Assistance on Virus Removal please

[Guest]

Hello,


I am working on a Server 2000 machine that was left unpatched for many
years.(ugh) So I patched it and scan for viruses. Well you know what I found.
Yes Viruses.

The Viruses I found are:
Trojan.Startpage
W32.Spybot.Worm
W32.RaHack.H
These are the names provided by Norton
They do have Aliases by other AV vendors but such Allaple.? and so on.
I have tried all the AV programs I can and cannot remove them.
I also have not found a good article on how to manualy remove them either.

However a little added info is this. After a while the Home page gets
Hijacked to a web site callled Dbarticles.com I left out the URL so no one
will click it in case this is the culprit.

These are the processes that I cannot kill
mdm.exe
urdvxc.exe
..exe (This was a Norton find)
Rundll32.exe

If I missed anything please let me know. I need to remove these files and
change this passswords on this Server

Thanks so much
Joe

 

[Meinolf Weber]

Hello Joe,

On the Symantec webpage is a detailed description for every Virus:

W32.Rahack.H
http://www.symantec.com/security_response/writeup.jsp?docid=2006-082311-5907-99&tabid=3

W32.Spybot.Worm
http://www.symantec.com/security_response/writeup.jsp?docid=2003-053013-5943-99&tabid=3

Trojan.StartPage
http://www.symantec.com/security_response/writeup.jsp?docid=2002-011511-4413-99&tabid=3


And if this does not work, you have to think about to backup your data and
rebuilding the complete server.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.

 

[Leonard Agoado]

Hello,


I am working on a Server 2000 machine that was left unpatched
for many
years.(ugh) So I patched it and scan for viruses. Well you know
what I found.
Yes Viruses.

Joe,

You will never be certain now. Back-up your data, flatten
the system, and start over.

Len Agoado
(e-mail address removed)