We would like to draw the attention of all clients using Windows to the growing number of servers infected with malware. The most common consequences are encryption of all files on the disk by ransomware, or a BTC miner being launched, which heavily overloads the server, causes it to hang and leads to the recurring "black screen" problem when connecting via RDP, which only a reboot resolves. Somewhat less often: malicious network activity, network scanning, participation in DDoS attacks, sending spam, etc.

The most likely cause of infection is some vulnerability in Windows Server 2008 R2 or the use of a web browser on the server.

We strongly recommend regularly installing all available Windows security updates and following our security recommendations

We also remind you of the need to regularly back up all important data from your server. Under the terms of service, this is solely your responsibility: we are not responsible for the safety of data on servers and do not make backups. Make sure your administrator always has up-to-date backups stored outside the server (storing backups on the server itself is useless). Such backups are the only way to recover your data if it is lost or damaged for any reason.

If you are dealing with an infection (the server is unstable, reboots on its own, some time after a reboot you get "only a black screen" when connecting via RDP, the server has a constant 100% CPU load (on all cores or one of them), and other symptoms), we recommend booting the server from the Dr.Web LiveCD ISO image, updating the antivirus databases and running a scan. Before that, you may need to switch the virtual machine's controller mode from "Virtio" to "default" in the VDS control panel.

How to change virtual machine settings
How to mount an ISO image and boot your VDS server from it

Keep in mind that there is no guarantee this antivirus will detect all malware, but the most common miners will most likely be neutralized, which will let you bring the server back to a working state for a while. After that, we strongly recommend a full scan and cleanup of the server following the instructions and with the help of the specialists of VirusInfo

Another option is a full reinstallation of the virtual server. This is the only way to quickly and easily get a machine that is 100% free of malware, but it does not rule out reinfection in the future.

Please note that, under the terms of service and the technical support policy, we do not administer software on clients' servers. Resolving all software-related issues (including security, virus removal, data recovery, etc.) is the responsibility of your system administrator. You can order administration services from our specialists for an additional fee, but in malware cases we cannot guarantee results (they depend on the antivirus, not on us) and cannot guarantee that the infection will not recur later (since the way it got in is unknown).