router problems after blaster

[rikkkidd]

Hi
I’m managing a small network consisting of one sever running windows 2000 server, and 8 workstation XP/2000/98. They connect to the Internet through a netgear router to an ntl ISDN line.

We had the msblaster virus a couple of weeks ago. I down loaded the blastfix from Symantec, and the Microsoft patch and removed the worm from the system and patched the vulnerable computers. According to the blastfix program the worm was only on the XP machines not 2000 server or workstation or the 98 machines. Since then the internet has slowed down considerably. And disappears completely when all the computers are trying to connect at the same time.

I’ve found that if I ping the router it will respond correctly for a few minutes then ill get a request timed out for 20 second or so then it will com back to life again for a few minutes the go again. At worst the router will time out for 5 minutes or so at which point I switch it off and restart it and then it comes back.

Does this sound like blaster is still in the system? I’ve run the blastfix program again but all the computers appear to be clean. Any advice is much appreciated.

 

[jgoodman00]

It sounds like it could be the Welchia worm which followed it. I believe both of these worms attempt connections to other hosts, which will hog bandwidth, & may give the symptoms you are experiencing.

Which AV program are you using? When did you last perform a virus sweep of the entire network?

James Goodman MCP

http://www.james-goodman.co.uk

 

[ChicagoTechNet]

We have received many similar cases. It seems the blaster already opened the door for other viruses. make sure you have all SPs, correct firewall settings and re-scan the virus (maybe more than one time).

For more tips or information, go to

http://www.ChicagoTech.net

Robert, MS-MVP/MCSE and CNE
Windows & Network Support, Tips and FAQs on

http://www.ChicagoTech.net

Robert Lin, MS-MVP, MCSE & CNE
Windows, Network and How to at

http://www.ChicagoTech.net

 

[g4j4hgil4]

sounds like u still have those nachi worms spreading all over your network
u can use this step to fix it..

1.block outgoing ping in your router to stop those worms traffic hogging down your router
2.use microsoft rpc scan tool to look for unpatched machines u have, then patched em all
3. use virus scanner to clen your network
4. done (u can remove that ping block if u want)

 

[rikkkidd]

thanks for the help but im still geting the same problem.

I downloaded the welchiafix from Symantec and the paches from microsoft and patched all the pc's and ran the fix program, it found the welchia virus on one of the xp machines and removed it but it said the others were clean. i also ran the blastfix.exe again on all the machinen and ones again the came back clean.
i also used windump on the server to listen to trafic but there was none on port 135/tcp, 4444/tcp, and 69/udp which Symantec said would indicate the worm.

i'v updated norton antivirus today and it curently scanning all the workstation but it hasn't found anything yet. the server has been fully scanned and norton says its clean so i have disconected all the workstation from the network and i still get the same problem with just the sever and router conected to the hub?

 

[jgoodman00]

Hmm, do you have a spare hub or switch you could try to eliminate or prove the problem is with the PC's? If possible, try connecting the server to a workstation either through a x-over cable or through a switch & see if the problem is replicated.

If the problem is not replicated, it suggests a fault with the router. I have seen the power supplies on some routers to be very fussy, & the slightest fluctuation causes them to crash. At least this way you will know your problem is with either the machines or the router.

James Goodman MCP

http://www.james-goodman.co.uk