Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Servers badly infected with viruses

Posted on 2011-09-20
4
337 Views
Last Modified: 2012-05-12
I am trying to help out a freind with a small business.  He has two windows 2003 server (one domain controller and one member server).  He has a couple of small offices use remote desktop into the member server at the main office.  Remote desktop stopped working and he got a call from his ISP saying there was a huge amount of spam coiming from his internet connection.  He didn't have any anti virus on the servers, so I had him buy the AVG server product and I installed malwarebytes.  Both AVG and Malwarebytes found a bunch of viruses on the servers.  It supposedly cleaned the servers, but he still had a problem with remote desktop connections.  I booted both server into safe mode and scanned them with both products.  Malwarebytes found a virus on each server and the AVG found nothing.  Malwarebytes apparently removed it and once I rebooted back into normal windows mode, remote desktop started working again just fine...until about 10 minutes later, when the same problem started happening again.  I am now back in safe mode doing scans again, but I need to find some heavy duty virus scanning products that will get rid of this.  Any ideas???

I wanted to post the name of the virus Malwarebytes found, but the log didn't get saved so, I'll post back again once this current scan get's done (assuming it still finds the virus)
0
Comment
Question by:jbobst
4 Comments
 
LVL 7

Assisted Solution

by:Hamid Reza Molahadi
Hamid Reza Molahadi earned 100 total points
ID: 36571734
Download this file: http://rescuedisk.kaspersky-labs.com/rescuedisk/updatable/
write it as a bootable CD and then boot your computer with that, it's clean your servers!
0
 
LVL 17

Assisted Solution

by:Sikhumbuzo Ntsada
Sikhumbuzo Ntsada earned 100 total points
ID: 36571904
Since you already have AVG, try and get support from them they should be able to either connect to your site or ask you to upload the logs for analysis so that they can give a patch to clean the registry entries affected.
0
 
LVL 38

Accepted Solution

by:
younghv earned 300 total points
ID: 36573313
It is no longer sufficient for us to simply run tools/scanners such as Malwarebytes or an AV program.

Many current malware variants require that we use one of the 'rogue process stoppers' prior to doing the scans.

Here are more EE Articles with the details:
Rogue-Killer-What-a-great-name
Basic Malware Troubleshooting
Stop-the-Bleeding-First-Aid-for-Malware

Both Roguekiller and MBAM are safe for Server platforms. In most situations, a basic "AV" program is not going to disinfect your systems. You will need a specialized tool.

The following is the location of MBAM scan logs on an XP system - just change "Documents and Settings" to "Users" or however else your systems base the user accounts.

C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
 
Note - there are some real concerns about using any kind of "Boot CD" if you are going to be modifying system files. Windows FPS is NOT running while using a Boot CD and modifying system files may render the system unbootable.

Details here:
Malware Fighting – Best Practices

0
 
LVL 1

Author Comment

by:jbobst
ID: 36581145
Thanks for all the information.  I think all the virus have been removed, and then we had a problem with the domain controller not having a global catalog anymore (virus did this???).  Got that fixed and now we seem to be ok.
0

Featured Post

Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
MS Endpoint Protection 2 43
AWS Default Security Group Question 3 42
Malwarebytes keeps blocking this..... 6 42
Opinions of Sophos Intercept X and Endpoint Security 2 49
If you thought ransomware was bad, think again! Doxware has the potential to be even more damaging.
The next five years are sure to bring developments that are just astonishing, and we will continue to try to find the balance between connectivity and security. Here are five major technological developments from the last five years and some predict…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

790 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question