Local system can't "see" some DLL files, but I can see them when viewing the system dir remotely

[jventresco]

I have posted this in the WU group as well, as the issue in question
breaks AU since two of the WU dll files are the ones that the local
system can't see. Unfortunately the problem is not with WU itself, as
there are some other random DLL's that can't be "seen" (by the system
itself) from the local PC.

Those files are already there, except you can only see them when
viewing the windows directory from ANOTHER machine. When viewing the
the directory of the server FROM THE SERVER ITSELF you can't see the
files at all.

I can't even copy the DLL files to that directory locally, nor can I
even create files with those names! Windows tells me that a file with
that name already exists even though it can't see it!

The server has had virus infections in the past, but it has been clean
for 2.5 months now (I checked using TrendMicro and Norton).

Any thoughts?

 

[Dave Patrick]

Any server that was ever infected cannot be trusted again until it is
rebuilt.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

 

[jventresco]

While technically true, that isn't a realistic answer.

My company manages hundreds of networks for smaller businesses; we deal
with server infections pretty much every week. The overwhelming
majority of the time we can remove the infections without any problems,
and the server works like new again.

I posted this issue to see if anyone else has seen this particular
problem, and if so how they fixed it. I already knew that the potential
for a rebuild existed.

Jason

 

[Dave Patrick]

My guess is you've got some more cleaning to do. You might try one of the AV
or virus groups.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

 

[jventresco]

Problem fixed.

It was a rootkit

I removed it using:

http://greatis.com/unhackme/download.htm

All that work and the problem was solved in 30 seconds plus 1 reboot.

Jason