Web Hosting Talk : Web Hosting Main Forums : Dedicated Server : How to remove "hscan.exe"

[anilktm]

Hello,

I have a Server with EV1 and yesterday I got one Abuse mail from them that my Server is Compromised.

I have checked the current running programs through Taskmanager and I can find that "Hscan.exe" is running on my Server.

I have stopped it and again it will come. After that EV1 support people remove it from registery.

But now today that hscan.exe is running.

So Please tell me how to remove this "hscan.exe" from my Server??

Expecting everybodys reply.

Anilktm

[Steven]

Sounds like you are running windows and you are hacked. Most likely though an unpatched exploit. My suggestion is getting a reload and securing the server properly the first time.

[anilktm]

Can anybody help me how to remove this hscan.exe from my Win Server.

Aniktms

[sirius]

Originally posted by anilktm
Can anybody help me how to remove this hscan.exe from my Win Server.

Aniktms

You got the best answer you're going to get from thelinuxguy... he knows his stuff.

Sirius

[dollar]

Originally posted by anilktm
Can anybody help me how to remove this hscan.exe from my Win Server.

Aniktms

Right click on the file and delete it

In all seriousness, your server has been compromised, the only way to fix your problem is to have a fresh OS image put on the machine, otherwise you will be back here in another two weeks asking the same question again.

[anilktm]

Thanks everybodys reply.

I think this is the fault of EV1 right?

If so, then why they are not suggest me to reload with new OS. They asked me to hire a Good Server Admin for trouble shooting this. They are providing only UNmanaged Servers. I think this is some business relation between EV1 & Server Admins...

[dollar]

This is your fault for not securing your server.

If you don't lock the door to your house at night and a person breaks in, you don't blame the people that built your door do you?

This is no business between EV1 and server admins.

EV1 offers unmanaged servers, meaning security and updates are supposed to be taken care of by you in some way or another. Either you need to be on top of it, or you need to hire somebody else to take care of it. If you want the company you purchase your machine from to do this for you, you should be purchasing a "managed" server which will cost more.

You really should have done more reasearch before purchasing a machine =/

[sirius]

Originally posted by anilktm
Thanks everybodys reply.

I think this is the fault of EV1 right?

If so, then why they are not suggest me to reload with new OS. They asked me to hire a Good Server Admin for trouble shooting this. They are providing only UNmanaged Servers. I think this is some business relation between EV1 & Server Admins...

Nada. You're playing with big boy toys now... and with that, comes responsibility.

You are responsible for your data and keeping it secure. EV1 is there to ensure that you server hardware is available and that the network is available. You are responsible for everything else.

Like has been said, get an OS reload and have a professional secure your server.

Sirius

[sprintserve]

For Windows, it's actually easier to clean out of trojans than Linux. I have done both and windows is no doubt easier. The fact that Windows is closed sourced is a blessing. It is actually possible to clean out a Windows system from most common trojans.

If you want, i can see if I can remove the backdoor for you. My 4th July good deed : )

[sirius]

Originally posted by sprintserve
If you want, i can see if I can remove the backdoor for you. My 4th July good deed : )

Although a good deed, you are leaving the thread starter open to further attacks. By providing a band aid (removing the trojan) the thread starter is likely going to do nothing else and will just be compromised again.

My .02

Sirius

P.S. Never let a good deed go unpunished.

[Stacie]

http://www3.ca.com/securityadvisor/p...x?id=453075204

[dkitchen]

Either get the box completely reloaded, or hire a professional Windows admin to fix the box for you.

I have to second what sprintserve said, it is pretty easy to clear a Windows exploit if you know what you're doing, as there is really nowhere for it to hide...

You should remember though that server security is an ongoing thing, and if you don't know what you're doing yourself, hire someone professional to do it for you - or this will happen again and again...

[Steven]

there are rootkits for windows to hide things.

http://www.securityfocus.com/news/2879

[nadtz]

depends on the exploit. I've seen some that were a right pain to remove.

[TDMWeb]

Whether it is cheaper for you to have an OS reinstall and re-add all of your data, or to hire a professional experienced in removing Windows "malware", depends on how easy it will be to re-add all your data and how much this costs you in revenue etc.

This chap knows a lot about Win malware removal: www.blong.com (but he operates commercially).