You Who?

Geek Eye for the Hacked Guy

Am I hacked or not? I'm pretty sure I'm not... I patched our Windows 2000 server for the RPC DCOM exploit on Aug 4. On Aug 7, I noticed some weird errors in the Event Log which mentioned "RPC" and IIS was acting a little weird. Was I hacked? Was a hack attempted but failed? Is it just normal Windows flakiness? At this point I am leaning towards "not hacked" -- I mean the various Blaster worms didn't show up until this week so... And right now I have the firewall locked down pretty tight so... Yeah yeah, I'll probably still rebuild the server just to be safe. It could use it anyway. It'll give me a chance to chase down all those other chronic errors in the log. What I really need is five fabulous sysadmins to come in and give my server a complete makeover.