Server Internet Access Problem

michaelb · 03-17-2009, 04:04 PM

Hi,

I'm having a problem with our main server. It's an HP ML350 G5 running Windows SBS 2003, acting as the domain controller, file server, print server and exchange server.

The problem began about 2 weeks ago, all of a sudden, without any config changes anywhere, the server can no longer browse the internet. It can also not update the anti-virus from the internet.

The server can however ping sites like google.com.au and receive a response.

The server has 2 network cards which are teamed. One is connected to a switch and the other to our Sonicwall device. 2 other servers are connected in this exact same way and work fine.

If I bypass the sonicwall and connect the server straight to the modem, there is no problem, internet works fine. This may suggest that the problem is the Sonicwall, but this seems unlikely due to the fact that it is just this server that is having a problem. I have also changed the port it is connected to on the Sonicwall, still no good.

We had a technician from an external support company come and take a look and now since he played with it, unplugging bits and re-running configurations, the Outlook Web Access and Remote Web Workplace are not accessible externally. They return a 404 File not found error. These were working fine for the last 2 weeks until the technician came, though they of course deny changing anything that would affect this. They can be accessed fine internally, using the server's internal IP address.

Anyone have any ideas on what might be causing this?

Cheers,
Michael

iqbalsyed · 03-18-2009, 10:45 AM

1. Download the GMER rootkit detection tool to find and “delete” the "hidden" malware service. (it will probably delete the malicious DLL) - <http://www.gmer.net/gmer.zip> [SEE INSTRUCTIONS BELOW FOR RUNNING THIS TOOL AND REMOVING THE MALWARE]
a) Alternately, you could choose to “Disable” the hidden service.
b) After choosing either “delete” or “disable”, a reboot is required to actually cause the desired action.
c) After the reboot, run GMER to confirm the malware has been removed or disabled.
INSTRUCTIONS FOR RUNNING GMER:
1. Run the tool on one affected machine.
2. If a rootkit is found, the entry will appear in the color “Red”.
3. If you see one, right-click over it, and choose “Disable” which will require you to then manually move or delete the malicious dll. Otherwise, choose “Delete” to automatically have the malicious dll removed after the next reboot.
4. Then reboot.

syediqbalahammad@yahoo.com

03-17-2009, 04:04 PM	#1 (permalink)
michaelb Registered User Join Date: Mar 2009 Posts: 1 OS: Windown XP SP3	Server Internet Access Problem Hi, I'm having a problem with our main server. It's an HP ML350 G5 running Windows SBS 2003, acting as the domain controller, file server, print server and exchange server. The problem began about 2 weeks ago, all of a sudden, without any config changes anywhere, the server can no longer browse the internet. It can also not update the anti-virus from the internet. The server can however ping sites like google.com.au and receive a response. The server has 2 network cards which are teamed. One is connected to a switch and the other to our Sonicwall device. 2 other servers are connected in this exact same way and work fine. If I bypass the sonicwall and connect the server straight to the modem, there is no problem, internet works fine. This may suggest that the problem is the Sonicwall, but this seems unlikely due to the fact that it is just this server that is having a problem. I have also changed the port it is connected to on the Sonicwall, still no good. We had a technician from an external support company come and take a look and now since he played with it, unplugging bits and re-running configurations, the Outlook Web Access and Remote Web Workplace are not accessible externally. They return a 404 File not found error. These were working fine for the last 2 weeks until the technician came, though they of course deny changing anything that would affect this. They can be accessed fine internally, using the server's internal IP address. Anyone have any ideas on what might be causing this? Cheers, Michael

03-18-2009, 10:45 AM	#2 (permalink)
iqbalsyed Registered User Join Date: Mar 2009 Posts: 2 OS: vixta	Re: Server Internet Access Problem 1. Download the GMER rootkit detection tool to find and “delete” the "hidden" malware service. (it will probably delete the malicious DLL) - <http://www.gmer.net/gmer.zip> [SEE INSTRUCTIONS BELOW FOR RUNNING THIS TOOL AND REMOVING THE MALWARE] a) Alternately, you could choose to “Disable” the hidden service. b) After choosing either “delete” or “disable”, a reboot is required to actually cause the desired action. c) After the reboot, run GMER to confirm the malware has been removed or disabled. INSTRUCTIONS FOR RUNNING GMER: 1. Run the tool on one affected machine. 2. If a rootkit is found, the entry will appear in the color “Red”. 3. If you see one, right-click over it, and choose “Disable” which will require you to then manually move or delete the malicious dll. Otherwise, choose “Delete” to automatically have the malicious dll removed after the next reboot. 4. Then reboot. syediqbalahammad@yahoo.com Last edited by iqbalsyed; 03-18-2009 at 10:46 AM.