>I have a database site using westwind and it works GREAT.
>
>HOWEVER, yesterday someone has "hacked" into the site and every time I try to open ANY westwind page, it gives me a page saying the site has been hacked by the Chineese.
>
>All requests that go through WC.dll get that same page.
>
>The request does show up in westwind, and the PRG has NOT been changed, but te page returned is always the same.
>
>Somehow the WC.dll seems to have been changed, but it is NOT a new copy of the dll so it has NOT been changed.
>
>It is like IIS is sending the request to both wc.dll and something else.
>
>HELP!!!!!!!!!!!!!!!!!!!!
>
>I have turned the siote off, but will turn it back on if anyone wants to see what is going on.


Do your server logs show any strange accesses?

Check the Security event log for strange logon attempts. Check your IIS web-site logs to see what requests were made to your web server. The hackers may have used the 'unicode' bug to execute DOS commands on your server. These should show up if you search for 'CMD' in the log.