Around two weeks ago I received a call from a customer complaining their server is not able to send and receive emails, Workstations are experiencing problems accessing network resources, Internet connection is overloaded and obscure "Net Send" application pop-up from an unknown source apparently from outside.
Looking into the problem showed that something malicious is running in the background on the server which removes the
server hidden share folders (This is why users reported "The network name can not be found")and consumes the whole internet bandwidth by sending traffic to a range of IP addresses (the kind of traffic didn't bother me as I was supposed the fix the problem ASAP). Finally after examining the registry content (like HKLM\Software\Microsoft\Windows\CurrentVersion\Run)we could find out a file named "ethernet32m.exe" is loaded by server startup and is running as a service. No reports on the web for ethernet32m.exe to be a malicious file nor we could find any resource saying this is a system file. So we carefully made backup of System State data, switched to safe mode, removed WINDY\SYSTEM32\ethernet32m.exe, searched registry for any ethernet32m.exe entry and removed them all and back to normal operation mode again... It was gone!
I am still curious to know what exactly it was and how it could reach the server while the server console was locked! The Anti Virus solution recorded many Netsky, MyDoom and Beagle on client machines which all were quarantined but no logs on the server.
Labels: Security, Windows