I have posted this in the WU group as well, as the issue in question
breaks AU since two of the WU dll files are the ones that the local
system can't see. Unfortunately the problem is not with WU itself, as
there are some other random DLL's that can't be "seen" (by the system
itself) from the local PC.

Those files are already there, except you can only see them when
viewing the windows directory from ANOTHER machine. When viewing the
the directory of the server FROM THE SERVER ITSELF you can't see the
files at all.

I can't even copy the DLL files to that directory locally, nor can I
even create files with those names! Windows tells me that a file with
that name already exists even though it can't see it!

The server has had virus infections in the past, but it has been clean
for 2.5 months now (I checked using TrendMicro and Norton).

Any thoughts?

Any server that was ever infected cannot be trusted again until it is
rebuilt.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

<(E-Mail Removed)> wrote:>I have posted this in the WU group as well, as
the issue in question
> breaks AU since two of the WU dll files are the ones that the local
> system can't see. Unfortunately the problem is not with WU itself, as
> there are some other random DLL's that can't be "seen" (by the system
> itself) from the local PC.
>
> Those files are already there, except you can only see them when
> viewing the windows directory from ANOTHER machine. When viewing the
> the directory of the server FROM THE SERVER ITSELF you can't see the
> files at all.
>
> I can't even copy the DLL files to that directory locally, nor can I
> even create files with those names! Windows tells me that a file with
> that name already exists even though it can't see it!
>
> The server has had virus infections in the past, but it has been clean
> for 2.5 months now (I checked using TrendMicro and Norton).
>
> Any thoughts?
>

While technically true, that isn't a realistic answer.

My company manages hundreds of networks for smaller businesses; we deal
with server infections pretty much every week. The overwhelming
majority of the time we can remove the infections without any problems,
and the server works like new again.

I posted this issue to see if anyone else has seen this particular
problem, and if so how they fixed it. I already knew that the potential
for a rebuild existed.

Jason

My guess is you've got some more cleaning to do. You might try one of the AV
or virus groups.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

<(E-Mail Removed)> wrote:
> While technically true, that isn't a realistic answer.
>
> My company manages hundreds of networks for smaller businesses; we deal
> with server infections pretty much every week. The overwhelming
> majority of the time we can remove the infections without any problems,
> and the server works like new again.
>
> I posted this issue to see if anyone else has seen this particular
> problem, and if so how they fixed it. I already knew that the potential
> for a rebuild existed.
>
> Jason
>

Problem fixed.

It was a rootkit

I removed it using:

http://greatis.com/unhackme/download.htm

All that work and the problem was solved in 30 seconds plus 1 reboot.

Jason