Mutex.exe & Cybershots.exe running...

[EarAche]

Has anyone seen these 2 Programs running on your system?
There are very bad. They shut down McAfee and any 32bit applications. I was only able to clean them using a command line scan and a SuperDAT from McAfee. Also, the DAT was not able to clean them until I submitted the EXEs to McAfee. The fix was only released on the 18th.

Once cleaned, the post-infected machines can now not map any drives or connect via network neiborhood. The tcp/ip access and IE still work fine.

Any one have any ideas how to fix the networking issue?

These are on Win-2000 boxes only.

Thanks.

 

[tlcscousin]

Have you looked to make sure Client for Microsoft Networks is still enabled on the machine?

 

[EarAche]

OK, ... How do I check that?

 

[tlcscousin]

Open dial up and network connections then right click the local area connection and select properties.

Ensure Client for Microsoft Networks is checked.

 

[Diancecht]

And also ensure you don't have any firewall active on the machines.

Cheers,
Dian

 

[EarAche]

Yes Client for MS is checked on.
No firewall (software) running.

Anyone else have any ideas?

 

[tlcscousin]

Do you get an error message when you try connecting?
Can you ping the other computers either by IP or name?

 

[EarAche]

Yes, I can ping anything on the network.
I can also resolve to any machine. Meaning, I can ping a machine name instead of the IP and it will resolve via DNS.
Yes, I do get an error when I try to connect to a drive or map a drive:

"The Network Connection cannot be reached, for more info about network troubleshooting, see Windows Help."

 

[tlcscousin]

http://support.microsoft.com/default.aspx?scid=kb;en-us;269019

The above was found when searching the error you are getting.

 

[EarAche]

Thank you tlccousin for the response. However, that was not the case. The above tech-doc refers to: "Network and Dial-up Connections" folder icons missing

My Icons are there and fully functional.

Anyone else have any ideas?

Thanks.

 

[allteltec]

One of the old tricks we use to do in the Win98 days was add a Protocol like NetBEUI then remove it after we go think working. The adding Protocol would fix a lot of network problems. Runing SFC /scannow could also help if the virus has damaged system files.

 

[tlcscousin]

I realise the icons are there and fully functional but are the keys showing the correct values? (If you change the values i would export the key first)

This is the key values I have on a w2k Pro machine not on a domain

HKEY_CLASSES_ROOT\Interface\{0000010-0000-0000-C000-000000000046}]
IRunningObjectTable

[HKEY_CLASSES_ROOT\Interface\{0000010c-0000-0000-C000-000000000046}\NumMethods]
10

[HKEY_CLASSES_ROOT\Interface\{0000010-0000-0000-C000-000000000046}\ProxyStubClsid32]
{00000320-0000-0000-C000-000000000046}

File and Print sharing is enabled as well (checked in network properties)?