It states they are being removed, but they keep appearing almost every hour... I have ran Malwarebytes, Spybot S&D, and other spyware programs which don't find anything.
This server is being used for file sharing and all permissions have now been locked down by security groups. (Don't ask why, this was being administered at a remote site)
I can't seem to clean this server for good! I'm also using McAfee for our Enterprise AntiVirus which keeps finding the following(I'm assuming there is some relationship between the two):
These are being found in the Setup50045.fon, setup50045.lnk, myporno.avi.lnk, and pornmovs.lnk files.
Any help would be appreciated. I will post files upon request as this is my production server.
Please follow the instructions in ==>This Guide<==. If you cannot complete a step, skip it and continue.
Then post your DDS and GMER logs as a reply to this topic. Once you have done that I will remove my reply and consolidate the posts so that you retain your correct place in the queue.
If you can produce at least some of the logs, then please explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the reply and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.
When attempting to run the DSS.src tool I received the message: This tool does not support your operating system. As previously stated this is a W2K3 R2 64bit OS. Before I run the GMER.exe rootkit scan, will there be any issues with incompatibly for my OS? I ran it on my local Pc first and got a Blue Screen; I did have multiple windows open, and was able to run it once I rebooted my PC. I also noticed it begins a scan when the application opens. Is this normal? Will it cause any interruption on my server for users?
EDIT: Posts merged. Skip the GMER scan for now. When one of our helpers picks up your topic they will provide further instructions. ~Budapest
Edited by Budapest, 04 May 2011 - 03:57 PM.