I was asked by a coworker to help solve a problem with a remote client site through VNC. Immediately after connecting I've started noticing some strange behaviors that I am lead more and more to believe are virus related.
1) When first logging in a popup warning "services.exe" had stopped working.
2) The windows error log has numerous (I'm talking into the hundreds) of WinVNC lines stating blacklisted connections from all different IP addresses
3) The SQL Server 2005 Express database is no longer accessible. Previously it was set to allow Windows Authentication but that no longer works. Issuing commands like:
osql –U sa –S SQLSERVER\INSTANCE
...Or similar from the command line give errors stating that the authentication is denied.
netstat-an | find /i "established" TCP 192.168.15.20:4366 <SUSPICIOUS_IP>:1015 ESTABLISHED netstat -b -a -n TCP 192.168.15.20:4366 <SUSPICIOUS_IP>:1015 ESTABLISHED 3148 [services.exe]
And the final kicker....
5) When searching for "services.exe" on C:\ I find two. One in system32, one in system, Looking at the properties of the file in
system in the Version -> Original Filename tab I get
GuardS5.exe along with a few other oddball entries throughout the properties.
The question I ask.... how can I troubleshoot this further from a strictly remote connection? I will not be able to do Safe Mode or reboots. Ultimately if I can get definitive proof that this is an infected PC then more drastic steps can be taken.