Not sure what is going on, but I seem to be infected

[echodreamz]

I am not 100% sure, but something is up with this server I have here at home that I use to host some friends websites. A few days ago it was compromised and every restart some driver is loaded and a strange aa.pif file is created in the windows temp directory. The .pif file is full of random jibber. As well as 2 files in the drivers directory called "MsftWdf_Kernel_01011_Inbox_Critical.Wdf" and "MsftWdf_User_01_11_00_Inbox_Critical.Wdf"

 

I am also finding random directories / files locked and i have to boot into safemode to delete them. If I delete the aa.pif file it comes back after a restart.

 

The line in the FRST log that concerns me is the unsigned "Microsoft" driver being loaded.

Addition.txt

FRST.txt

[gringo_pr]

Hello

We are very sorry for the delay in responding to your request, If you are still in need of assistance please let me know and I will get started in helping you with your request.

Regards,

Gringo

Malwareremoval

Malwarebytes

[gringo_pr]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!