One of our servers is a ZOMBIE

[EMPiRE]

I am running housecall now... let's see if it find anything

What I did find was a suspicious .dll file which is in use and is upx'ed, it is dated 2 days ago and I have not installed anything on this server... is resides in: WINDOWS\TEMP (see attached .dll)

The SPAM itself is always the same (or with similar links xxx.blogspot.com):

================================================== =====================
Hallo,

Real men! Milliions of people acrosss the world have already tested THIS and ARE making their ggirlfriends feel brand new sexual seensations! YOU are the best in bed, aren't you ?
Girls! Deveelop your sexual relationshipp and get even MORE pleaasure! Make your boyyfriend a gift!
http://adelinelindstromn.blogspot.com

She said these words repeatedly. Soon, the divine a paper
inserted in the memoires de l'academie and without the stiffness
which usually accompanies should take care to gratify the
regenerate ones. Hidden evidence of wealth and of superiority
to or any last cry of farewell? It was ulva calling many
painters who have sought by means of the they felt at home
there, as in some barn whose you lately. So when carlos
proposedyou see i don't to do with him, ma'am, as much as
you can wish those rites were ended, a strange goddess,
o king, to place. As if i had not enough luggage to carry
of thy army, headed by bhishma and drona, impetuously excuse
that to have then attempted to put these of vasudeva, by
name samva, will bring forth a.
================================================== =====================

[DABhand]

UPX'd dll yeah I think you found your cause. UPX as you know is the poor mans compressor :P

But have you tried to go into safemode and use regsvr32 to uninstall it and remove it. Also remove anything from the c:\windows\system32\prefetch folder also. As it may be residing in there.

Also check your startup incase there is a self executable that reinstates it.

And perhaps even use sfc /scannow to check for legit system files not being tampered with.


EDIT: Search for a lifuqyny file on your system. perhaps thats the culprit :\

There is also a reference to a %08X.dll and %s%s.bak

[EMPiRE]

That is just it, it is a remote server to which I do not have any access to, also no kvm access, so safemode is not possible

Windows\prefecht only has the usual NTOSBOOT-B00DFAAD.pf file which every Win2K3 server has, startup & services does not have anything "interesting", registry does not have any links to the dll file

sfc does not work in a RDC session it wants to run as administrator running a console session...

regsvr32 does not work