[bcc900s]

Please help. I have a Win2k server that I belive has been infected with a virus. It wass hit with the esbot virus but I was able to successfully remove that. Since then it has still had the same problem of the websites (and the server) being accessible only intermittently. I have been trying to fix this problem for days without any luck.

HiJack This Log:
Logfile of HijackThis v1.99.1
Scan saved at 8:17:54 AM, on 8/20/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\termsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\CFusion\Bin\cfexec.exe
C:\CFusion\Bin\cfrdsservice.exe
C:\CFusion\JRun\bin\JRun.exe
C:\CFusionMX7\runtime\bin\jrunsvc.exe
C:\CFusionMX7\db\slserver54\bin\swagent.exe
C:\CFusion\jre\bin\ntConsoleJava.exe
C:\CFusionMX7\db\slserver54\bin\swstrtr.exe
C:\CFusionMX7\db\slserver54\bin\swsoc.exe
C:\CFusionMX7\verity\k2\_nti40\bin\k2admin.exe
C:\CFusionMX7\runtime\bin\jrun.exe
C:\WINNT\System32\svchost.exe
d:\Program Files\ewido\security suite\ewidoctrl.exe
d:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINNT\System32\llssrv.exe
C:\Program Files\Tiny Personal Firewall\persfw.exe
C:\WINNT\system32\MSTask.exe
D:\Program Files\WebTrends Analysis Series\scheduler_service.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
D:\Program Files\WebTrends Analysis Series\WTAM_Service.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\dns.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\System32\msdtc.exe
C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
D:\Program Files\WebTrends Analysis Series\wtam_lfm.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\msdbg32.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
D:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\System32\mdm.exe
C:\CFusionMX7\verity\k2\_nti40\bin\k2server.exe
C:\CFusionMX7\verity\k2\_nti40\bin\k2index.exe
C:\Documents and Settings\Administrator.CSSERV\Desktop\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://v4.windowsupd.../en/default.asp
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Windows Debugger] msdbg32.exe
O4 - HKLM\..\RunServices: [Windows Debugger] msdbg32.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1124235963664
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1124236368117
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - file://C:\Inetpub\wwwroot\TSWeb\msrdp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{334CB435-49E3-47C0-A1C2-0C94431F5213}: NameServer = 64.89.70.2,64.89.74.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{52917B92-D242-4C3B-901C-69A7E3495C87}: NameServer = 66.148.250.18,66.148.250.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{958CF02D-7431-4745-AF1F-B0483BD0A2A7}: NameServer = 66.119.1.130,66.119.1.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{334CB435-49E3-47C0-A1C2-0C94431F5213}: NameServer = 64.89.70.2,64.89.74.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{334CB435-49E3-47C0-A1C2-0C94431F5213}: NameServer = 64.89.70.2,64.89.74.2
O23 - Service: FireDaemon Service: BPFTP Server (BPFTP Server) - Unknown owner - C:\Program Files\FireDaemon v0.09c\FireDaemon.EXE (file missing)
O23 - Service: ColdFusion Executive (Cold Fusion Executive) - Macromedia Inc. - C:\CFusion\Bin\cfexec.exe
O23 - Service: ColdFusion RDS (Cold Fusion RDS) - Macromedia Inc. - C:\CFusion\Bin\cfrdsservice.exe
O23 - Service: ColdFusion Graphing Server - Unknown owner - C:\CFusion\JRun\bin\JRun.exe
O23 - Service: ColdFusion MX 7 Application Server - Macromedia Inc. - C:\CFusionMX7\runtime\bin\jrunsvc.exe
O23 - Service: ColdFusion MX 7 ODBC Agent - Unknown owner - C:\CFusionMX7\db\slserver54\bin\swagent.exe
O23 - Service: ColdFusion MX 7 ODBC Server - Unknown owner - C:\CFusionMX7\db\slserver54\bin\swstrtr.exe
O23 - Service: ColdFusion MX 7 Search Server - Unknown owner - C:\CFusionMX7\verity\k2\_nti40\bin\k2admin.exe" -cfg "C:\CFusionMX7\verity\k2\common\verity.cfg" -ntstart 1 (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - d:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - d:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Tiny Personal Firewall (PersFw) - Tiny Software - C:\Program Files\Tiny Personal Firewall\persfw.exe
O23 - Service: FireDaemon Service: portforward (portforward) - Unknown owner - C:\Program Files\FireDaemon v0.09c\FireDaemon.EXE (file missing)
O23 - Service: WebTrends Scheduler (Analysis Series, v7.0) (WebTrends Scheduler Analysis Series v7.0) - Unknown owner - D:\Program Files\WebTrends Analysis Series\scheduler_service.exe
O23 - Service: Windows Kernel - Unknown owner - C:\WINNT\svchost.exe
O23 - Service: WebTrends Alerting and Monitoring for Analysis Series 7.0 (WTAMSVC_Analysis Series 7.0) - Unknown owner - D:\Program Files\WebTrends Analysis Series\WTAM_Service.exe

Trend Micro Housecall Report:
Virus Scan 1 virus detected


Results:
We have detected 1 infected file(s) with 1 virus(es) on your computer. Only 0 out of 0 infected files are displayed.
Detected File Associated Virus Name
C:\WINNT\system32\rdriv.sys TROJ_ROOTKIT.E




Trojan/Worm Check 1 worm/Trojan horse detected

What we checked:
Malicious activity by a Trojan horse program. Although a Trojan seems like a harmless program, it contains malicious code and once installed can cause damage to your computer.
Results:
We have detected 1 Trojan horse program(s) and worm(s) on your computer. Only 0 out of 0 Trojan horse programs and worms are displayed.
Trojan/Worm Name Trojan/Worm Type
TROJ_ROOTKIT.E Trojan



These were both ran this morning 8/20/2005.

If there is anyone out there, please help. I am desperate at this point.

Brian

[Advertisements]

Hi and welcome to GeeksToGo! My name is Sam and I will be helping you.

I apologize for the delay getting to your log, the helpers here are very busy.
If you still need help, please post a fresh Hijack log, in this thread, so I can help you with your Malware Problems.

If you have resolved this issue please let us know.

[Buckeye_Sam]

Hi and welcome to GeeksToGo! My name is Sam and I will be helping you.

I apologize for the delay getting to your log, the helpers here are very busy.
If you still need help, please post a fresh Hijack log, in this thread, so I can help you with your Malware Problems.

If you have resolved this issue please let us know.

[Buckeye_Sam]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.