• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 871
  • Last Modified:

Can these files be safely removed from Windows Server 2003?

Hello,

Been having an issue with an infected Server 2003 Standard machine running Exchange Server 2003.  It's been sending tons of SPAM out and processes are jumping all over the place in task manager, CPU is going from 17% to 40% to 100% very erratic.

Finally used Emisoft Anti-Malware and it actually found some things running.  I had tried all kinds of root kit tools and they all came up clean.

My question is that it is reporting that the following files are infected or dangerous:

C:\windows\system32\LocalSystem.dll
C:\windows\system32\rpcserver.dll
C:\windows\system32\mui\svchost.exe

I'm worried if I clean or really more worried if I delete these files that it will mess up the server even worse...  are these required for Windows to function?

Thanks!

Matt
0
mscalafasd
Asked:
mscalafasd
1 Solution
 
larsrohrCommented:
I have an Exchange 2003 setup on Server 2003, and I do not have any of those three files present.  So I'd say they're safe to delete -- or rather, safe to copy to somewhere else (USB key, etc) before deleting.

You might want to check your registry for mention of these files.  And re-scanning after their removal and a reboot would also be recommended.
0
 
mscalafasdAuthor Commented:
Thank You!
0
 
ReneGeCommented:
I looked on two of my 2003 servers and these files dont exist. Just to be on the safe side, I would suggest that you add the extension .tobedeleted to these files and see how your server behaves.
0
 
Manpreet SIngh KhatraSolutions Architect, Project LeadCommented:
I wouldnt recommend deleting any files rather move but check the below

Your Windows Server 2003 computer may experience an access violation in Svchost.exe when it becomes extremely low on resources
http://support.microsoft.com/kb/829994

Not sure about these files though
C:\windows\system32\LocalSystem.dll
C:\windows\system32\rpcserver.dll

- Rancy
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now