Losing Net Share Constantly

[suedaisy]

Hi,

Every 5 minutes or so we lose net share on only one of our Win2k servers.
I have scanned it for viruses numerous times. and it comes up with something on the M:\ drive (its our Exchange) and it quarantines it.
I even have a different scanner to check for trojans specifically and that's not finding anything either.
I don't know what else to do. And the big problem is that computer is used to authenticate all my users (not sure how THAT happened).
So my questions are.. 1) How can I get my net shares back and to stay? or 2) Can I make that computer stop being the primary authenticate for the end users?
All of my users are on Win98.. and the servers are Win2k Advanced Server.
Thanks for your help!!

 

[xmsre]

On an exchange server, you do run a real time scanner. You exclude the exchang database and log directories as well as the M: drive from the scans. Your Exchange aware AV will take care of scanning Exchange.

 

[suedaisy]

I just double checked Symantec.. and the real time scanner is checking under the C: drive, and it was scanning the log directory of the D: drive. So I turned that exclusion on.

Think that's going to fix my ipc share?

 

[xmsre]

No, but it'll keep you from crashing your stores.

 

[suedaisy]

But my stores never crashed. And I don't remember saying they ever did.

 

[suedaisy]

I guess I'll try tango's suggestion of demoting it as a DC. Because the only problem I have is authenticating.. email is working just fine.. always has been.

Next time I'll be sure not to break my back working on an issue I never had.

 

[napoleao]

I have been struggling with the same problema for more than a week and know its all solved. Even doing what other users recommended did not solve. So your problem could be the same.
Go to Winnt/system32 and look for a file called sec32.exe
If exists, deleted.
go to Start->Run->regedit
Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
See if you have something called SecureNet
IF it exists, delete that entry.
Hope that helps

 

[vbrocks]

http://support.microsoft.com/defaul...port/kb/articles/Q245/1/17.asp&NoWebContent=1

 

[mlichstein]

I would not recommend trying to demote the server, since you will probably end up with more problems. Demoting an exchange server should only be attempted as a last resort, and really should be done under the guidance of PSS.

See

http://support.microsoft.com/default.aspx?kbid=822179&product=exch2003

Demoting the server, even if it doesn't break Exchange will most likely not fix the IPC$ problem. They are just not related in any way.

This still sounds like virus to me. Try scanning with a different scanner:

http://housecall.trendmicro.com

Your AV scanner did find something and says it quarantined it. That's not a good sign.

Or there could be an issue with TCP/IP, but I doubt it.

 

[mlichstein]

The virus link should be

http://housecall.trendmicro.com

 

[suedaisy]

napoleao.. i think ill try that on tuesday, hopefully that may fix the issue, because this is still an ongoing problem with the network.

vbrocks.. this was one of the first things ive tried to do.. and this didnt solve my issue either. thanks though.

mlichstein.. i never demoted the server, i got too paranoid to do it, so i never did it. i did however scan the computer with mcafee, and although it did find viruses norton didnt find.. it didnt help the ipc$ problem at all.

so ill try napoleao's advice tuesday and post results here. im pretty sure theres nothing in my Run in regedit.. i cleaned that out weeks ago.
ill see about the file though.

 

[vbrocks]

Have you uninstalled and reinstalled the File and Print Sharing network service?

 

[suedaisy]

sec32.dll is not on that computer at all.. and the currentversion/run is clean of anything suspicious.

i havent un/reinstalled file and print sharing.. i think ill try that next.