One of our servers is a ZOMBIE

[DABhand]

UPX'd dll yeah I think you found your cause. UPX as you know is the poor mans compressor :P

But have you tried to go into safemode and use regsvr32 to uninstall it and remove it. Also remove anything from the c:\windows\system32\prefetch folder also. As it may be residing in there.

Also check your startup incase there is a self executable that reinstates it.

And perhaps even use sfc /scannow to check for legit system files not being tampered with.


EDIT: Search for a lifuqyny file on your system. perhaps thats the culprit :\

There is also a reference to a %08X.dll and %s%s.bak

[EMPiRE]

That is just it, it is a remote server to which I do not have any access to, also no kvm access, so safemode is not possible

Windows\prefecht only has the usual NTOSBOOT-B00DFAAD.pf file which every Win2K3 server has, startup & services does not have anything "interesting", registry does not have any links to the dll file

sfc does not work in a RDC session it wants to run as administrator running a console session...

regsvr32 does not work