Strange scheduled tasks on Windows Server 2003

malwarewindows-server-2003

A few days ago, I noticed that our Windows Server 2003 system has strange scheduled tasks. I do not know where they came from or who set them up. I deleted them and they came up again today. They have names such as "At1","At2", "At3" and the status says that they are running.

When I open their properties, the run command looks like rundll32.exe zfypspqu.u,ygxjgq.

What it could be? Does my server have some virus? I did a scan with nod32 and it didn't report anything. I do not have anything unusual set up on this server – it's only running SQLServer 2005 with ReportServer. Two other servers with similar configuration do not have these strange scheduled tasks.

Best Answer

That's a Conficker infection.

Basic steps to remove it:

If you have multiple systems, make sure you fix them all.

The full Microsoft guide for protecting yourself from Conficker is here.

Good luck, I've had to deal with a Conficker infection at a smallish client, about 30 servers spread throughout 12 sites, it was not fun.