Learn about Edgartown's quest to ensure the safety and security of the entire town's employee and citizen data. Read the case study!
Course Of The Month
8 days, 9 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
Weird Default WBDService
Posted on 2010-09-17
Ok guys, I'm a tech and network admin, and have come across something that has me stumped. I have a Windows 2003 server running IIS that hosts multiple web sites. About every 2-3 nights the system stops serving web sites completely. I have done some digging and have found a service installed called Default WBDService. This goes to a file called upsvr.exe. Description of the service is "Support Windows File Search Servers Databases.". When I kill that running process and disable the service everything works fine again. I have found nothing on this file name, service name, or description on the web.
Anyone have any thoughts? This has all the makings of a virus type file, or a backdoor, rootkit, something, but virus scanners say the file is clean. Have I been hacked?
Anyone have any thoughts? This has all the makings of a virus type file, or a backdoor, rootkit, something, but virus scanners say the file is clean. Have I been hacked?
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
-
4
2
6 Comments
Well, if you can't find that service anywhere online, it would lead me to believe that it's a rouge application. My first thought is that upsvr is taking over port 80 periodically as you say and confusing the server into not serving pages at all. Hence when you kill the service, IIS is once again able to serve over 80.
I just checked a couple 2k3/II6 machines that are actively serving pages and see no sign of this service. There's no harm in disabling it obviously, so why not do a search in regedit for upsvr.exe and just delete the keys (backup first if you are uncomfortable) see if they stay deleted/disabled.
what does uploading the file to http://www.virustotal.com/ have to say about it?
I just checked a couple 2k3/II6 machines that are actively serving pages and see no sign of this service. There's no harm in disabling it obviously, so why not do a search in regedit for upsvr.exe and just delete the keys (backup first if you are uncomfortable) see if they stay deleted/disabled.
what does uploading the file to http://www.virustotal.com/ have to say about it?
I've removed the service before and it comes back, leading me to further believe that, as you way, it's a rogue app. Any idea of a .Net application that another user has done could possibly be causing this? Nobody else has access to this server to install anything, at least not that I know of. I have one web app on that is a .Net app that the coder who did it is not very experienced. I've been blaming my locking up issues on that app until I found this not too long ago.
I think your assessment of the situation is accurate - was just hoping someone would recognize what this service and / or file might be doing.
Not familiar with VirusTotal. Thanks for that info!
I think your assessment of the situation is accurate - was just hoping someone would recognize what this service and / or file might be doing.
Not familiar with VirusTotal. Thanks for that info!
I have tracked down some more info. From VirusTotal.com I get a response of BDS/Backdoor.Gen from Avira. There's another file that is suspicious that I've found that resembles something important that may be related as well - labeled as "Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\Windows\System32\msdtcs
yeah, msdtc is a valid service, msdtcsvc is definately malware. Since Avira seems to at least recognize it, you could use Avira's portable boot CD to clean the files: http://thepcsecurity.com/virus-scan-boot-disk-from-avira/ you'd have to bring the box down for an hour or so, but better that than a day down the line.
I think I'm going to one even better and move the sites I have on here to another server and just reload this one. Thanks for the comments back and forth. Always helps to have a second opinion on these things.
Featured Post
Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
Periodically we have to update or add SSL certificates for customers. Depending upon your hosting plan you may be responsible for the installation and/or key generation. In the wake of Heartbleed many sites were forced to re-key.
We will concen…
While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.
Suggested Courses
Course of the Month8 days, 9 hours left to enroll
734 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.