Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

Given the hack listed here how should I go about migrating to a new server?

Lets assume for this migration that the new server is:

Windows Server 2008

Fully patched

IIS 7

No physical access to either server (just FTP access)

The "good" news is I have backups of the websites, the bad news is they are old and 9 times out of 10 they are much out of date. What methods are there for migrating from the old server to the new server without migrating any backdoor(s) or hacked files to the new server? I'm guessing part of the migration is visually checking each file before copying it over, anything else I should be aware of?

share|improve this question
Are you a sysadmin? – random♦ Apr 21 '11 at 0:11
@random♦ - The server is hosted elsewhere. I have full FTP access to iis root for both server. Any IIS changes (i.e. setting up the site on the new server and turning off the sites on the old server) require a phone call to the hosting providor(s) – Justin808 Apr 21 '11 at 0:14
You might benefit from considering an open source alternative to MS-IIS (which is not open source) such as Apache HTTPd, and look at some of the open source ASP compatibility solutions -- if your ASP code isn't doing anything complicated nor relying on oddball stuff like undocumented system calls (as was somewhat common back in the DOS days), then such a conversion could prove very beneficial to you. Since all the software I'm suggesting is free, there would be no licensing fees so setting up a test system in VirtualBox.org makes it easy for you to determine if this may be a realistic option. – Randolf Richardson Apr 21 '11 at 2:14
(The beauty of popular open source projects like Apache HTTPd, OpenSSL, etc., is that a large number of developers are actively looking for security risks, mostly with the intention of fixing them. If the hack was due to a problem with MS-IIS, then you'll have to be willing to wait for MS to fix the problem if the open source solution doesn't meet your needs.) – Randolf Richardson Apr 21 '11 at 2:16

1 Answer

up vote 0 down vote accepted

Judging by your other question, you should probably wait until you figure out how they got in before moving it.

It may just be that the XP's SP2 host got infected by one of several means (someone using the machine to surf? Is there a firewall? etc.). Whomever controls it should be able to help you figure that out, if they're willing.

If it is the host's problem, then moving it to a better host is the answer and you just need to clean out the existing remnants. As you say, basically by checking each file for hacks, and for things like 'extra' files, and unexpected off-site links, etc.

Otherwise, it's a hole in your web-accessible code (SQL injection or alike) and you, or whoever wrote it, should be able to figure it out, and it will need to be patched before bothering to change hosts or it will just happen again.

Hope that helps..

share|improve this answer
The machine should only be used as a webserver. No other activity should be happening on the box at all. If i'm not mistaken this is actually a VM in a server-farm somewhere. As for the SQL injection nothing is happening to or on the database or the database server (different box) and there are no forms on the site to try to inject SQL from. – Justin808 Apr 21 '11 at 0:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.