IIS WP modify permission & server compromised?

[mo753]

Hi, My server (using plesk 8.1 windows) has been compromised with some sort of rootkit and I'm investigating vulnerabilities. This server hosts some asp.net applications and I have to grant Modify Permission to IIS WP(iwam_plesk) user on Some subfolders (under Httpdocs folder for each domain). Is it a possible security problem? if yes, how can I allow asp.net applications to write to, say, an Access db? I really appreciate a prompt reply because I have to finish setting up a new machine today and move websites from compromised one.

 

[jacobfogg]

same problem!

My server got hit with this too.. 'rdrive.sys' a pretty nasty rootkit, reaped major havok including persistant bluescreaning... Word on the street is that the latest SWsoft update download was laced with the rootkit. no other explination at this point... ended up having to backup data and reinstlall the server!

 

[mattd2173]

If you read this thread:

http://forum.swsoft.com/showthread.php?s=&threadid=41317&perpage=15&pagenumber=1

They seem to think it was an exploit in MailEnable 2.35 (All Versions), which was patched back on Dec 18th with a hot fix and in version 2.37. I don't believe it was the latest update to plesk, because I did not have it installed and was still effected by the attack.