Backdoor.ASP.Ace.C keeps showing up and being removed by f-secure

Question

Backdoor.ASP.Ace.C is being found and removed from:

C:\Users[username]\AppData\Local\Temp[randomstring]

We have recently found some malicious aspx files on our IIS server that we have studied and have stored on our computer. Scanning these files with online virus detecting programs identified the Backdoor.ASP.Ace.C virus on them.

We have several computers and servers with f-secure, but only some of them have detected Backdoor.ASP.Ace.C.

Do anyone know what this virus is doing on our computers and servers?

Answer 1

What is it doing: probably providing access to a malicious user

What you should: wipe the system and restore from backup that was not yet affected by the virus. If a virus keeps popping up it means it's not being removed succesfully or someone keeps putting it back.

There is no other way to have 100% certainty that your system is not compromized anymore. If you want to extract the file or locate it so you can verify it on your backups. It should be in the Temporary Internet Files directory.