Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
My server's been hacked EMERGENCY

Windows 2000 Server.

I believe I have a rootkit. But, nothing will remove it. I've tried everything. Even tools that are merely for scanning fail or bsod the computer.

Since nothing works, I wanted to try and do it manually.

edit: This is a Windows 2000 Server Forest Root. I cannot rebuild it without blowing up the domain.

share|improve this question

marked as duplicate by Iain May 14 '12 at 14:59

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Can you really be certain about the integrity of your server after such a compromise? It may be wiser to rebuild. – brent May 14 '12 at 14:48
You reinstall from scratch or from a known clean image. – Shadok May 14 '12 at 14:49
You will never be able to trust this system again - reinstall and recover from know good backups is the only real solution. – Iain May 14 '12 at 14:59
@johny Not only can you rebuild a Forest Root Server, you should have a contingency plan (DRP, BCP) sitting around with directions of how to do so. – Chris S May 14 '12 at 15:04
If you "can't rebuild" then what would you do if your server died? You have a contingency for that right? You know you can create a new DC in that domain and transfer all the roles as part of removing the suspect one, right? – RobM May 14 '12 at 15:36

I'd strongly advise to rebuild your server.

  • if the server has been root-compromised how can you assure integrity of all of its parts even if you THINK you've removed the compromised part ?
  • it's easier and saves the time and hassle - rebuild and restore from backups
share|improve this answer
I cannot rebuild. It is a forest root. – johnny May 14 '12 at 14:53
@johnny set up a new server, dcpromo it and transfer the FSMOs. Also, make sure to use a supported version of Windows Server - Windows 2000 had its end of support 2 years ago. – the-wabbit May 14 '12 at 15:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.