[HELP] Server 2008 R2 - CheckSUR and SFC can't repair + possible malware in scheduled task

[Shin]

Hello,

I'm experiencing serious integrity issues on a Windows Server 2008 R2 machine.

- `CheckSUR` and `sfc /scannow` both fail to repair system files.
- `FRST` reveals suspicious scheduled tasks (e.g., MsInputMonitor) that seem to delete security-related registry entries.
- Possible unauthorized use of suspicious `winreg.exe` and `winacl.exe` in Temp folder.

I suspect there is hidden malware interfering with updates and logging.

Could you please review the attached logs and provide a custom `SFCFix.zip` package and/or malware removal fix?

Thanks in advance!

**Attached Logs:**
- CheckSUR.log
- CheckSUR.persist.log
- CBS.log / part
- FRST.txt
- Addition.txt
- Shortcut.txt

 

[Shin]

Hi,

I've attached the results of the ComponentScanner for your review.

Please take a look when you have a chance.
Let me know if you need anything else from my side.

Thanks again for your help!

 

[DR M]

Hi, Shin!

Welcome to Sysnative Forums!

Thanks for your patience.

Is this computer a personal computer or a business computer?

In addition, have in mind that Microsoft Windows Server 2008 R2 Enterprise stopped getting security updates 5 years ago. We don't use to clean outdated systems, since they basically consist of a security risk. Even if you clean such a system, it is likely going to get infected soon or later, because of that.

If it is a personal computer, I recommend you get a version of Windows 11 (if your computer supports it) suitable for an ordinary user (Home or Pro), and make a fresh start. There are some reputable sites selling Windows 11 at a low price these days.

Let me know about your thoughts.

 

[Shin]

This is a computer that is currently being used as a server. There has been a problem with an attack, etc., so I asked you to know this place while taking various measures. I'm currently running a website, so I'm going to solve the problem to some extent and transfer the server. There are problems with the mail system and the schedule system, but I couldn't log in either, so I came all the way here. Can you help me?

 

[DR M]

See here:

Windows Server 2008 R2 - Microsoft Lifecycle

So, based on the above info, as well as on what I wrote above, I can't help you to clean the system. Sorry.

 

[Shin]

Thank you for your interest and response.

 

[DR M]

You are welcome.

Take care, Shin.