Help.

I have a W2K3 Standard based box with Server Matrix. I use IIS 6 to host 4 web sites on it - 3 of which have a FTP account, with anon user disabled.

Today I discovered that it's being used as a pubstro. My searches on Google have netted me some information but the server really does feel infested now.

So I'm looking for advice on 2 fronts. First off. Should I just request an OS reload with a formatting of the hard drive and just start again from scratch? I just ordered the book, 'CYA Securing IIS 6', and hopefully it might show me where I went wrong, and help me prevent this happening again.

Or is there a simpler solution to remove this parasite from the server?

And looking ahead, what can I do to help prevent this from happening again? I'm not currently running a firewall for several reasons. First off - the cheapest firewall option Server Matrix offered when I purchased was about $100 per month for a hardware option which is $20 more than my actual hosting! Is this expensive option something I�m just going to have to go with?

I did try to use the built in firewall with the OS but it didn�t allow me to open all ports to a specific ip range � which is required for service monitoring by The Planet.

I really feel very exasperated with all this and am beginning to regret going with the M$ option in the first place, but as I know nothing about *nix, I had little option.

Any advice anyone has would be very much appreciated.

Hoss.

Personally - Id reload the OS and start new. Tracking down problems can happen, but most of the time you wont catch it all, and if you do it isnt just a click of a button. Takes time and money to pay admins to do it if you dont know how to fix it yourself.

Microsoft can be secure if you know what you are doing. If its what you know best, there is nothing wrong with choosing it. getting a server hacked almost seems a reality far to often now-a-days. Reason why a good disaster recovery plan is a must-have.

For me I will reload also, u dun know what they have put in, maybe a backdoor or something and it is very tedious as Cope says, to track, and tracking to a foreign IP basically will not help u catch them......most of the time they use the 3rd world countries vulnerable servers......impossible to catch.

That seems to be the consensus of opinion - putting it down to experience and start afresh. I've only had the server a few weeks and nothing criticical (or even slightly important) is hosted there at the moment - so a reformat and os load isn't too much of a hassle to me.

As soon as this book arrives I'm going to read it cover to cover before activating IIS again.

On the upside, every cloud has a silver lining - the hackers have placed 40 gig of hardcore German porn on the server. Result.