Solved

My sever is sending and receiving 2 million packets of data a day

Posted on 2006-10-25
8
273 Views
Last Modified: 2010-04-11
Hello,

I am running Server 2003 Enterprise on a Compaq box. I must have a virus or some malware, but everything I have tried to run on it shows there is nothing on it. It's sending and receiving 2 million packets of data a day. Does anyone have a suggestion or is familiar with this type of thing?

Thank You
0
Comment
Question by:ablogan
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
8 Comments
 
LVL 27

Expert Comment

by:David-Howard
ID: 17805387
If you have done your scans in Safe Mode with up to date utilities and definition files then I would check my Computer Browser. This is listed within Services (Administrative tools). If this is a stand alone pc (And I understand that you are running Server 2003) the pc may be attempting to broadcast constantly. You may want to disable this service and see what happens. I'm assuming that your Even logs aren't giving you any insight as to what the problem may be.
0
 
LVL 27

Expert Comment

by:David-Howard
ID: 17805395
"Event" logs....not "Even" logs.....sorry about that.
0
 

Author Comment

by:ablogan
ID: 17806029
Hi David

I have been trying different virus programs. I have used "Stinger" and am now trying a program called "Comodo". Niether of them are detecting anything and the log files are showing nothing out of the ordinary. All my updates and patches with MS are current as well. I also have an anti- spyware program called ad-aware, but I don't think this is particularly good for servers. I have tried enabling the Internet Explorer "enhanced security" feature but it has no effect. How can I completely disable IE? I looked in the services for it, but it doesn't appear to be there. This is a stand alone server, but it is networked to some others, but they are all ok. Any suggestions would be very welcome.

Thank You
Alan
0
Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

 
LVL 27

Accepted Solution

by:
David-Howard earned 250 total points
ID: 17806340
You cannot disable IE as it is part of the Windows operating system.
AdAware is a good program when used in conjunction with other programs such as Spybot:
http://www.safer-networking.org/en/download/index.html
You might try Ewido as well.
http://www.ewido.net/en/
Both are free.
0
 

Author Comment

by:ablogan
ID: 17806531
Ok sure I thought when you said  "I would check my Computer Browser. This is listed within Services (Administrative tools)." you where talking about IE. I am currently running Spybot on the server right now and hopefully it will find something. Thank you for the links. I'll let you know as soon as it stops scanning if it's found anything
0
 

Author Comment

by:ablogan
ID: 17807023
I found a worm on the machine. Thank you for your help
0
 
LVL 4

Expert Comment

by:expexchuser
ID: 17807164
How do you know you're sending & receiving that many packets?  Are you going by firewall logs or what?

Anytime I have concerns about network traffic like that, I use a protocol analyzer.  There are many out there.  Ethereal is pretty popular.
http://www.ethereal.com/download.html
0
 

Author Comment

by:ablogan
ID: 17807343
Hi Again,

I noticed just by looking at the nic card status box. It shows packets sent and packets recieved. I happened to look at it the other day because the server was running slow and saw it was in the millions. I knew something was wrong. I just updated the definitions on the server anti virus program Comodo now and it showed I had 3 email worms. I suppose I should also turn off smtp on the server as I'm not usuing it as an email server.

Thank you for the link for the PA and your help. I will try it out.

Kind Regards
Alan
0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Make the most of your online learning experience.
Part One of the two-part Q&A series with MalwareTech.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Suggested Courses
Course of the Month3 days, 17 hours left to enroll

630 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question