0

I run a windows server 2008 which I connect to both via VNC and via remote desktop. Yesterday I noted when I connected to it via VNC that another user was logged in. See images.

Notes:

  • I have no idea what ASP is. It seems to be a guest account when I looked it up in accounts as Administrator.

  • I have no idea what "SCOOTER-PC" is.

  • I tried my usual passwords to log in as the ASP-user, but these were incorrect.

  • I have not seen this before, and as I just recently started using remote desktop I figure it might be that that session somehow is still being active.

first screenshot

second screenshot

|improve this question
  • I think the policy here should be delete the user and ask questions later. – RoraΖ Sep 17 '14 at 12:20
  • I changed password on the "ASP" user account and then restarted the server which included installations of latest updates. Should I still delete the account? – user3607022 Sep 17 '14 at 12:27
  • My best guess is that you server is compromised. [Act accordingly][1]. [1]: serverfault.com/questions/218005/… – agtoever Sep 17 '14 at 12:32
  • It's your server, if you don't know the user I would delete it. And run an antivirus on it. – RoraΖ Sep 17 '14 at 12:33
  • Many thanks for you replies. I have two follow up questions. 1) If it is compromised, do you have any ball park estimates of the risk that this user, logging in with a guest account, has been able to access the My Documents folder of the Administrator account? 2) why would antivirus help against hackers? Is that to remove any trojans? – user3607022 Sep 17 '14 at 12:43
1

Your server seems compromised!

the steps you should take is to immidiatly make a IP scope for the remote desktop and VNC application in windows firewall so only the IPaddress of the remote (or LAN if its in the same network) should be able to acces this!

Also, the user ASP should be deleted at once, be sure to run antivirusses like Malwarebytes and install updates to make sure there isnt a keylogger, and change the passwords for the Admin (and all other users if there are any).

good luck!

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.