server hacked, help plz !

[GoNz0]

we have a machine that keeps going down, we lose RDP and all game and voice services, you can ping the box though, it just did it again and i logged into the PDU and rebooted it, i managed to RDP in at bootup to be met with this



as soon as it ran i got booted and had to restart the machine again to get control. i have ran a hijackthis and cant see anything, the file checker.exe didnt throw a virus warning when i just downloaded it to my pc, bit bigger than most virus files i came across at 2.36 mb

question is how do i find out whats going off ?

[Mblaster]

Not come across anything like this before but I'd set up a virtual machine to run checker.exe in and try and find out what it does.

Also, in the meantime I'd review the security to make sure he can't get back in again, change passwords, check firewall configurations etc. It's a game server from the sounds of it so probably no sensitive information on there to steal luckily.

Also, is your server running XP? ...

[Phage]

Appears to be a worm.
http://www.symantec.com/security_res...322-99&tabid=2
I'd nuke the whole thing from orbit and re-install. It's just cleaner.

[GoNz0]

yes its xp, its more games friendly

and nuke a rack server, start again, well theres the silly quote of the day

its 120 miles away and not a simple reinstall

[Jay]

block all access to it via the firewall apart from your IP

[Jiff Lemon]

then ask yourself "how did it get hacked?"

[GoNz0]

kaspersky got nothing, malware bytes found a backdoor

Malwarebytes' Anti-Malware 1.44
Database version: 3531
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

09/01/2010 22:07:22
mbam-log-2010-01-09 (22-07-22).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 171912
Time elapsed: 36 minute(s), 1 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
C:\WINDOWS\system32\logon.exe (Backdoor.Bot) -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\prilogon (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\logon.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

[aidanjt]

yes its xp, its more games friendly

It's a server, it doesn't have to run the actual games. You need to seriously consider whether the games your server daemonise are actually Windows exclusive at all. You'd be surprised at just how many games run natively on Linux, or more relevantly, their dedicated server binaries. At the very least, all the id, steam-dedicated, and unreal games are covered.

[watercooled]

then ask yourself "how did it get hacked?"

And then install Linux

And as aidanjt said there are a lot of game servers for Linux even if the game itself doesn't have a Linux version.

[GoNz0]

And then install Linux

And as aidanjt said there are a lot of game servers for Linux even if the game itself doesn't have a Linux version.

*sigh*

[CAT-THE-FIFTH]

Chaps the server is in a rack!!

This could get dangerous!!

[watercooled]

What about Linux in a VM then?

[CAT-THE-FIFTH]

Nobody got my joke then??!!

[TAKTAK]

Nobody got my joke then??!!

Maybe Saddam is tinkering with it. Oh... Wait... No...

[GoNz0]

What about Linux in a VM then?

do you never have anything constructive to say apart from try linux or boot a live cd ?

Nobody got my joke then??!!

just

[Mblaster]

It's a server, it doesn't have to run the actual games. You need to seriously consider whether the games your server daemonise are actually Windows exclusive at all. You'd be surprised at just how many games run natively on Linux, or more relevantly, their dedicated server binaries. At the very least, all the id, steam-dedicated, and unreal games are covered.

As he said. My only experience of running a game server was in Unreal many years ago, and even then they had a separate dedicated server install as a cut down version of the game with none of the 3D stuff, they even had a linux version too.