Need to track down Infection in a Server 2008 domain user profile

Posted on 2016-11-15
Last Modified: 2016-11-15
One of my customers remoted onto her server a couple of days ago and ran her Outlook email there. She received an infected email with an "Invoice attached" message, and, amazingly, attempted to open the attachment, which was a .jar file.

Don't recall her permission level on the server, but it was enough to run the .jar, but it stopped, prompting her to accept a command which is trying to insert a .reg file into the registry.  She did not permit the .reg file, thankfully.

I reduced her user account privileges to basic user, but whenever she logs on, Regedit is constantly requesting permission to run a .reg file. If she cancels, the prompt comes back one second later. I can stop it all by killing javaw.exe in the task manager.  However, when she logs back on, it starts up again.

Hers is the only user account affected, yet I cannot find anything anywhere that tells javaw.exe (or anything else) to start up when she, and only she, logs on. There are no suspicious extensions or add-ons in her Chrome or IE browsers. I've scanned her user profile for visues, and run a rootkit detector, etc.  All clean.

Can someone advise?
Question by:DaveWWW
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
LVL 37

Expert Comment

ID: 41887920
run MSCONFIG as an administrator on the server and review all Startup Items and remove or disable anything suspicious. better also review services as well.

you may also right-click the taskbar and choose Task Manager to check Startup items.

Author Comment

ID: 41887936
Thanks.  I've been been through MSCONFIG and the Task Manager. I see javaw.exe in the Task Manager, which I can shut down, but it comes back when this user logs back on.  What I'm not clear on is how to find the source of this autostarting of javaw.exe when only a single user is having the issue.  No other users autostart the program javaw.exe.

I've checked the logon script for this user and it is no different than anyone else's.

That's the confusing part in this: Where is this single user receiving an instruction to run javaw.exe that attempts to run a .reg file?
LVL 37

Accepted Solution

bbao earned 500 total points
ID: 41887954
javaw.exe itself is not the issue or trouble maker, the process calls Java runtime is the one to go.

you may check the Java runtime's parent process ID, it should be pointing the target process or at least providing a clue.
Salesforce Has Never Been Easier

Improve and reinforce salesforce training & adoption using WalkMe's digital adoption platform. Start saving on costly employee training by creating fast intuitive Walk-Thrus for Salesforce. Claim your Free Account Now


Author Closing Comment

ID: 41888002
Thank you! That worked. I found the info using Process Explorer and then searched the registry for it, and deleted it out of the Run area for that user.
LVL 86

Expert Comment

ID: 41888004
msconfig is good, but much better is Sysinternals'  'autoruns' - try that
LVL 86

Expert Comment

ID: 41888009
Too late - but it might have got you there right away ;)
LVL 37

Expert Comment

ID: 41888121
> Sysinternals'  'autoruns' - try that

yes, AUTORUNS can be handy to list ALL auto-start items from both startup folders, registr items and services, but you have to review them one by pen to guess if it is related or not.

the given method of tracking back to parent process can directly determine the related process or even thread (a virus way) and finally catch the source image file on file system.

Featured Post

Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article investigates the question of whether a computer can really be cleaned once it has been infected, and what the best ways of cleaning a computer might be (in this author's opinion).
Resolving an irritating Remote Desktop connection that stops your saved credentials from being used.
This video teaches viewers about errors in exception handling.
This tutorial will introduce the viewer to VisualVM for the Java platform application. This video explains an example program and covers the Overview, Monitor, and Heap Dump tabs.

690 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question