Server 2003 Standard Issue

[The-One]

Hi All
I am having this weird problem with 2 of my 2003 servers on the network, under group policy editor-windows settings-security settings –local policies-User right Assignment- access this computer from the network, I keep losing these setting and all users loose connection to that server.

But when I go back and have a look at access this computer from the network, all security settings are lost and I have to add those users and groups back in again, this happens every 10min or so.
This is happening with two of my servers, the other 10 don’t have this issue,
Any help would greatly be appreciated as I don’t know where to look anymore

 

[savage]

Google for something called Policy Reporter, download, install, check what's up.

Enable debug logging, have a look at the logs under %SYSTEMROOT%\Debug

That should get u started at least I suppose

 

[The-One]

I manged to find the culprit, I check under Processes and found WinMgmt.exe running, was a Trojan of Win32/Boberog.L worm, file was located user c:\windows\system32\drivers, hope this might help for anyone of you having the problem is the futre.

 

[Aqox]

lol, what AV u running on the server?