How to tell if you've been hacked

[nigel99 608]

I run a small network (5 PC's) off of a Windows 2003 server that sits behind a low cost ADSL router/firewall.

The server goes through times where it runs out of resources and crashes 2 or 3 times a day and then will run quite happily for a month or so.

Nobody ever logs onto the server from inside the network (guaranteed) and the router/firewall doesn't have any incoming ports open. That said it is conceivable that tainted websites have been visited from PC's on the network (although they all run anti-virus software and don't crash).

Is there a possibility that the server has been hijacked or is it simply Microcrap? Any idea's would be welcome

Experienced jumper - someone who has made mistakes more often than I have and lived.

[SkyBastard 0]

firstly i'd go to GRC.com and run the 'shields up' test to check your firewall IS doing its job.

next, go to trendmicro.com/housecall and get it scanned, their online scanner finds alsorts of bogeys. only take it there, i assume it's not used for general net access (i hope not)

if you find trojans etc on your company server you should consider a total rebuild and it goes without saying you need to find out how they got there and make sure your other machines are clean. disabling usb on work machines can help, usb pen drives are a GREAT way for staff to infect your network.

without knowing what you're running etc it's impossible to say whether anything is untoward, could just be crappy config/hardware

Dude #320
"Superstitious" is just a polite way of saying "incredibly fucking stupid".
DONK!

[nigel99 608]

Thanks it all came up clean. It may just be getting long in the tooth - it is just irritating and I don't like wasting money. This server replaced an older one running Win 2k, but old system didn't have the resources to upgrade and kept "dying" on me. The actual PC is still happily running Suse Linux long after Win2K gave up on the hardware.

Experienced jumper - someone who has made mistakes more often than I have and lived.

[theonlyski 8]

Ever check the event log?

I've had a couple servers that would flip out on me and stop working, only needed to look at the event log to find the issue was something simple.

"I may be a dirty pirate hooker...but I'm not about to go stand on the corner." iluvtofly
DPH -7, TDS 578, Muff 5153, SCR 14890
I'm an asshole, and I approve this message

[SkyBastard 0]

yeah event log next, should give you a few clues.

right click computer and choose manage it's all in there, good luck!

also check the main programs you're running are the latest versions and latest updates for the OS are installed, uhm, bios updates are good also, make sure you get the right one or you nail it to the wall but i'm sure you know that, er.. yeah, event log, you might just have one screwy program :)

Dude #320
"Superstitious" is just a polite way of saying "incredibly fucking stupid".
DONK!

[theonlyski 8]

Also, could be a heat issue, maybe a power glitch.

See if the motherboard has its auto shutoff temp set, I know of atleast one computer that was having that problem. Ended up needing a couple extra fans to get all that heat out.

Open it up, blow the dust out, see if that helps any... Also look at all the fans, make sure they are spinning and not making too much noise. (Noisy fans usually dont produce the same airflow they used to)

If its not on an UPS, you're wrong.

"I may be a dirty pirate hooker...but I'm not about to go stand on the corner." iluvtofly
DPH -7, TDS 578, Muff 5153, SCR 14890
I'm an asshole, and I approve this message