Invisible files in Windows server 2003

Discussion in 'Windows Server' started by danrostron, May 22, 2006.

  1. danrostron

    danrostron Guest

    Hi

    I seem to have a problem with certain files within Windows Server 2003
    Standard Edition.

    The are certain systems files such as cscript.exe, and net.exe that appear
    to be missing, however when I create a new file and try to rename it to
    cscript.exe it says that the file already exists. I have made sure that 'Show
    hidden files and folders' is checked, also that 'Hide protected operating
    system files' is unchecked.

    The program can also not be launched from DOS, stating that 'cscript' is not
    recognized as an internal or external command, operable program or batch
    file'.

    The program was running fine until about a month ago. It now just seems to
    be invisible.

    Any thoughts anyone?

    Thanks
    Dan Rostron
     
    danrostron, May 22, 2006
    #1
    1. Advertisements

  2. Silly question have you tried rebooting? Has any updates being downloaded an
    applied automatically or manually recently. Anything installed recently?
     
    Steve Goddard, May 22, 2006
    #2
    1. Advertisements

  3. danrostron

    danrostron Guest

    Hi Steve

    Yes I have tried rebooting once but to no avail. The problem started at the
    7th of April. There were four updates installed on the 14th - but I do not
    think any of these are causing the problem - because wrong timing. We also
    installed these updates on another Windows 2003 Server and they didn't cause
    any problems.

    Any more thoughts?
    Thanks
    Dan
     
    danrostron, May 22, 2006
    #3
  4. Maybe, "root-kit's". I could be seriously jumping the gun but the behaviour
    sounds very familar to that of a malware program that is hiding itself. The
    tools used to spot root-kits might help, do some background reading on it, I
    don't want to suggest running a tool that may cause you other problmes but
    sysinternals knows a hell of a lot about MS OS's.

    http://www.sysinternals.com/Utilities/RootkitRevealer.html

    The only other thoughts would to be suggest copying over the missing files
    from the other server, if the files are in use then use the article below.
    Running a System File Check might also replace these files if they are not
    the Microsoft digitally signed ones that should be present.

    How to replace in-use files at Windows restart
    http://support.microsoft.com/kb/181345/en-us
     
    Steve Goddard, May 22, 2006
    #4
  5. danrostron

    danrostron Guest

    Steve

    Thanks very much for the response below. It turns out we do have a rootkit
    on there. I've worked out how to remove this. I just need to find out how the
    bastards got in now....

    Thanks again
    Dan Rostron.
     
    danrostron, May 23, 2006
    #5
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.