Security question

[DannyH]

Hi Guys,

 

 

I have an urgent security question to ask, I am running Uniform Server 3.3

 

I have 5 websites setup using Virtual Host. And 2 users in House have access directly into the WWW folder as they are updating the websites all the time.

 

Today 2 off my websites had been deleted completely out of the WWW Root Apart from one folder - the administrator folder in one of our Joomla websites

 

Now my first thoughts are that someone in house has be doing something they shouldn’t but is it possible that someone has hacked into my server to cause this?

 

Is there anyway that I can perform a security test online to see if I’m at risk?

 

Any help on this would be greatly appreciated

 

Danny

[Ric]

I think it could be worth looking at your log files for a clue!

 

All the best

Ric

[DannyH]

Thanks for the reply Ric,

 

Now this is interesting it only started since Joomla has been installed and when I was working on one of our sites yesterday morning my computer shut down unexpectedly while I was logged into the Joomla control panel, this could be why!! Last time this happened I think it was a similar thing

 

And now I am getting this message pop up on the server every so often, and when I do get this message if I’m viewing the website internal sometimes it may freeze for about 5 Seconds resulting in the error below.

 

Apache HTTP Server has encountered a problem and needs to close. We are sorry for the inconvenience.

Please tell Microsoft about this problem.
We have created an error report that you can send to us. We will treat this report as confidential and anonymous

To see what the error report contains click here

Error signature

AppName: apache.exe	 AppVer: 2.0.55.0	 ModName: ntdll.dll
ModVer: 5.1.2600.2180	 Offset: 00011223

 

 

I found this in some of the error Log file, not sure if this has anything to do with my problem ?

 

 

[Wed Oct 01 12:54:52 2008] [error] [client 74.125.75.17] Invalid URI in request GET /noexist_3065a167511c75f0.html HTTP/1.1
[Wed Oct 01 12:55:05 2008] [error] [client 74.125.75.17] Invalid URI in request GET /noexist_3065a167511c75f0.html HTTP/1.1
[Wed Oct 01 12:55:57 2008] [error] [client 74.125.75.17] Invalid URI in request GET /noexist_3065a167511c75f0.html HTTP/1.1
[Wed Oct 01 12:57:55 2008] [notice] Parent: child process exited with status 3221225477 -- Restarting.
[Wed Oct 01 12:57:55 2008] [notice] Apache/2.0.55 (Win32) DAV/2 PHP/5.1.1 configured -- resuming normal operations
[Wed Oct 01 12:57:55 2008] [notice] Server built: Oct 28 2005 02:08:11
[Wed Oct 01 12:57:55 2008] [notice] Parent: Created child process 3784
[Wed Oct 01 12:57:56 2008] [notice] Child 3784: Child process is running
[Wed Oct 01 12:57:56 2008] [notice] Child 3784: Acquired the start mutex.
[Wed Oct 01 12:57:56 2008] [notice] Child 3784: Starting 250 worker threads.

 

 

All our internal machines access the website, now this is just a thought, each internal computer that accesses the website go through the router, now many years ago I had a similar problem with running PHPBB and found that I had to change the C:\WINDOWS\system32\drivers\etc\host file and point this to my local server

 

This resolved any issues I was having then so I probable need to do the same again

Or do you think I need to upgrade my US to the latest addition

 

Many thanks for your help

 

 

Danny