TeamSpeak Server keeps getting hacked

DogSoldierDogSoldier The heart of radical Amish country..
edited March 2007 in Spyware & Virus Removal
I need some expert advice and I couldn't think of a group more qualified than this one. The problem is that our TeamSpeak server keeps getting hacked. The server itself is not public, it's completely private. The same script-kiddie is constantly getting access and I'm unsure how. I don't have root access in order to log the kiddie. The TeamSpeak forums had some good advice http://forum.teamspeak.org/showthread.php?t=23726 So I've disabled a number of permissions for SA. I've revoked the ability for SA's to Grant SA's and revoke SA's. Disabled the ability for SA's to remove a users registration or delete players. But one thing I didn't do was limit the amount of SA's. Since the TS got hacked last night, I will be deleting everyone's registration and starting over with usernames and passwords I will be assigning. My fear is that among our 20 users there is someone running a trojan/keylogger and doesn't even know it.

What are the steps to verify that a computer is clean of trojans and keyloggers?

I'm thinking of having everyone run Hijackthis and sending me the log. Then having them run some type of scanner.

Comments

  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited March 2007
    Wait - just to be clear - this is a windows box, right? Is it Windows XP? Win2K Server? 2K3 server?
  • DogSoldierDogSoldier The heart of radical Amish country..
    edited March 2007
    I couldn't tell you the server OS. But the TS version is v2.0.r20.b1 Win32
  • TroganTrogan London, UK
    edited March 2007
    If you want to post a HJT log from every computer - go for it. I'll check them for you.
Sign In or Register to comment.