This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Serious malware infected server

2 min read

This thread's last reply is from April 26, 2009, 8:58 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

majdid
April 25, 2009, 9:35 AM UTC last edited April 26, 2009, 8:43 PM UTC (Edited to disable live link.)
Hi,

i need help! we have a windows 2003 SBS, running ISA server. everyday, i mean everyday, i notice a download of about 80MB from hxxp://windowsupdatev8.3322.org/. it is really crazy, we have tried everything, blocking in at the domain level, IP ... no way, absolutely, it keeps running and i am not sure how to remove it as there is absolutely no information about this domain name in the net.

Any idea on the steps i can perform to detect and remove this? it is costing us a lot of $$ extra bandwidth every month, and who knows, the server might be vulnerable to any kind of attacks now...

please advise before it starts getting worse.

thanks very much.
NonSuch
April 26, 2009, 8:58 PM UTC
It appears that you have a serious problem and that your server will very likely require a reformat. Our forums deal only with home computer issues. This computer is a business server and, as such, is connected with all other computers within the domain. As such, it obviously would have been connected to the network while infected, therefore, presenting a risk to all its data and to all other computers connected to that same network as well. This issue should be addressed immediately.

The online anti-malware community primarily serves home users and is therefore not ideally suited to deal with situations such as yours that are best handled by a company's own IT department. All companies have their own set of policies and procedures for handling situations like this as well as, hopefully, system backups. These things are obviously beyond our sphere of knowledge. Therefore, as this server has been identified as infected, you are strongly advised to immediately seek the assistance of your company's IT department so they may implement their own preferred method for handling this situation. If you are responsible for the server and its network yourself, then we suggest that you immediately call in an outside consultant to resolve this issue. This should not be delayed.

As this issue falls outside the scope of this forum, this topic is now closed.