1

Recently I've noticed some suspicious activity on the server and removed a virus (from what I gathered it was MPK). I caught it on time and it didn't do any damage. One of the things that it did is messed up permissions and now I can't start ESET service or run malwarebytes or KAV... I understand that it somehow messed up security permissions (I think files and regs). As a result I can't use sfc or dism to fix problems.

Is there a way to restore permissions?

1
  • Try reinstalling the software. If that doesn't work you may have to either restore from backup or build a new server / OS and restore your data.
    – Tim
    May 17, 2017 at 20:17

2 Answers 2

3

Please don't try to fix the permissions or whatever else may be wrong.

Your server has been compromised which means you can no longer trust the code running on it. It's tempting to try to clean up after a virus infection and move on, but if you miss something, (how would you guarantee what can't be seen isn't there?) everything that touches that server is compromised too.

Instead, reinstall the operating system and restore your data. This is the only method to reasonably ensure your server is not compromised and fit for continued use.

0

If a reinstall of the system is not an option, setting up a second system from scratch, which is as close as possible to the system under repair, and copying the permissions is usually the most reliable option. Mind that whatever tool is used or written has to use names and not SIDs as a "currency", and might have to translate names of local user accounts.

This also can be used as a reference if the integrity of any system files is questionable.

1
  • Basicaly what I have is a server that has Hyper-V running on it with two VMs that weren't affected. I should be able to setup a second system to use as a donor. If I do that then how and what exactly I need to transfer? If I install a new system on top of the existing one as an upgrade and not as a new install. Will it fix my problem with the permissions and keep my settings? Or will I need to reconfigure everything again?
    – Pixels
    May 18, 2017 at 13:43

Not the answer you're looking for? Browse other questions tagged .