Windows 2000 Server has a virus called ServU-Daemon

[SundancerKid]

Hi everyone,

I have a virus on a server called ServU-Daemon. I ran a virus checker called "McAfee ASAP" and it detected the virus. The virus can not be deleted in the normal way. The virus is masking its self as a system file C:\WINNT\System32\Winlogo.exe the Winlogo is running as a service. I would like to stop the service and have McAfee ASAP delete the virus in the proper way. the task can not be stopped in the normal way "Task Manager". How do I stop the service from loading? in other versions of the operating system we could use MSCONFIG.exe and all of the loaded tasks would come up so that a service could be disabled.

Are there any suggestions?

Thanks,

Rick

 

[AlexIT]

On a server you have more control of services. Go to control panel, services and disable the service. Reboot the server and see if ASAP can remove it now.

You know that ASAP is not intended for servers right? The NetShield product should be installed instead...

 

[diogenes10]

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=BKDR_GRAYBIRD.H

This trendmicro writeup has a section on removing autostart entries from the registry.

-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?

 

[bfralia]

Actually Netshield has been replaced by Virusscan Enterprise version 7.1 with 8.0i coming out in August.