We currently have a 64bit Windows Server 2003 running an instance of IIS 6 which was configured to run in 32bit mode. If we install the .NET framework 4.0, should the framework be installed as 32bit or as 64bit?
Note, this is a production web server which currently has .NET 2.0 installed and runs a classic ASP application as it's main website.
I have a Windows Server 2003 SP2 machine with IIS6, SQL Server 2005, MySQL 5 and PHP 4.3 installed on it. This is not a production machine, but it is exposed to the world via a domain name. Remote desktop is enabled on the machine and two administive accounts are active on it.
This morning I found that the machine had been logged off with an uknown user's name still in the login text box. Upon further investigation I've found that two windows users have been created, anti-virus has been uninstalled and a smattering of .exe files have been dropped into the C: drive.
What I would like to know is, what steps should I take to make sure that this does not happen again, and areas should I focus on to determine the avenue of entry. I've already checked netstat -a to see which ports are open, and nothing appears odd there. I did find unknown files in the data folder for MySQL which I'm thinking might have been the entry point but I'm not sure.
I'd really appreciate the steps to conduct a good post-mortem of a server hack so that I can avoid this in the future.
Post Investigation Review
After some investigation I think I found out what happened. First the machine has not been online during the time frame of August '08 to October '09. During that time frame a security vulnerability was discovered, the MS08-067 Vulnerability. "This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system remotely. On Microsoft Windows 2000-based, Windows XP-based, and Windows Server 2003-based systems, an attacker could exploit this vulnerability over RPC without authentication and could run arbitrary code." This vulerability was fixed with the KB958644 Security Update which came out in October 2008.
Because the machine was offline at the time and missed out on this update, I believe that this vulnerability was exploited soon after the machine came back online in October of '09. I found references to a bycnboy.exe program which has been described as a backdoor program which then creates much havoc on an infected system. Soon after the machine was online, automatic updates installed the patch which closed off the ability to have remote control of the system. Because the backdoor was now closed, I believe that the attacker then created physical accounts on the machine and was able to utilize the machine for a further week until I noticed what was happening.
After agressively pursing the malicious code, .exes and .dlls, removing self hosting websites and user accounts, the machine is now again in a working state. For the near future I will be monitoring the system and reviewing the server logs to determin if a repeat of the incident is happening.
Thank you for the information and steps that were provided.
I'm thinking of repurposing a Dell XPS 1710 laptop (dual core 32 bit CPU, 3 gigs of RAM) for a virutal networking machine. Should I use Server 2003 or Server 2008 as my base operating system for this? What would be the advantages and/or disadvantages of each OS?