asked on

GhostRadmin/r_server.exe problem

I found GhostRadmin in my server which is a DC/exchange server.

Does anyone have recommand software to search Trojan and Malware and remove them?

also I found the exchange server service 'information store service' is down several time, but it can be restart. Is there any relationship with the trojan?

after I remove this virus, what do i need to do to protect my server?

Thanks a lot!

paraghs

GhostRadmin is a 'dropper' to silenty install radmin..intended almost always for use as a trojan.

GhostRadmin has the following files:

editor.exe (6 Kb)
FSG.EXE (65 Kb)
server.exe (2.5 Kb)

What "Ghost Radmin" does is downloading r_server.exe and AdmDll.dll files to the targent machine without notifying the user, nothing more. These two files are also included into the package.

Here is a copy of the Ghostradmin instructions:

Ghost Radmin 1.0
Coded by illwill in ASM
9/18/03

===========================================================
a 1.26kb program that silently installs Radmin on a
remote computer for win9x/me/nt/2k/xp.
basically it downloads the radmin server and dll from the
web and adds the proper registry keys for it to function.
===========================================================
features:
* only 1.26 kb
* installs radmin with a password of 12345678

Instructions:
first get a website
1. extract all files from zip to a folder
2. open up editor.exe
3. select the [...] to browse for server.exe
4. once server selected press read
5. change the settings to your liking
a. url: web address of r_server.exe
b. dll: web address of AdmDll.dll
6. write the settings to the server
7. compress it then bind it with your trojan
===========================================================

I am not aware of any program to remove it. BTW, it is not a virus.

See if deleting the above mentioned three files helps.

elbereth21

Have you already tried with Ad-Aware SE and SpyBot Search and Destroy?

ASKER CERTIFIED SOLUTION

elbereth21

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial