Server Fix

[Dekstro]

Hello there!

Dear analysts, my server (windosw server 2003) is severely infected by a malware.

I hope you can help me out with this issue.

I'll be waiting for your prompt reply.

Regards,

[Numb]

Hello.
As far as I can see there is nothing harmful in your log. There are some suspicius files so if you want them to be checked, please, execute the script below. Attention! Your system will be restarted, so close all applications and clear all connections with your SQL-server before execute it.

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('c:\sality mission\pack3\sality_off.exe','');
 QuarantineFile('C:\Documents and Settings\Administrator.METROEUROPA.000\WINDOWS\System32\smss.exe','');
 QuarantineFile('C:\Documents and Settings\Administrator.METROEUROPA.000\WINDOWS\system32\DRIVERS\57488671.sys','');
 QuarantineFile('C:\Documents and Settings\Administrator.METROEUROPA.000\WINDOWS\system32\DRIVERS\32943243.sys','');
 QuarantineFile('C:\Program Files\Common Files\Borland Shared\BDE\SQLMSS32.DLL','');
 QuarantineFile('C:\KK_v3.4.7\KK.exe','');
 QuarantineFile('C:\CorporeRM\API\CPConnect.dll','');
 QuarantineFile('C:\CorporeRM\API\RMPlanilha.dll','');
 QuarantineFile('C:\WINDOWS\System32\smss.exe','');
 QuarantineFile('C:\WINDOWS\system32\DRIVERS\57488671.sys','');
 QuarantineFile('C:\WINDOWS\system32\DRIVERS\32943243.sys','');
BC_ImportquarantineList;
BC_Activate;
RebootWindows(true);
end.

After restart, upload quarantine via the link http://virusinfo.info/upload_virus_eng.php?tid=50163 as it's described in the app. 3 of the rules. And please, could you tell us more about your problem?