(More) Workgroup connection problems 9

[SnailUK]

I have a problem with access to one of two computer connected via a workgroup network. It has been working fine but suddenly stopped. The only thing I have done, apart from spy ware cleanup is to un-install Norton System Works 2003 and install Zone Alarm.
Both workgroup computers are visible in My network places and PC1 (running XP Pro) can access PC2 (running XP home), however PC2 cannot access PC1 – I get the message:

\\PC1 is not available. You might not have permission to use this network resource. Contact the administrator of this service to find out if you have permissions.

Access is denied.

I have read through most of the (large number) of previous posts on this subject and have so far carried out/checked the following, all to no avail:

•Under TCP/IP Properties for the Network Connection, Advanced, WINS tab, disable 'use LMHOSTS' and check to 'enable NetBIOS over TCP/IP'

•HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters IsDomainMaster=FALSE on PC2 and TRUE on PC1

•identical workgroup name, different computer names
•something shared on both machines
•real passwords, no blank or empty passwords used
•all usernames and passwords duplicated on all machines
• The only anti-virus/firewall I have running is Zone alarm with anti virus. Both the network addresses are listed in the “trusted” area.

•I think Simple file sharing disabled on both machines, but not sure how to check this.

•I have downloaded and run the Windsock Fix program.

I could put up with this and just use the access from PC1 to share files, however I have a briefcase set up to synchronise my Outlook mail account and this will not work now.

Can anybody suggest anything else I can try please?
Thanks in advance....

 

[Ganzir]

http://www.michna.com/kb/wxnet.htm

THX This Link finally did the job......
--------------------------------------------------------------
You have both the following symptoms:

* You can ping the computer by IP and by name.
* When you type on another computer, replacing computername with the name of the inaccessible computer:

net view \\computername

you get one of the various "Error 5" error messages, like "System error 5 has occurred. Access is denied" or "Error 5: You do not currently have access to this file
------------------------------------------------------------

Exactly this is my problem, the only thing left to do now, is to find the evil program and eliminate it.

Greetz
Ganzir

 

[Ganzir]

Ok I used the regmon bootlog function to monitor regestry changes during the boot process.

The lsass.exe, spollvs.exe and svchost.exe are accessing the regestry key in question.

109831: lsass.exe:872 QueryValue HKLM\System\CurrentControlSet\Control\Lsa\RestrictAnonymous SUCCESS 0x1

112491: lsass.exe:872 QueryValue HKLM\System\CurrentControlSet\Control\Lsa\RestrictAnonymous SUCCESS 0x1

125995: svchost.exe:1140 QueryValue HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictAnonymous SUCCESS 0x1

140867: svchost.exe:1140 QueryValue HKLM\System\CurrentControlSet\Control\Lsa\RestrictAnonymous SUCCESS 0x1

238883: spoolvs.exe:3484 SetValue HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous SUCCESS 0x1

obviously the spoolsvs.exe is changing something, because regmon states it is setting a value (see above)

I searched for spoolvs.exe via google and found this here:

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.aladinz.l.html

 

[Ganzir]

The post above was correct for PC a. I terminated the spoolvs.exe and now PC a can be accessed as normal. I did the same procedure on PC b and the it was not the spoolvs.exe but the steam.exe who was/is changing this very value evertime I reboot the mashine. The problem I´m experiencing now is the following: Regmon states that steam.exe is responsible for the value change. Therefore I deduct that somewhere on PC b the steam.exe has to exist. The strange thing is, i cannnot find the steam.exe via windows search. Has anybody an idea, how to locate a file which is not found in windows search?

Greetz
Ganzir

 

[Ganzir]

Ok I finally managed to kill the steam.exe with help of hijackthis. Now the value on PC b doesn´t change anymore. So far so good. Tha bad news ist that I still get the same error massage. When I now type net view \\b

I get

System error 1364 has occurred.

A specified authtication package is unknown.

Has anyone an idea how to solve this?

Greetz
Ganzir

 

[linney]

Try rebuilding the Winsock entries or at least have a good look at them.

WinXP Connectivity Issues
Lost Connectivity after Registry or Malware Cleanup
FAQ779-4625


How to determine and recover from Winsock2 corruption

http://support.microsoft.com/?kbid=811259#kb1

How to reset Internet Protocol (TCP/IP) in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;299357&FR=1&PA=1&SD=HSCH

After you run Microsoft Windows AntiSpyware (Beta), you have network-related problems, or you receive an error message

http://support.microsoft.com/kb/892350

You receive an "An operation was attempted on something that is not a socket" error message when you try to connect to a network

http://support.microsoft.com/default.aspx?scid=kb;en-us;817571&Product=winxp