Lost network connection

Hello,
one of oour servers (Win2003R2) lost all networking capabillities. We cannot
ping "destination unreachable" by either IP address or Host name. There are
packets coming in and out but they get lost somewhere in the stack. We tried
a different NIC and tried to reset the winsock stack without any changes. If
we try to "repair the network connection" we get an error message that the
"ARP cache cannot be flushed". When the server restarts the IPsec service
doesn't start with an error " file not found". Lsass.exe is in the correct
directory.
Does anyone have any insights to that and can recommend a repair solution?

Thanks, Stefan

Hello,

did you install the Windows 2003 Service pack 2 ?
Any eventlog entry ?
chkdsk c: ?
Any virus (did you analyze) ?


--
Cordialement,
Mathieu CHATEAU
http://lordoftheping.blogspot.com


"Network-whiz" <(E-Mail Removed)> wrote in message
news:27AD9829-9918-4A9C-8A42-(E-Mail Removed)...
> Hello,
> one of oour servers (Win2003R2) lost all networking capabillities. We
> cannot
> ping "destination unreachable" by either IP address or Host name. There
> are
> packets coming in and out but they get lost somewhere in the stack. We
> tried
> a different NIC and tried to reset the winsock stack without any changes.
> If
> we try to "repair the network connection" we get an error message that the
> "ARP cache cannot be flushed". When the server restarts the IPsec service
> doesn't start with an error " file not found". Lsass.exe is in the correct
> directory.
> Does anyone have any insights to that and can recommend a repair
> solution?
>
> Thanks, Stefan

There are no events in the log exept that IPsec and DHSP services couldn't
start. While looking through the running services in the task manager, we
come accross a service (2940KB) where we cannot find the .exe file anywhere
on the hard drives. The file name also changes on every restart. Looks like
some malware to us. The MS malicious softwre removal tool does not find any
infections neither does TrendMicros AV software. Since we can't get on line
with the machine and the drives cannot be removed (Raid Aray) is there a
scanner one recommeds that can be downloaded and installed?

Thanks for answering.


"Network-whiz" wrote:

> Hello,
> one of oour servers (Win2003R2) lost all networking capabillities. We cannot
> ping "destination unreachable" by either IP address or Host name. There are
> packets coming in and out but they get lost somewhere in the stack. We tried
> a different NIC and tried to reset the winsock stack without any changes. If
> we try to "repair the network connection" we get an error message that the
> "ARP cache cannot be flushed". When the server restarts the IPsec service
> doesn't start with an error " file not found". Lsass.exe is in the correct
> directory.
> Does anyone have any insights to that and can recommend a repair solution?
>
> Thanks, Stefan

Executable changing it's name sound very bad.
Unplug this server from the network

You may check that the Windows File protection is running:
HOW TO: Verify That Windows File Protection Is Running in Windows Server
2003
http://support.microsoft.com/?scid=k...4597&x=14&y=14

You may force a check: sfc /scannow
You may force it to be enabled: sfc /enable

Spy bot may help (you can download it's update to install offline)
http://www.safer-networking.org/en/index.html


--
Cordialement,
Mathieu CHATEAU
http://lordoftheping.blogspot.com


"Network-whiz" <(E-Mail Removed)> wrote in message
news5B33C09-0653-4A90-90DF-(E-Mail Removed)...
> There are no events in the log exept that IPsec and DHSP services couldn't
> start. While looking through the running services in the task manager, we
> come accross a service (2940KB) where we cannot find the .exe file
> anywhere
> on the hard drives. The file name also changes on every restart. Looks
> like
> some malware to us. The MS malicious softwre removal tool does not find
> any
> infections neither does TrendMicros AV software. Since we can't get on
> line
> with the machine and the drives cannot be removed (Raid Aray) is there a
> scanner one recommeds that can be downloaded and installed?
>
> Thanks for answering.
>
>
> "Network-whiz" wrote:
>
>> Hello,
>> one of oour servers (Win2003R2) lost all networking capabillities. We
>> cannot
>> ping "destination unreachable" by either IP address or Host name. There
>> are
>> packets coming in and out but they get lost somewhere in the stack. We
>> tried
>> a different NIC and tried to reset the winsock stack without any changes.
>> If
>> we try to "repair the network connection" we get an error message that
>> the
>> "ARP cache cannot be flushed". When the server restarts the IPsec service
>> doesn't start with an error " file not found". Lsass.exe is in the
>> correct
>> directory.
>> Does anyone have any insights to that and can recommend a repair
>> solution?
>>
>> Thanks, Stefan

We reinstalled SP2 And ran "netsh int ip reset" command with noimprovement.
The misterous file was generated by Trendmicros AV and was in the
c:\windows\temp folder.
My next step is to run Kaspersky AV on it but I am not so confident that it
is a virus/malware problem in the first place.
Any other hints or ideas?

Thanks, Stefan


"Mathieu CHATEAU" wrote:

> Executable changing it's name sound very bad.
> Unplug this server from the network
>
> You may check that the Windows File protection is running:
> HOW TO: Verify That Windows File Protection Is Running in Windows Server
> 2003
> http://support.microsoft.com/?scid=k...4597&x=14&y=14
>
> You may force a check: sfc /scannow
> You may force it to be enabled: sfc /enable
>
> Spy bot may help (you can download it's update to install offline)
> http://www.safer-networking.org/en/index.html
>
>
> --
> Cordialement,
> Mathieu CHATEAU
> http://lordoftheping.blogspot.com
>
>
> "Network-whiz" <(E-Mail Removed)> wrote in message
> news5B33C09-0653-4A90-90DF-(E-Mail Removed)...
> > There are no events in the log exept that IPsec and DHSP services couldn't
> > start. While looking through the running services in the task manager, we
> > come accross a service (2940KB) where we cannot find the .exe file
> > anywhere
> > on the hard drives. The file name also changes on every restart. Looks
> > like
> > some malware to us. The MS malicious softwre removal tool does not find
> > any
> > infections neither does TrendMicros AV software. Since we can't get on
> > line
> > with the machine and the drives cannot be removed (Raid Aray) is there a
> > scanner one recommeds that can be downloaded and installed?
> >
> > Thanks for answering.
> >
> >
> > "Network-whiz" wrote:
> >
> >> Hello,
> >> one of oour servers (Win2003R2) lost all networking capabillities. We
> >> cannot
> >> ping "destination unreachable" by either IP address or Host name. There
> >> are
> >> packets coming in and out but they get lost somewhere in the stack. We
> >> tried
> >> a different NIC and tried to reset the winsock stack without any changes.
> >> If
> >> we try to "repair the network connection" we get an error message that
> >> the
> >> "ARP cache cannot be flushed". When the server restarts the IPsec service
> >> doesn't start with an error " file not found". Lsass.exe is in the
> >> correct
> >> directory.
> >> Does anyone have any insights to that and can recommend a repair
> >> solution?
> >>
> >> Thanks, Stefan
>
>

did you apply the service pack 2?
Maybe an hardware failure on the network card ?
Can you launch a dell diagnostic or something like this to validate the
hardware?

It stopped working one day while nothing were done 5 days before ?

--
Cordialement,
Mathieu CHATEAU
http://lordoftheping.blogspot.com


"Network-whiz" <(E-Mail Removed)> wrote in message
news:915E7E78-48D8-46CA-929D-(E-Mail Removed)...
> We reinstalled SP2 And ran "netsh int ip reset" command with
> noimprovement.
> The misterous file was generated by Trendmicros AV and was in the
> c:\windows\temp folder.
> My next step is to run Kaspersky AV on it but I am not so confident that
> it
> is a virus/malware problem in the first place.
> Any other hints or ideas?
>
> Thanks, Stefan
>
>
> "Mathieu CHATEAU" wrote:
>
>> Executable changing it's name sound very bad.
>> Unplug this server from the network
>>
>> You may check that the Windows File protection is running:
>> HOW TO: Verify That Windows File Protection Is Running in Windows Server
>> 2003
>> http://support.microsoft.com/?scid=k...4597&x=14&y=14
>>
>> You may force a check: sfc /scannow
>> You may force it to be enabled: sfc /enable
>>
>> Spy bot may help (you can download it's update to install offline)
>> http://www.safer-networking.org/en/index.html
>>
>>
>> --
>> Cordialement,
>> Mathieu CHATEAU
>> http://lordoftheping.blogspot.com
>>
>>
>> "Network-whiz" <(E-Mail Removed)> wrote in message
>> news5B33C09-0653-4A90-90DF-(E-Mail Removed)...
>> > There are no events in the log exept that IPsec and DHSP services
>> > couldn't
>> > start. While looking through the running services in the task manager,
>> > we
>> > come accross a service (2940KB) where we cannot find the .exe file
>> > anywhere
>> > on the hard drives. The file name also changes on every restart. Looks
>> > like
>> > some malware to us. The MS malicious softwre removal tool does not find
>> > any
>> > infections neither does TrendMicros AV software. Since we can't get on
>> > line
>> > with the machine and the drives cannot be removed (Raid Aray) is there
>> > a
>> > scanner one recommeds that can be downloaded and installed?
>> >
>> > Thanks for answering.
>> >
>> >
>> > "Network-whiz" wrote:
>> >
>> >> Hello,
>> >> one of oour servers (Win2003R2) lost all networking capabillities. We
>> >> cannot
>> >> ping "destination unreachable" by either IP address or Host name.
>> >> There
>> >> are
>> >> packets coming in and out but they get lost somewhere in the stack. We
>> >> tried
>> >> a different NIC and tried to reset the winsock stack without any
>> >> changes.
>> >> If
>> >> we try to "repair the network connection" we get an error message that
>> >> the
>> >> "ARP cache cannot be flushed". When the server restarts the IPsec
>> >> service
>> >> doesn't start with an error " file not found". Lsass.exe is in the
>> >> correct
>> >> directory.
>> >> Does anyone have any insights to that and can recommend a repair
>> >> solution?
>> >>
>> >> Thanks, Stefan
>>
>>