Hi All,
First post and I hope it is in the right area.
I did some searching but did not find an answer so I decided to post a question.

A new customer has a windows 2000 server sitting behind an plain old Netgear home router. They called me up last week because the server was slow. I found a .temp folder full of sub folders many levels deep. Some were named something like "scans by bob" or "uploaded by harryz" and eventually had hidden files in them. I could not delete them from windows, even in safe mode they said "file not found". I had to boot to a Linux Mint cd to delete them. I know, I should have kept better track of them. The customer was in a panic and I needed to get him up and running.
There was only 1 gb of free HD space left when I got there. Cleaning up the folders made the machine run decent again.
Now, obviously someone has access to the machine and is storing stuff on it. I didn't see any unusual accounts on it but terminal services is not the only way in. Do any of you have any ideas as to what somebody is doing and how to prevent it?
Your advice is appreciated.

Hi

what are the logs showing?

I'll have to go check. Which particular one are you interested in?

System and Security would be of particular interest

The Security log is empty but the System log is full. System log is attached.

systemlog.evt.zip
Description:		Download
Filename:	systemlog.evt.zip
Filesize:	12.93 KB
Downloaded:	15 Time(s)

Anything else?