[Help] Hacker Editing my server - Ports closed

Hi.

Some days ago, someone is messing up with my server, switching muy users's races, editing items with 00000000 serial, blocking characters and accounts and stuff, i have my ports closed, so i don't think it's a blaster, i even installed SyGate but somehow this guy is still messing up with my server, i use a Secure asp + Muweb 0.4 Website, i just ran out of ideas, so if anyone can help me, i'll be deeply appreciated.
BTW, my SyGate log looks like this:
Application Hijacking has been detected
The application: C:\WINDOWS\system32\userinit.exe try to launch another application: C:\Archivos de programa\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe to go to remote host 255.255.255.255

Andraxxus.

really insteresting..if u know his ip ban him with sygate..please let me know reply back :D.

:D xex... then u was installing ur web :D someone installed to so he manage accounts chars he can make gms block chars unblock them... and etc... i like to do that with dumbass admins witch dont delete install folder. Try to rewrite ur web ...
And about that hijacking thingy ... :D i have much attacks and hijackings showing in my firewalls... about ur fw message i think startup was trying to start mssql server remotly and firewall blocked it... attacks might be caused by many things... IRC servers they scan ur ports for backdors... and etc...

well yea maybe he just started when u finished your website so..he installed ur site on his sql..and made these kind of things..that is just a hole in da water..Coz just this tip/trick they know to do ;)

Maybe, i just don't know how he's doing all this.
And BTW, i did delete my install folder, so it's not that. And i triple checked my ports, this is driving me mad xD

ofc..Thats absolutely pathetic..i hate hackers..im trying to stay calm..Anyway just at 97 i cant face them at the rest..i can pwn them ;)

haha that guy must be clever to do that lol

Quote:

---

Originally Posted by Andraxxus

Maybe, i just don't know how he's doing all this.
And BTW, i did delete my install folder, so it's not that. And i triple checked my ports, this is driving me mad xD

---

I think he registered on ur site before of you... u still can reistall ur web ... and did u changed ur SQL User : sa , password ???

I think he's doing it through SQL Injections,
There are some guides in the guides section on how to prevent it.