Need help with a sensitive server.

qzmicro · Jun 1, 2006

Hi guys. We recently installed a phone system on a stand alone 2003 Enterpirse server. This server is very particular in that it is a PBX system. It cannot handle virus scanner, it cannot handle service packs and it cannot handle a lot of 3rd party software. Because of this, disinfecting this system is a bit problem for me right now. I have experience in removing malware and have never come across something like this. Basically, I can't find the exact infection. I have run Spybot and Adaware with no luck. I have also run panda activescan and bit defenders active scan. Symtoms include slowness, constant rebooting of the system (like the old sasser varients) and temporary loss of network connectivity (possibly due to the reboots). I need to have this fixed 3 days ago. I have been on it for over 3 days now and have not had any luck. Any help would be appreshiated. I won't post hijack this until someone asks me to do so. I also have log files from online scans. Thanks and much obliged.

Qz

chaslang · Jun 2, 2006

Welcome to Majorgeeks!

If you cannot install Service Packs to update your OS, and you cannot install an antivirus, (what about a firewall) then you are going to continue to have problems with malware.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too (these scans are covered in steps 6 & 7 of the READ & RUN ME sticky)

Bitdefender

Panda Scan

HijackThis

If you have already run ALL steps in the READ & RUN ME, just attach the three requested logs as per the instructions above (and in step 6 & step 7 of the READ ME)

qzmicro · Jun 3, 2006

Here are the three files... they seem clean. However, these scan are AFTER I have gotten rid of many other nucenses. Please advise.

Qz

PS, the BITDEFENDER scan can be found here.

http://www.geocities.com/qzmicro/BitDefender.htm

chaslang · Jun 4, 2006

Everything looks clean!

Are you having any malware problems?

qzmicro · Jun 7, 2006

chaslang said:

Everything looks clean!

Are you having any malware problems?
Click to expand...

... Okay, so is that your way of telling me that you think I am free of malware and that the problem might lie elsewhere?

Tony

P.s. Oh, and thank you for your time and assistance.

chaslang · Jun 7, 2006

qzmicro said:

... Okay, so is that your way of telling me that you think I am free of malware and that the problem might lie elsewhere?
Click to expand...

Basically yes! We could dig deeper to see if anything else is really hiding in there (like rootkits or similar) but your problems do not sound like malware. Sounds more like hardware issues (possible overheating), software conflicts, too much running, etc. However I was never really clear on what the below meant:

It cannot handle virus scanner, it cannot handle service packs and it cannot handle a lot of 3rd party software.
Click to expand...

Describe what you mean by "cannot handle".

qzmicro · Jun 7, 2006

Thanks. Yes, it's software that runs on a standard 2003 server no service packs and no virus or malware scanners. It seems to interfer with the Shortel Server. Basically, it's a PBX box that shouldn't be on a data network, but in this case it is.

Tony

P.s. I've set alerts and counters and have found no hardware issues. It seems this is a bit of a mistery. I have not been able to "repair" the OS either, because of the way the Hard Disk is partitioned. * Sigh *

chaslang · Jun 8, 2006

All I can suggest is that you post a new message in the Hardware Forum clearly describing your exact problem. You should also reference this thread so they do not send you here. Overheating and problems with bad capacitors on mother boards (often called puffy caps) can cause rebooting or shutdowns.

qzmicro · Jun 8, 2006

chaslang said:

All I can suggest is that you post a new message in the Hardware Forum clearly describing your exact problem. You should also reference this thread so they do not send you here. Overheating and problems with bad capacitors on mother boards (often called puffy caps) can cause rebooting or shutdowns.
Click to expand...

Thanks, will do.

Qz

chaslang · Jun 8, 2006

You're welcome and good luck!

Log in or Sign up

Need help with a sensitive server.

qzmicro Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

qzmicro Private E-2

Attached Files:

Activescan.txt

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

qzmicro Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

qzmicro Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

qzmicro Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member