WebServer Keeps Getting Viruses in ASPNET User

[GalaxyWho]

We have WebServer that runs Windows Server 2008 R2 and uses MSSQL and VB.NET (ASPX) Webpages, however, it keeps getting attacked by lots of Viruses, which the AV does not seem to pick up or when it does, its 2 or 3 days old.

 

Until recently it had disabled the Windows Updates so no Updates had got through for around 2 months, I managed to get that working again, and I believe it is all updated now (It does not report any Errors).

I have also removed a whole host of software that was installed on there but is not needed (Adobe Flash, Ms Office 2010, Java SDK and RE and lots other) to minimize exploits etc.

 

However we keep getting attacked by Viruses on here quite a lot, and I noticed the other day that in the Documents and Downloads folder of the ASPNET user there were loads of Viruses, I scanned it all and got the Antivirus (Avast for Business) to remove what it could, then I Deleted the Rest of them manually.

 

I have run several full scans with Avast and Malwarebytes but it does not see any threats however again, the Documents and Downloads folder seems to be getting more in them, below is a list of some of the files that are in there at the moment.

 

Builder.Panel

ConfuserEx_bin

KPortScan-3.0

Themida_x32_x64_v2.4.6.0

Nuclear Explosion

 

Has anybody got any tips to try and help get rid of these for once and for all without a rebuild of the OS?

 

Also, would anybody know why they all seem to be downloading into the ASPNET User, is there anything we can do to "block" it, I know what the user is and for, but not sure if we can change anything?

 

Many Thanks

[DGardiner]

We have WebServer that runs Windows Server 2008 R2 and uses MSSQL and VB.NET (ASPX) Webpages, however, it keeps getting attacked by lots of Viruses, which the AV does not seem to pick up or when it does, its 2 or 3 days old.

 

Until recently it had disabled the Windows Updates so no Updates had got through for around 2 months, I managed to get that working again, and I believe it is all updated now (It does not report any Errors).

I have also removed a whole host of software that was installed on there but is not needed (Adobe Flash, Ms Office 2010, Java SDK and RE and lots other) to minimize exploits etc.

 

However we keep getting attacked by Viruses on here quite a lot, and I noticed the other day that in the Documents and Downloads folder of the ASPNET user there were loads of Viruses, I scanned it all and got the Antivirus (Avast for Business) to remove what it could, then I Deleted the Rest of them manually.

 

I have run several full scans with Avast and Malwarebytes but it does not see any threats however again, the Documents and Downloads folder seems to be getting more in them, below is a list of some of the files that are in there at the moment.

 

Builder.Panel

ConfuserEx_bin

KPortScan-3.0

Themida_x32_x64_v2.4.6.0

Nuclear Explosion

 

Has anybody got any tips to try and help get rid of these for once and for all without a rebuild of the OS?

 

Also, would anybody know why they all seem to be downloading into the ASPNET User, is there anything we can do to "block" it, I know what the user is and for, but not sure if we can change anything?

 

Many Thanks

 

if you can i would check the code against a clean copy - sounds like some things being exploited on the web app but can luckily only interact with the user the apps running in?