0

So, i have a HP proliant server with windows server 2012 installed, all worked fine until last weekend power went off for couple of hours. it was on external power source, but it's battery wasn't strong enough to stay powered. Well since that windows server is not running as it should. It boots up perfectly until the stage when you should have a login screen. It's just black screen without anything. CTRL ALT DEL is not working. you can't do anything that will make something to appear, just black screen. However i think windows is running it's just not visible because you can see everything on network, you can ping and things like this. Second problem i have is that RDP is not working, you cant login to it by any other methods i know, like remote powershell or network regedit since non of that was configured to run. I tried to run Chkdsk and sfc through installation dvd but when i would like to see what are the partions used through "diskpart" there is nothing visible. Any ideas what to do?

PS: i tried to find safe boot but it's not there. ALso I don't know specifications of server nor configured settings in it since it's not my job and i'm not the guy for that. (that guy was fired and he left no notes or anything)

Sorry for my english.

Edit1: i think RDP services or registry keys are damaged that's why it's not working and you can't login to it

Edit2: startup repair does absolutely nothing

Edit3: okay i found that at the same time as server was online, one user was logged through RDP with opened Outlook and firefox. So maybe it's not windows problem but could be some sort of a virus. I scanned network folders with malwarebytes and newest Eset smart security, but those were clear. so could it be that system files got corrupted because of malware?

0

Check for this file "C:\Windows\SysWOW64\lsassw86s.exe" (or that folder or System32 for recently added file.
It was added on sunday on our server. https://www.virustotal.com/en/file/23c6139eef0be9f1c89d409aff9e06b9c9f8b25f742250b3d578a23771cff012/analysis/1507617932/.
I'm just going to wipe it... Also HP Blade, W2012R2.
There was also a service called "Windows Security Accounts Manager".

0

Yeah it happened because of malware just as Random IT Guy said. Not sure if person that was last connected opened infected mail or it was downloaded through RDP to our server from her PC but what we needed to do was load raid drivers through CMD then chech services and registry, search for malware using malwarebyte and eset (virus deactivated eset, customer monitor and firewall) and it changed RDP port as well! Be carefull. we used 3389 port for rdp i changed it now also blocked the account of the person that caused that, untill her pc will be checked. Hope this wont happen to you :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.