Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

at my small office we've stumbled upon a strange problem which have started during today.

It all started with our network seeming sluggish and unresponsive - user's complained about slow connection to network shares, email and such.

A quick look at our Windows 2003 domain controller showed that the network utilization seemed to be up around the 100% constantly. I'm no network guru by any means but I pulled our Wireshark and found out what client was the culprit. I physically located the client and confirmed that it too was maxing out its network utilization.

I started up the Process Explorer from Microsoft/SysInternals and I believe to have found the culprit in a range of rundll32.exe processes which was active on the machine.

All the processes was owned by the domain user and if suspending a specific one of them I saw that the network utilization dropped to ~0% - though only for a few seconds. The really funky stuff begins when I pulled the machine off the network - within a few minutes a new computer would start doing the same spamming of the domain controller. Running process explorer on this client seemed to show the same thing - a range of rundll32.exe processes doing God knows what. This seemed to escalate - when disconnecting this second client from the network, 2 new clients started; both with 50% network utilization and again spamming the server.

All clients - and the server - have McAffee antivirus and all are up-to-date. A scan gives no results.

I can't seem to find any true reasons as to why this is happening and it's really giving me grey hair. Thiese kind of problems isn't really my cup of tea but right now, I'm the one dealing with it.

I'm hoping that some of you guys and girls out there can provide me some hints which can aid me in uncovering what is going on here.

Thank you in advance
Christian

share|improve this question
    
Sounds like malware to me. I would run malwarebytes and a-squared on each machine. –  joeqwerty Mar 22 '11 at 16:46
    
What traffic are the workstations sending to the domain controller? –  krugger Mar 22 '11 at 16:48

1 Answer 1

up vote 2 down vote accepted

I would recommend running a virus scan at least in safe mode, if not from another computer on that hard drive to actually rule out a virus.

Also as krugger stated above, what type of traffic? Wireshark will allow you to see the content of the packets which should prove useful.

(Sorry that this is an answer and not a comment, I don't have enough points to comment yet on this sub-site.)

share|improve this answer
    
Not just viruses - you should check for rootkits too given your description. –  mfinni Mar 22 '11 at 17:01
    
Very true, I tend to (ab)use the term "virus" in a very general sense. –  farr Mar 22 '11 at 17:03
    
We ended up doing an extensive Wireshark dump and sending it off to an external company for analysis. After a while with mailing back and forth with these network-savy dudes we ended up locating the culprit. So far it seems the problem exists due to a defect in some specific SAP applications which after being closed starts going nuts. No idea to what have caused these applications acting this way but a re-installation have solved the issue. Thank you for your feedback. –  Christian A. Apr 18 '11 at 8:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.