We have multiple Windows 2003 boxes with all latest patches/security updates (running h-sphere) which have all been compromised in the same way. It appears that there is some type of worm/trojan that is hiding all files/folders on the server that contains the word "temp".. this is causing a lot of problems with customers sites. It also appears to be able to uninstall/remove virus scanning software such as AVG. We had AVG installed on more than 13 boxes and it was removed from all of them. At this point I still haven't determined if it's a virus/worm or an actual person who hacked the servers.
Is anyone familiar with this worm? Can anyone put a name on it? Is there any way to prevent it?
