Help! Hacked!

my IIS 5.1 webserver was hacked by some turkish guy named ozan... he was nice enough not to wipe out my default file, but he was able to leave this html file on my server. HOW did he do this, the only port open on my router is port 80.....

i would like to know HOW he did this, and what i can do to prevent it, or prevent any further instances..

thanks.

Im not the hacker type, i find more joy in being constructive than destructive.

I would consider auditing your IIS_USR account priviledges, and downloading the latest Security patches from Microsoft.

The company I work for uses a software package called WebAgain. This program constantly monitors your website for changes (comparing it to the archive copy that you set up) and if it senses a change, it immediately overwrites the change with what is in the archive! This is handy for preventing defacement and hacks. We've never been hacked before, but if we were, it would be immediately fixed!

automatic updates are on.. i have norton running 24/7...

do you mean making the site read only?
would that affect my database applications? the databases are held in another directory not in my webserver directory.

the internet guest account need only have read-only access to your wwwroot directory (or equiv). NEVER give write access to the internet guest account. Should you need to allow your users to upload files/access the file system you should provide a way to to this through an appropriate client side interface, or using Windows NT permissions.

You should access your database with a user who has sufficient permissions to do the task that are required, and nothing more. If possible, you should use only stored procedures, because you can manage database permissions better.

If you require any further information, you should refer to your servers'/microsofts' help files, or you can post questions here.

Front Page extentsions are a common way to get defaced. Also if you have dynamic codes, such as ASP or ASP.NET. I disagree with A2k on the whole never give write access to IUSR_MachineName, most hosts give this write, as it is a royal pain to give out this access. My best bet is you got hack through a vuln in Frontpage Extentsions.

Make sure you keep your Windows updates current. I didn't once on a box I forgot was running IIS, and got nimda'd

yeah, i got nimda the first time arround..
but apparently someone is trying to hack me again..

they have 27 sessions open..

http://port80.cjb.net/default/?cat=getstats

i recently upgraded to sp2
how can i disable frontpage extentions?

You can remove the fp extensions from a website using the IIS management console.