What can I do about this hack to our NT server?
This clue was left behind...

"GoD    Library VB This tool hacks your system you (expletive deleted) admin.
Geklauter key gefunden GOD Library VB"
"God lauscht auf port 456, und IP ___.___.___.__ (our IP range)

Hi,

Thank you for your question.

Your server is infection with the Hackers Paradise trojan.

Please see this page (search the page for "456"):
http://help.undernet.org/protect/

Here is some information about the trojan:

Hackers Paradise port usage
http://www.glocksoft.com/trojan_list/Hackers_Paradise.htm
http://lockdowncorp.com/manual/CommonPortLists.htm

Description and removal instructions
1-) http://www.dark-e.com/archive/trojans/hp/2beta3/index.shtml
2-) http://www.pestpatrol.com/PestInfo/h/hackers_paradise_2_b3.asp

You should also scan your system with a virus scanner:

Housecall
http://housecall.trendmicro.com

To protect your system you will need a firewall such as ZoneAlarm from ZoneLabs:

ZoneLabs
http://www.zonelabs.com/store/content/home.jsp


I hope this answers your question, if you require and more
clarifications please do not hesitate to ask.

Thanks.
endo