Server 2003 infected can't install from msi and AD toold will nopt initialize

Discussion in 'Malware Help (A Specialist Will Reply)' started by sfghadmin, Dec 11, 2012.

  1. sfghadmin

    sfghadmin Private E-2

    Dell Poweredge 6800 Windows Server 2003 I inherited the problems as I was not IT Manager for the last couple of years. Cannot open AD users and computers or other AD tools : Error: MMC cannot initialize snap-in. Cannot install many programs (tried reinstalling Admin Tools, Malware Bytes)but you get an error that it cannot create the shortcut so installation fails For Malware Bytes the final error is: "CoCreate instance failed; code 0x80040154.
    Class not registered". Admin pack literally said it cannot create the lnk files and shortcuts.

    Ran McAfee (after finding the definitions had not been updated for a year)and it found 48 infections of generic.bx!bblk but said it cleaned or deleted them. I have attached the logs of the other scanners as detailed in the how-to procedures.

    Thank you for your help. I am guessing I need to do something in safe mode to really clean this but as this is the only server in the domain now and has all of the data on it, I do not want to take any chances without direction. Thank you again.
     

    Attached Files:

  2. sfghadmin

    sfghadmin Private E-2

    Now I notice that the Administrative tools for Active Directory do not show up in the menu anymore-they show up in an MMC but the AD tools, users and computers, domains and trusts etc will not run. Shortcuts mostly do not work anymore, from desktop, and search does not work either. When I try to run msconfig it can't find it unless I type the full path. My PATH environment variable is as follows: (Do you see any issues?)

    E:\Program Files\Support Tools\;C:\Program Files\PeerDirect\bin;C:\PROGRA~1\PEERDI~1\pdre\bin;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM;%OMPATH%;C:\Program Files\Dell\OpenManage\Array Manager;C:\Program Files\Microsoft SQL Server\80\Tools\BINN;E:\PROGRA~1\DISKEE~1\DISKEE~1\;C:\WINDOWS\system32\WindowsPowerShell\v1.0;
     
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!


    There are a few items of interest in your logs:
    • The largest two issue are the below seen running
    C:\Documents and Settings\Administrator.SFGH\WINDOWS\System32\smss.exe
    C:\WINDOWS\System32\wins.exe
    The only place the smss.exe should be running from is C:\windows\system32\smss.exe Do you have any idea why you could possibly have the one running from the C:\Documents and Settings..... folder?

    And the wins.exe file is known to be a worm that could be stealing information. For business computers this could be very dangerous/damaging and typically the safest thing to do is to format and reinstall immediately. Do you have any other info on what this is? See >> http://www.bleepingcomputer.com/startups/wins.exe-23224.html

    Do you have sensitive information on this computer that you have to worry about being stolen? Could customer information have been stolen?

    I don't understand how McAfee would not be picking up these items.
    • The next observation is the below item. Are you haveing any network connectivity problems? It does not seem like it based on the fact that you are still using the server.
    O10 - Broken Internet access because of LSP provider 'c:\documents and settings\administrator.sfgh\windows\system32\mswsock.dll' missing
    • I see thousands of open UDP connections are you aware of this and does it make sense for these to exist? Here is just a small sample:
      Code:
        UDP    mas200:50103           *:*                    
        UDP    mas200:50107           *:*                    
        UDP    mas200:50133           *:*                    
        UDP    mas200:50147           *:*                    
        UDP    mas200:50150           *:*                    
        UDP    mas200:50155           *:*                    
        UDP    mas200:50158           *:*                    
        UDP    mas200:50166           *:*                    
        UDP    mas200:50167           *:*                    
        UDP    mas200:50169           *:*                    
      There are 2605 TCP connections showing. Look in the MGlogs.zip file at the runkeys.txt log and you will see what I mean. There is a section that begins with the below header that lists all the connections
    Code:
        ----------------------------------------------------------------------------
        Showing TCP and UDP Connections - with netstat -a                           
     
        ----------------------------------------------------------------------------
    Active Connections
     
    Last edited: Dec 13, 2012
  4. sfghadmin

    sfghadmin Private E-2

    Thank you soo much for your observations. It looks like one of the scanners did pickup and clean the smss but the wins.exe was still there. Unfortunately the old admin had not updated virus defs for over a year but I don't know why McAfee did not pick them up now after I updated and have regular scans running.

    I have deleted wins.exe and am now running sfc /scannow to help restore missing and corrupt files. I think this should solve most of the issues but we will see. I will check open ports after a reboot and see what is going on there. I have to assume that one of the trojans opened all those up. This server does have customer info on it so I need to do a thorough check of everything. Even encrypted info is not good to have it stolen. Luckily no credit card numbers but names and emails and addresses,

    This is of great help already. I think I'm on the right track now. I suspect that the admin profile I'm using may be what is screwed up so I will create a new admin account from the other server in the domain-I forgot I even had that one at a different site! Thanks for your help so far and I will post an update

    Kim
     
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    Okay, let me know how things go.
     
  6. sfghadmin

    sfghadmin Private E-2

    Well I was able to clear all of the infections but I had to just reinstall Windows Server 2003 slipstreamed with SP2 in order to get the admin functionality back. Everything looks great now and I have reset the virus protection and malware protection to update automatically and scan regularly. It did though infect the rest of the network and they all had their virus scanners not being updated also.

    Breaks my heart to see the laziness of other admins. I had all this stuff self-regulating before he took over. Prevention is the best medicine.

    Thanks for your help.
     
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Glad to hear you have it all working.

    Yes prevention is the important first step which is why we have the below link in the forum.

    How to Protect yourself from malware!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds