Covani

Hello, I have installed MySQL and phpmyadmin to my Windows 2003 Standart server yesterday. I've entered a root password and had successfull created some databases. Also I have installed Php 4 on the server. Today I had a big problem on my server, because all the files starts with 'user' were deleted (users.dat, users.mdb, user.frm etc) Mailserver didn't work anymore because there was a missing file named users.dat etc. After that I tried but I wasnt be able to create any files wherever starts with 'user'. I tried on command prompt, but cmd.exe was changed as Windows 2000 polish version. If typed 'ver' on command line, get Windows 2000 Server etc.. with some polish words. Microsoft Windows 2000 [Wersja 5.02.3790] © Copyright 1985-2000 Microsoft Corp. C:\Dokumente und Einstellungen\Administrator> // C:\Dokumente und Einstellungen\Administrator>dir Wolumin w stacji C: Mom Numer seryjny woluminu: 78BA-92E9 Katalog: C:\Dokumente und Einstellungen\Administrator I thought the server was hacked. Symantec Antivirus Corporate was up to date but I think it was caused the new mysql installation and I did something wrong. Now I have scanned the server with Symantec again but nothing found. I still can't be able to create files/folders starts with 'user' and reinstalling mysql doesnt work too. there's also a file .bat file in c:/windows nvsvc.exe /install /silence net start R_Server etc.. Do you have any idea about the issue? or did hear something like that?

hi sampson, thank you for your reply. I was looking for the worms whole day. you are right, the server is infected with worm. if I check netstat on cmd, I can see some ports open and listening by com.pl addresses. but i dont understand how to get infected. it's possible because of the mysql installation, at the beginning I was entered 123456 as password, but that was for short time. so i will let reinstall the system and look now for more security except symantec corporate. do you have any suggestions to use good firewall for windows standart server 2003?