Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm not so sure if this is the appropriate place for this, however I accidentally clicked this link which opened a video and infected my windows 2003 std server with this virus which not only creates popup ads but also redirects whatever link I click on within google's search results. IT seems to always go to

http://ix-find.com/?q=

I have tried ClamWin, adware, spybot, superantispyware, atf-cleaner and fixwareout and noneof those seem to work.

If this isn't the appropriate place for this, could you please directme who is the best place for help with this problem?

thanks in advance.

share|improve this question
    
HA! Is that the link? Why post it? for us to click it too? –  Saif Khan Jun 10 '09 at 18:16
9  
That will teach you to browse the internet on a server... –  Antoine Benkemoun Jun 10 '09 at 18:18
    
yea.. i was trying to download a driver –  phill Jun 10 '09 at 19:57
    
You'll want to visit this serverfault.com/questions/6190/… and read through it, especially Robert Moir's excellent response serverfault.com/questions/6190/… –  Avery Payne Jun 14 '09 at 21:48
    
Never ever download drivers except from the manufacturers website OR windows update. Doing anything else will result in issues like this one. –  Chris Lively Sep 10 '09 at 18:37

10 Answers 10

If it's a server, it's time to reload. There's no telling what it might have done.

sorry.

share|improve this answer
    
Mathew is right, time to reload. If you can't reload try Malware Bytes, it should get it. –  IOTAMAN Jun 10 '09 at 17:58
    
If rebuilding after an infection I would make sure I boot from the OS disk (rather than starting Setup from command line) and would reformat the Hard Disk as part of the installation. –  it depends Jun 10 '09 at 21:25

You probably have this burned into your brain forever at this point, but to the benefit of those who come after, Thou Shalt Not Browse the Internet from Thy Server

share|improve this answer
4  
+1 for reciting one of the SysAdmin commandments. –  Avery Payne Jun 10 '09 at 18:06
    
preach it brother! –  Saif Khan Jun 10 '09 at 18:09
    
Yeah, +1 for the commandment.. –  cop1152 Jun 11 '09 at 11:31

THe best thing to do after infecting a machine with any malware is to reinstall. Cleaning malware, even with an AV program or with specific instructions doesnt necessarily remove all traces. I have performed uncountable cleanings by hand and I have used software to clean, but the only 100% way to be sure is a format and reinstall.

Save yourself some possible trouble in the future and format & reinstall.

Again....

Save yourself some possible trouble in the future and format & reinstall.

..and PS - I am sure you have been scolded enough, but browsing the internet on a server? Come on. I am sure there was another machine available.

share|improve this answer

Check the Host file in the C:\WINDOWS\system32\drivers\etc directory if it was tampered with. Also try AVG they seem to be a better scanner these days, IMO.

share|improve this answer
    
It's too bad AVG doesn't have a free version for servers. –  Dave Jun 11 '09 at 12:17
    
@Dave: they probably figure that if you can afford Windows Server you can afford antivirus. –  RobM Jun 14 '09 at 19:17

This is a server - suggest you put hand in pocket and buy some AV! Remember AVG et al are not free for commercial use.

And then go stand in the corner and think before clicking the little blue e- how important is this computer and what user am I running as?

share|improve this answer

Yeah, never browse to anything other than manufacturer's sites on a server.

On the last PC I cleaned spyware of off, I did clean it and leave it at that, but usually I view cleaning as a temporary fix to keep it going while the user makes sure all their data is off. Then it gets wiped and reformatted.

On a server, I'd never take a chance - I might clean it just for the exercise, but I'd never hook it up to the network until it was wiped.

I've found bleepingcomputer.com to be a good site for finding info. on cleaning trojans. If someone has posted on that site and been helped to clean it up, you can follow the same clean-up steps.

In terms of tools for spyware, I keep Spybot Search and Destroy around, also Malwarebytes Anti-Malware, and Hijack This.

share|improve this answer

Smells a bit like Koobface. It uses a supporting application called "tinyproxy" to modify the results you get.

I would advise you to make some considerations about the security of any data you need to keep on the machine. Tear it down and start again. Don't attempt to clean it up unless you really have to.

share|improve this answer
    
Another possibility for the infection could be Gumblar: blog.scansafe.com/journal/2009/5/14/gumblar-qa.html But yeah... server compromise = reinstall –  gharper Jun 10 '09 at 19:12
    
It could be any number of things. But I have seen one machine this week doing the ix-find dance it turned out to be Koobface. –  Dan Carley Jun 10 '09 at 19:42

Try combofix.exe, from bleepingcomputer.com...

That should get rid of mostly everything, however, you should still reinstall that machine. And then never surf the web on it. (or at the very least, create a virtual machine and surf on that)

share|improve this answer
    
combofix didn't work.. –  phill Jun 10 '09 at 20:06
    
oh that sucks. sorry. Sounds like reformat is the only way to go. –  Roy Rico Jun 10 '09 at 21:52

I have had a similar virus on a personal computer. Google search results link to another page, always with the similar "http://ix-find.com/?q=" URL. Malwarebytes catches most of it, but it still comes back, likewise with Spybot S&D. When I used AdAware, it caught more than usual, and now when I click on a search result, I come up a page load error with the same "ix-find" URL.

Not really sure what the next step is, I might try Hijack This.

share|improve this answer

I would check for RootKits. I see them more and more often on infected machines which display this behaviour, i.e. quietly redirecting clicks to bad URLs.

The best tool I've found so far to get rid of them is RootRepeal.

Which you can get here: http://rootrepeal.googlepages.com/

share|improve this answer
    
The only way to get rid of them is to re-install the OS. –  Josh Brower Jun 10 '09 at 20:02
    
That's not been my experience. I've removed a number of rootkits from PCs. –  Alistair McMillan Jun 11 '09 at 10:16
    
amcmillan: What I was trying to say is that the only way to make sure that you are really clean, is to re-install. Once you've been rooted, you cannot trust anything the OS tells you. –  Josh Brower Jun 14 '09 at 20:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.