I need more security for my IIS webserver...

[RainMaQer]

Ok... I was putting some files into my web server directory and noticed 3 new files: winnt.asp, space.asp, and patch2k.exe. I have NO idea what they are or where they came from. Two were created yesterday and one on the 31st of March. I don't know if they're supposed to be there or not... never seen them before and I would have noticed. I can access the space.asp from my browser and it has links to my drives... ummm... not good.

First of all... are those SUPPOSED to be there?

Regardless of that... what can I install to prevent ANY hacking... I know WinXP has a built in firewall... but I'm kinda funny with using it... is there something else? Or should I just use that?

 

[Kingslayer]

IISLockdown and urlscan.exe (which is a part of Lockdown) Both of which can be found at the website we all know and love....

www.microsoft.com

 

[RainMaQer]

IISLockdown and urlscan.exe (which is a part of Lockdown) Both of which can be found at the website we all know and love....

www.microsoft.com

Thanks Kingslayer... any idea if those files in my server directory are legit? Or should I be concerned?

 

[Kingslayer]

I just did an update to the webserver here at work and then did some checks on those files. I dont have them. Not saying it's not legit but I would be suspicious to err on the side of safety.

Go into the file properties and see who last modified the files. If it says IIS User or Administrator and you didnt put them in, cut and paste them to a floppy. (that way you can put them back if you find out you need them)