Hacked - My System is Hacked!!! Help!

[Guest]

Hi Experts,

I have windows 2000 server and have updated all the windows updates - yet my
system seems to be hacked and some one gone to the extent of creating an
account with administrator rights!!! Whenever i connect to internet via DSL
USP Modem i can see a heavy inbound traffic and outbound traffic sometimes to
the extent of 100MB!!! And i end up paying my ISP for traffic!!! Is there
anyway to find out who is behing this??? I dont know why there is a need for
remote administration? I think this could be the cause

Help!

Regards
Manish Sawjiani

 

[Yor Suiris]

Well I would maybe start with a port snuffer, such as:
http://www.ethereal.com
And see what I can track down.

 

[Galen]

In

Is there anyway to find out who is
behing this??? I dont know why there is a need for remote
administration? I think this could be the cause

In addition to the information about installing a port sniffing tool it
would certainly be beneficial to install (and properly configure) a decent
firewall. You have either a hardware or a software firewall as your options.
In most cases a software firewall is more than enough to prevent things like
this. The key is proper configuration and allowing only nessesary
applications/services to access the internet either inbound or outbound.
Chances are that your computer is either spreading a virus, spam, or is
hosting a site with illegal content (warez, porn, music, etc) and you really
should look into stopping this immediately not just finding out who's
responsible. Perhaps your local authorities would be the first people to
contact immediately after you install and configure a firewall.

Galen
--

"My mind rebels at stagnation. Give me problems, give me work, give me
the most abstruse cryptogram or the most intricate analysis, and I am
in my own proper atmosphere. I can dispense then with artificial
stimulants. But I abhor the dull routine of existence. I crave for
mental exaltation." -- Sherlock Holmes

 

[George Hester]

Let me explain how to stop this. It's pretty simple. This issue usually results from having SQL installed nut I know that
is not necessary. The fix for this issue is to go into C:\WINNT\system32 and find the file tftp.exe. Then right-click the
file and remove Properties | Security | ALL NTFS permissions to it. You have to remove ALL the permissions. If you
leave ANYTHING with permissions to this file it won't work. Now be careful here for when you try to Service Pack
Windows at a later time it will fail not having access to this file. That's good you just have to remember what you did.
Luckily the install won't stop you jast have to Reset the permissions on the file and proceed with the Service Pack
install.