title: linuXploit_crew hit my webserver
body: <p>We run an old Windows NT Machine, fully patched running IIS4.0.</p>
  
  <p>Today we were hit by "linuXploit_crew", and they took down our websites for a minute or two. (luckily we were quick to notice a change on the websites and fix it within minutes of the attack).</p>
  
  <p>However -- After fixing the website, I'm left with trying to figure out <strong><em>HOW</em></strong> this happened.</p>
  
  <p>Looking in our FTP Logs, there's no changes in our default.asp files, and I see nothing out of the ordinary for Web Logs.   Any ideas on how to pinpoint how they got in?  We've only got 3 ports open, FTP, HTTP, and HTTPS (21,80,443) on a Cisco Firewall. </p>