well this problem is making me go nuts my server was hacked with the Mirai Botnet, we cleaned the system, Disabled the Server Agent completely and the system is stable and clean BUT...
if i re-open that sql server PC to the internet ( port 1433 ), it gets reinfected..
i experimented with all the logins and found out that if i leave the "BUILTIN\Administrators" login, that's what makes the botnet reinfects it.
the client which infects me is called "Microl Office", it originates from various assumingly hacked PCs, and the strange thing is that it authenticates as "NT AUTHORITY\ANONYMOUS LOGON"...
i deleted the model and msdb and recopied the ones in template in order to clean the server, still the same thing happens if i Leave the Builtin administrators.. soo i guess that botnet added the ANONYMOUS LOGON to the administrators group ?
btw i reinstalled another instance and different version and still the same thing happens so it's not an SQL issue i think.
Login succeeded for user 'NT AUTHORITY\ANONYMOUS LOGON'. Connection made using Windows authentication. [CLIENT: 220.127.116.11]
Also, if i use the BUILTIN\Users instead, it doesn't login and it fails with an error "Token-based server access validation failed with an infrastructure error" So i THINK once the server was severely infected, the malware somehow added the anonymous logon to the builtin administrators group
So can anyone tell me how can i SEE all the added users to the administrators group ? ( and yes the group has only my user as the Admin user when accessed from computer management )
can anyone please suggest anything in that matter ? ( Windows Server 2003 R2 and SQL SERVER Enterpise 2005 + 2008 sp1 )
options I tried:
- set LSA blockanonymous to 1
- set allowanoynomous to 1
- disable SID translation
- check the administrators group from computer management