What's That Trojan Doing on My Server?

If you have experienced your Windows Server 2003, or even a window 2000 or Windows XP computer will automatically boot, or if you have received a "serious error" message, or Lanping crippling, your computer may be infected with the spyware.service.miscrosoftupdate (Trojans) rootkit spyware.

Found a Trojan on the production server can be a frightening experience any network administrator. To remove Trojans, you need to identify file may cause problems. Once you have identified files, you can rename or delete files, They become useless.

high-tech help, as a , e-mail far From a window, the issue of exchange or virtual or need troubleshooting help? Perhaps you want a better interpretation exceeds the manual? Description your plight in an e-mail to the editors mcpmag.com in the email: editor@mcpmag.com best question be answered in this column, and draw interesting questions with a baseball-mcpmag.com cap.

when you put your question, please include your full first and last name, location, certifications (if a), and your message. (If you prefer to remain anonymous, This shows you the message, but requested information for verification).

root of all these problems is typical of the core drivers installation of a couple known rootkit spyware programs: msupd5.exe and reloadmedude.exe. To solve this problem, you need to rename the kernel drivers by the following method one. You can rename it use Windows Explorer when you log in to your computer, or re-naming it in safe mode. In Safe Mode, you can use the Windows Explorer or Use the command prompt .

The first step in this process is to ensure that your system is infected.

If the answer is yes, then you need to make it clear that the system which is the document culprit.

Once you know which documents dealing with you and the computer, you must decide Which method, you should use renamed malicious drivers. The process may seems to be more complex than in the past, it is actually the . Difficult part is to find out the exact documents are infected. Let us look at the entire process of cleaning virus in a in a systematic order.

Prepare your computer, start Windows Explorer and make sure that your Hide protected operating system files and clear. This can be confirmed to view, labels, tools, Folder Options ( Figure 1). Remember to hide file extensions, because you will find files a specific extension.

Figure 1. Show hidden files and folders.

verify spyware verify your computer is infected with spyware, in the Windows start explorers to the C: % windir% system32drivers folder. Find any file with . System extension has the following characteristics: randomly generated filename consisting of eight lowercase letters.

Some examples, the file has been found contain spyware, including: gbqxmhia.sys upzvlbvv.sys jsbmefvk.sys a document a date January 11, 2005.

The document said that no one version, product name or names The manufacturers listed.

A file size of 14 KB (13,824 bytes) .

A document has its hidden attribute set.

If you meet the above criteria found files, you may have been infected system.

Clean your computer infected to clean up your anti-spyware infected computers, first try to rename infected system files in Windows Explorer. Simply renamed files joined an extension, such as. " Bad "to these files. In addition, also renamed for any of the following documents, if they exist in your Computer: msupd.exe msupd4.exe msupd5.exe reloadmedude.exe restart the computer, and then scan your system for spyware use your anti-spyware software has been updated with the latest definition files. Microsofts Windows Defender, it is still in the testing stage, is one of the anti- spyware products, which will detect spyware.

If you can not rename the infected files, using the above method, then use safe mode to rename documents. Procedures renamed malicious drivers, exactly the same as in the safe mode, as indicated above above, unless you enter Safe Mode boot will restart the computer and pressing the F8 key.

If you prefer to use the command prompt, you can restart the computer enter the safe mode command prompt, and rename files. In order rapidly in the security model, type cd% windir% system32drivers.

Type Dir / ah look at the hidden attributes.

You can see the output looks like.

Directories, Group C: windowssystem32drivers January 11, 2005 at 09 am-18 13824 gbqxmhia.sys a file () 13,824 bytes 0 Dir () 961425408 bytes free attrib with orders to eliminate system and hidden attributes, Then renamed malicious use of the command files. In addition, remember to rename the file " msupd.exe msupd4.exe msupd5.exe reloadmedude.exe restart the computer, and then scan your system for spyware use your anti-spyware software has been updated with the latest definition files.

Microsoft Knowledge Base article 894278, "computer will automatically restart, or you may receive serious error message or stop the wrong message in Windows Server 2003, Windows XP or Windows 2000, "contains more details on the subject also includes several stop error message, you may encounter. Microsoft also lists a number of anti-spyware products, is to test The spyware.