New Observation

Please, can somebody help me on what I am experiencing
presently on our network.

Just this morning, users of the network complained that
most of the services on the network are disabled.

For instance: on some of the systems, you can't view the
Event Viewer Properties. If you copy a file or folder from
either the local machine or over the network, when you
right click to paste it, the "paste" option is disabled.

Also when you click on Programme Files you will not see
the files and the folders contained in it. Also some the
users can't share their folders.

I have checked the Domain Policy, such restrictions where
not defined.

Please can someone give me information on how to tackle
these problems.

Thank you.

Ezeh Ikechukwu

>-----Original Message-----
>Please, can somebody help me on what I am experiencing
>presently on our network.
>
>Just this morning, users of the network complained that
>most of the services on the network are disabled.
>
>For instance: on some of the systems, you can't view the
>Event Viewer Properties.


Group Policy? It does sound like policies have been
changed for domain users and / or domain workstations. I
take it the server/s is/are not affected?


If all else fails, surely you have one workstation that
you can restore from a recent backup and logon locally to
test all is normal? Then, log into the network, and see
if this causes these changes to occur again?

Personally, I can see this problem keeping you busy for
sometime yet.

Marko

gpresult on an affected machine. look for a new gpo but check all mentioned.

"Marko" <> wrote in message
news:06a501c37de4$835a6220$...
>
> >-----Original Message-----
> >Please, can somebody help me on what I am experiencing
> >presently on our network.
> >
> >Just this morning, users of the network complained that
> >most of the services on the network are disabled.
> >
> >For instance: on some of the systems, you can't view the
> >Event Viewer Properties.
>
>
> Group Policy? It does sound like policies have been
> changed for domain users and / or domain workstations. I
> take it the server/s is/are not affected?
>
>
> If all else fails, surely you have one workstation that
> you can restore from a recent backup and logon locally to
> test all is normal? Then, log into the network, and see
> if this causes these changes to occur again?
>
> Personally, I can see this problem keeping you busy for
> sometime yet.

Nettransplant

It sounds like you are infected with the Blaster varient Welchia, it kills
the RPC service on some machines, look in the %systemroot%/system32/WINS and
see if these two files are there, DLLHOST.exe and SVCHOST. If they are there
you are infected, download the tool from www.sarc.com it clean them. And
make sure all your machines are patched with the latest fixes from MS.

HTH,


--
Jeffrey W. Roach
MCSE, MCSA, CNA, Network+, A+





Ezeh Ikechukwu wrote:
> Please, can somebody help me on what I am experiencing
> presently on our network.
>
> Just this morning, users of the network complained that
> most of the services on the network are disabled.
>
> For instance: on some of the systems, you can't view the
> Event Viewer Properties. If you copy a file or folder from
> either the local machine or over the network, when you
> right click to paste it, the "paste" option is disabled.
>
> Also when you click on Programme Files you will not see
> the files and the folders contained in it. Also some the
> users can't share their folders.
>
> I have checked the Domain Policy, such restrictions where
> not defined.
>
> Please can someone give me information on how to tackle
> these problems.
>
> Thank you.

Jeffrey W. Roach

It looks like you got a virus.

Chris

>-----Original Message-----
>Please, can somebody help me on what I am experiencing
>presently on our network.
>
>Just this morning, users of the network complained that
>most of the services on the network are disabled.
>
>For instance: on some of the systems, you can't view the
>Event Viewer Properties. If you copy a file or folder
from
>either the local machine or over the network, when you
>right click to paste it, the "paste" option is disabled.
>
>Also when you click on Programme Files you will not see
>the files and the folders contained in it. Also some the
>users can't share their folders.
>
>I have checked the Domain Policy, such restrictions
where
>not defined.
>
>Please can someone give me information on how to tackle
>these problems.
>
>Thank you.
>.
>

Chris Fuller