index.htm and index.html removed from iis 5.0

[GerritR]

My IIS has been hacked for two times now
Somebody is able to remove the index.htm and index.html from the settings from 1 homepage in my iis server default.html etc are still there.
I have installed all security patches.
What can this be.
So it's not the files from the directory (they are still there) but de settings from the homepage properties page wich I manually added.

Please adv,
Gerrit

 

[koquito]

try auditing on

http://wwwroot.

Are you sure it came from outside? A+, MCP, CCNA
marbinpr@hotmail.com

Keep fighting for your knowledge!

 

[GlenJohnson]

Do you have a firewall? Look at the log files in c:\winnt\system32\logfiles and see if anything is odd. Good luck. Glen A. Johnson
Microsoft Certified Professional
glen@nellsgiftbox.com


"A person often meets his destiny on the road he took to avoid it."
Jean de La Fontaine (1621-1695); French poet.

 

[GerritR]

The guy who did this may have had access to the directory by ftp. The directory can only be accessed over his/her own ip port. But it is still a miracle to me how he could configure IIS, because the files where still there.

Is this possible ?

Thanks for helping,
Gerrit