Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Backdoor.ASP.Ace.C is being found and removed from:

C:\Users[username]\AppData\Local\Temp[randomstring]

We have recently found some malicious aspx files on our IIS server that we have studied and have stored on our computer. Scanning these files with online virus detecting programs identified the Backdoor.ASP.Ace.C virus on them.

We have several computers and servers with f-secure, but only some of them have detected Backdoor.ASP.Ace.C.

Do anyone know what this virus is doing on our computers and servers?

share|improve this question
2  
I daresay the naming of the virus is self-explanatory no? –  Terry Chia Oct 4 '12 at 6:06
add comment

1 Answer

What is it doing: probably providing access to a malicious user

What you should: wipe the system and restore from backup that was not yet affected by the virus. If a virus keeps popping up it means it's not being removed succesfully or someone keeps putting it back.

There is no other way to have 100% certainty that your system is not compromized anymore. If you want to extract the file or locate it so you can verify it on your backups. It should be in the Temporary Internet Files directory.

share|improve this answer
2  
Immutable law of security #1: "If a bad guy can persuade you to run his program on your computer, it's not your computer anymore." - nuke it from orbit, start over. Also, rule #4 applies too. –  Polynomial Oct 4 '12 at 7:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.