Nt Server - easy method to stop Server.exe - virus

Paddyo
Paddyo used Ask the Experts™
on
Hi

I have an NT Server with a process called Server.exe running. According to Sophos this program is the Troj/Srac-102 virus.

The process cannot be stopped and thus the program cannot be deleted.

Is there an easy way to stop the process and thus delete the program.

Hope someone can help

Paul
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®

Commented:

Just a quick suggestion, delete the registry key from HKLM\Software\Microsoft\Windows\CurrentVersion\
Run\ that starts server.exe, run your virus software and then reboot.

Worth a try anyway.

Author

Commented:
Thanks rj-smith

I have passed the customer onto Sophos who hopefully will be able to sort them out.

If they cant help I will try your suggestion and let you know what happens.

thank you once again
Top Expert 2007

Commented:
If they do not want to fool with the registry directly.
Here is a free program that allows you to see ALL the startup stuff and disable it as needed.

Download the Startup COP a free pcmag utility from
http://www.pcmag.com/article2/0,4149,2097,00.asp
 Run it and it will show you everything that is listed in all the possible startup
places, and allow you to disable things one at a time until the problem is eliminated.
 A lot of probelms are caused by excess old baggage - programs that have not been properly  un-installed. Startup Cop will eliminate leftovers and un-wanted programs that you no longer want.
Older Antivirus programs and Norton Utilities have been known to cause problems
try disabling them also !

I hope this helps !
Announcing the Winners!

The results are in for the 15th Annual Expert Awards! Congratulations to the winners, and thank you to everyone who participated in the nominations. We are so grateful for the valuable contributions experts make on a daily basis. Click to read more about this year’s recipients!

Author

Commented:
Thanks SysExpert

I dont think this progam will run under Nt Server.

It will come in useful for some other problems.

thanks again
try runing msconfig and look up server.exe in the startup

Author

Commented:
Thank you for all of your comments - I should have deleted this question as it was sorted out a good while ago.

Commented:

Paddyo,

Let us know how the problem was resolved. That's kinda the idea behind this whole thing...
Commented:
Sorry ri-smith

Sophos actually resolved the problem by getting the user to boot into 'safe mode' on the server and managed to remove the program from there.

Paddyo

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial