Infected Server Cannot get to Antivirus Support Sites

Greetings

I have a domain controller file server running server 2003 r2. It was hit with what is being called the beebone trojan. It was apparently intriduced to this school server via a students usb flash drive. I have been able to run malwarebytes and spybot and they have found and cleaned some parts out but there is still a lot of damage. My first issue is not being able to access sites such as AVG, Avast, Symantec or even Microsoft updates. These sites are obviously being blocked by the infection.

I am at my wits end on how to get this server to these sites so i can loads some server anti virus software.

Can anybody geve me any pointers? Until I get this resolved the school is pretty much dead in the water.

Thanks

Chris

Cant you run antivirus off a USB stick?
Many run off of that.
http://www.techrepublic.com/blog/fiv...all-times/1572
Are you the administrator?
What antivirus is on the server to start with?
Sometimes you can also use a portable browser to go to the av sites.
http://portableapps.com/apps/internet/firefox_portable

I hadn't thought of that as I have never tried that. I will read through the link you sent.

Yes I can login as admin.

Thank you for such a prompt reply

You could also try the Kaspersky Rescue Disk which I think can be both USB or CD.

I also suggest using a root kit removal utility such as one provided by malwarebytes.

Finally, I personally like using the Emsisoft Rescue Kit's command line scanner to do a follow up scan in safe mode.

Thank you all

Most likely with this variant that other malware is being downloaded and installed as well. I would start by making sure you have a backup of the data before proceeding.

First here is a list of Rootkit Scanners you can download and burn to CD or USB. - http://www.northernaurora.com/page/a...ools-links-r18

Next here is a list of bootable CD's you can build on a functioning PC. - http://www.northernaurora.com/page/a...e-cds-list-r72

And then a list of online scanners and free tools you can do the same with. - http://www.northernaurora.com/page/a...ools-links-r17

Finally a list of Spyware tools. - http://www.northernaurora.com/page/a...ools-links-r19

When you run the scans make sure the tools are updated to the newest versions you can get and run FULL SCAN's, not the QUICK or FLASH SCAN's.

You will likely want to run some of the scans a few times to make sure the server is clean. Once you are relatively confident it is clean you need to uninstall all unnecessary programs, install a full Antivirus program, update all of the software remaining to the newest versions including Windows. You may want to research Group Policy and consider if you want students plugging flash drives into pc's or not. I personally consider them a Bring Your Own Device sorta unit that I can't insure is not infected so I prevent them from doing anything on any pc's or servers in our domain. At minimum you may want to get Auto Run disabled on the PC's.

Post back your results and good luck. :)

Again great thanks all. i am off to work on it soon and will write back.

Chris

Thank you all, after a 9 hour battle I (we) won. Server back online and clean.