IIS 5.0 logs deleted by virus, hacker or defect?

[rzward]

Hello,

In the middle of the night both the W3SVC1 and MSFTPSVC1 log file folders were somehow erased on my publicly available Win2K IIS 5.0 Web server. The Web server machine does have firewall software installed.

No other files were erased on the machine.

Looking at the permissions in the System32\LogFiles folder, only the administrator account and the SYSTEM account has write privileges in the folder.

Unfortunately, the firewall software (from Network Ice) doesn't have anything unusual to report.

Has anyone heard of a defect that would cause IIS 5.0 to decide to erase the logfiles folders?

I used an undelete program to list all of the files that were erased and was fortunate enough to be able to restore all but three or four of the hundreds of log files.

If this was the result of an attack, is there anything I can do to prevent this from happening again?

Any advice would be greatly appreciated.

Richard

 

[LenLindquist]

You could start by running MBSA (Microsoft Baseline Security Analyzer) on the machine. It should enumerate its known weaknesses and list any patches you need to install. You can do a search on technet.microsoft.com and you'll find it.

Len