOTHER city started sending spam too. THEN he started acting. and that's when he noticed the perpretators had added users and modified his exchange configs on both server, and used the vpn to pass from site A to site b.

Believe me man, it could be worse. Because this guy essentially fscked himself over by allowing something not secure/safe inside his network.

So follow the steps to immediate recovery.
1) UNPLUG THE SERVER
2) FIND THE BACKUPS
3) (optional) pray to the $deity that your backups are actually functionnal.

And then immedialty start a security audit.If then got in once, they probably have had access to everything else in that subnet, or that network.

Good luck.