July 7, 2017 at 8:10 am
GilaMonster - Friday, July 7, 2017 7:04 AMI wonder if it was malware, or if someone intentionally installed it on the server to make some profit on the side from the cryptocurrency mining.
it very well could be. To me though, "b.exe" and "ba.exe" do not sound like programs that would be installed intentionally. especially since those programs were auto-cleaned up post install from the sounds of it.
Wouldn't be the strangest thing I've seen though if they had some installer that downloaded programs called that though.
Might not hurt to run msconfig and just check your startup items and see if any look suspicious though. If it was malware, it may re-install itself at reboot. Probably not a bad idea to look at task scheduler as well. And services.msc. Mind you, be careful disabling things in msconfig and services.msc... disabling the wrong thing can be harmful to your system. Task scheduler you can disable everything if you want and it will cause no harm to your system. May cause things to not work as expected (such as the antivirus may not do automated scans anymore).
The above is all just my opinion on what you should do.
As with all advice you find on a random internet forum - you shouldn't blindly follow it. Always test on a test server to see if there is negative side effects before making changes to live!
I recommend you NEVER run "random code" you found online on any system you care about UNLESS you understand and can verify the code OR you don't care if the code trashes your system.
July 7, 2017 at 9:13 pm
The server login access is with me only. I will be surprised if someone planted it there.
Moreover the original reason why I posted this thread was my sql server used to crash and thus stop. I realized that secury.exe was running and in task manager details view it showed under MSSQLSERVER (as you can see in the screenshot I posted in my first post).
Anyway I analysed the startup items and found nothing unusual. Thus I guess we are okay.
Viewing 2 posts - 16 through 17 (of 17 total)
You must be logged in to reply to this topic. Login to reply