at my small office we've stumbled upon a strange problem which have started during today.
It all started with our network seeming sluggish and unresponsive - user's complained about slow connection to network shares, email and such.
A quick look at our Windows 2003 domain controller showed that the network utilization seemed to be up around the 100% constantly. I'm no network guru by any means but I pulled our Wireshark and found out what client was the culprit. I physically located the client and confirmed that it too was maxing out its network utilization.
I started up the Process Explorer from Microsoft/SysInternals and I believe to have found the culprit in a range of rundll32.exe processes which was active on the machine.
All the processes was owned by the domain user and if suspending a specific one of them I saw that the network utilization dropped to ~0% - though only for a few seconds. The really funky stuff begins when I pulled the machine off the network - within a few minutes a new computer would start doing the same spamming of the domain controller. Running process explorer on this client seemed to show the same thing - a range of rundll32.exe processes doing God knows what. This seemed to escalate - when disconnecting this second client from the network, 2 new clients started; both with 50% network utilization and again spamming the server.
All clients - and the server - have McAffee antivirus and all are up-to-date. A scan gives no results.
I can't seem to find any true reasons as to why this is happening and it's really giving me grey hair. Thiese kind of problems isn't really my cup of tea but right now, I'm the one dealing with it.
I'm hoping that some of you guys and girls out there can provide me some hints which can aid me in uncovering what is going on here.
Thank you in advance