Server tries to open FTP connection to China on login

[icttechRSD]

Good morning all.

 

I have a problem with our AD server at my place of work. We've just dealt with what appeared to be a Conficker infection (how is that still getting around? I could've sworn we were fully patched) however it seems now, whenever I log in directly to the server, NOT when logging in to a workstation, the server opens a CMD window and attempts to download an executable file from a server in China via FTP, however it never actually downloads the file.

 

The server is also restarting at around 12:10am every day, even though there is nothing set in Task Scheduler to cause this.

 

Could anybody help me to finally remove this?

 

Many thanks

Luke Harrison

 

(P.S. Please fine enclosed a screenshot of the attempted file download)

 

[gringo_pr]

Hello

We are very sorry for the delay in responding to your request, If you are still in need of assistance please let me know and I will get started in helping you with your request.

Regards,

Gringo

Malwareremoval

Malwarebytes

[gringo_pr]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!