Sqler.exe virus, scan returns nothing but keeps coming back

[Patccmoi]

Hi,

we have a dev web server at work that is infected by a virus. The file name I see is sqler.exe, and it locates itself in the Microsoft SQL Server\110\Shared folder. Even if I delete the folder, it will just comes back 5-10 minutes later. At first I believed it was actually related to SQL, but I noticed that deleting it has 0 impact on our SQL services whatsoever.

The virus seems to be some sort of Cryptocurrency miner as it's consuming a very high % of CPU (75+%) whenever it is running. If I kill it in Task Management, it will start again 5-10 minutes later.

We have run Malwarebytes but it does not detect anything, and I do not know which further step I should take to eliminate the file. Any help would be appreciated.

The server is running on Windows Server 2012 R2

[AdvancedSetup]

Hello @Patccmoi

Very sorry for the delay. It looks like your topic was overlooked. Did you still need help with this?

Thank you

Ron

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks