One box keeps vanishing from Workgroup...?

[Kenneth]

Howdy,

We have 6 systems on our office lan...

Two are Win 2000 Pro, and four are XP.

One of the XP machines frequently (make that very
frequently) disappears from the Workgroup when viewed from
other systems.

At that point, rebooting the vanishing machine cures things,
but only for a while. It might be fine for a few hours, but
then pffft, and it's gone again.

What might be causing this, and how can I correct it?

Very sincere thanks,

 

[Robert L [MVP - Networking]]

Sounds like master browser issue. Any errors in the Event Viewer? Or check this search result.

Computer Browser
The master browser has received a server announcement from the computer <computer ... You have a master browser issue if you have the following symptoms. ...
www.chicagotech.net/browser.htm

Troubleshooting browser issues
The master browser has received a server announcement from the computer <computer name> that believes that it is the master browser ...
www.chicagotech.net/troubleshootingbrowser.htm


Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com

Howdy,

We have 6 systems on our office lan...

Two are Win 2000 Pro, and four are XP.

One of the XP machines frequently (make that very
frequently) disappears from the Workgroup when viewed from
other systems.

At that point, rebooting the vanishing machine cures things,
but only for a while. It might be fine for a few hours, but
then pffft, and it's gone again.

What might be causing this, and how can I correct it?

Very sincere thanks,

 

[Kenneth]

Sounds like master browser issue. Any errors in the Event Viewer? Or check this search result.

Computer Browser
The master browser has received a server announcement from the computer <computer ... You have a master browser issue if you have the following symptoms. ...
www.chicagotech.net/browser.htm

Troubleshooting browser issues
The master browser has received a server announcement from the computer <computer name> that believes that it is the master browser ...
www.chicagotech.net/troubleshootingbrowser.htm


Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com

Hi Bob,

I read many of the articles on those pages, and have
experimented a bit, but have a question:

Would I be correct that I should disable the Master Browser
service on all but one box on our lan?

Sincere thanks,

 

[Robert L [MVP - Networking]]

If you disable master browser services on all computers but one, you may have computer browsing issue. What you should do is using browstat to troubleshoot it and you may want to modify the registry accordingly. The link should have some details..

Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com

Sounds like master browser issue. Any errors in the Event Viewer? Or check this search result.

Computer Browser
The master browser has received a server announcement from the computer <computer ... You have a master browser issue if you have the following symptoms. ...
www.chicagotech.net/browser.htm

Troubleshooting browser issues
The master browser has received a server announcement from the computer <computer name> that believes that it is the master browser ...
www.chicagotech.net/troubleshootingbrowser.htm


Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com

Hi Bob,

I read many of the articles on those pages, and have
experimented a bit, but have a question:

Would I be correct that I should disable the Master Browser
service on all but one box on our lan?

Sincere thanks,

 

[Kenneth]

Sincere thanks for all the help,

 

[Kenneth]

This is a multi-part message in MIME format.

------=_NextPart_000_0096_01C7F596.286B7920
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

If you disable master browser services on all computers but one, you may =
have computer browsing issue. What you should do is using browstat to =
troubleshoot it and you may want to modify the registry accordingly. The =
link should have some details..

Hi Bob,

Might it be appropriate to use Hosts files for our lan? That
is, might that correct the problem?

Thanks again,

 

[Chuck [MVP]]

Hi Bob,

Might it be appropriate to use Hosts files for our lan? That
is, might that correct the problem?

Thanks again,

Kenneth,

Use of LMHosts would be more appropriate in your case. Hosts is for DNS based
name resolution, LMHosts for NetBT based name resolution.
<http://nitecruzr.blogspot.com/2005/07/local-name-and-address-resolution-on.html>
http://nitecruzr.blogspot.com/2005/07/local-name-and-address-resolution-on.html

Neither will do anything for your problem. You have a master browser conflict,
caused by multiple computers running the browser service, with those computers
being casually treated.
<http://nitecruzr.blogspot.com/2005/04/nt-browser-or-why-cant-i-always-see.html>
http://nitecruzr.blogspot.com/2005/04/nt-browser-or-why-cant-i-always-see.html

--
Cheers,
Chuck, MS-MVP 2005-2007 [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My email is AT DOT
actual address pchuck mvps org.

 

[Kenneth]

Kenneth,

Use of LMHosts would be more appropriate in your case. Hosts is for DNS based
name resolution, LMHosts for NetBT based name resolution.
<http://nitecruzr.blogspot.com/2005/07/local-name-and-address-resolution-on.html>
http://nitecruzr.blogspot.com/2005/07/local-name-and-address-resolution-on.html

Neither will do anything for your problem. You have a master browser conflict,
caused by multiple computers running the browser service, with those computers
being casually treated.
<http://nitecruzr.blogspot.com/2005/04/nt-browser-or-why-cant-i-always-see.html>
http://nitecruzr.blogspot.com/2005/04/nt-browser-or-why-cant-i-always-see.html

Hi Chuck,

As per the very helpful links you provided, I shut down the
Computer Browser service of all but one system (which
happens to be the box that other systems often fail to see.)

Hours later, the problem returned... That is, if, on another
system (6 boxes 3 are XP, and 3 are 2000 Pro) I click on
View Workgroup Computers the box with the running Computer
Browser service does not appear.

I have learned that if I re-boot that vanishing system, it
does show up for a while, then it vanishes again.

I should also mention that if it does not appear, and I
Search for it by name, I get a successful hit immediately.

Of course, I would appreciate any further thoughts you might
have on this nuisance (the problem... not me...<g>)

All the best,

 

[Kenneth]

On Fri, 14 Sep 2007 20:38:13 -0400, Kenneth

Hi again Chuck,

Though I have no idea if this might be relevant...

On the vanishing machine I just clicked View Workgroup
Computers (because I wanted to see if the system "saw
itself."

The hourglass appeared, and after a few moments the error:

"Office is not accessible. You might not have permission to
use this network resource. Contact administrator etc.

The list of servers for this workgroup is not currently
available."

(And yes, the Computer Browser service is running. I just
checked...)

Might that be of use?

Thanks again,

 

[Chuck [MVP]]

On Fri, 14 Sep 2007 20:38:13 -0400, Kenneth

Hi again Chuck,

Though I have no idea if this might be relevant...

On the vanishing machine I just clicked View Workgroup
Computers (because I wanted to see if the system "saw
itself."

The hourglass appeared, and after a few moments the error:

"Office is not accessible. You might not have permission to
use this network resource. Contact administrator etc.

The list of servers for this workgroup is not currently
available."

(And yes, the Computer Browser service is running. I just
checked...)

Might that be of use?

Thanks again,

Kenneth,

Let's look at logs from "browstat status", "ipconfig /all", "net config server",
and "net config workstation", from the problem computer. Read this article, and
linked articles, and follow instructions precisely (download browstat!):
<http://nitecruzr.blogspot.com/2005/05/troubleshooting-network-neighborhood.html#AskingForHelp>
http://nitecruzr.blogspot.com/2005/05/troubleshooting-network-neighborhood.html#AskingForHelp

And at the same time, look at "browstat status" logs from the other computers.
We also might see a clue from comparing "browstat status" for the problem
computer, when the problem is observed and when it isn't.

--
Cheers,
Chuck, MS-MVP 2005-2007 [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My email is AT DOT
actual address pchuck mvps org.

 

[Kenneth]

On Fri, 14 Sep 2007 20:47:52 -0400, Kenneth


Hi (yet) again Chuck,

As I continue to experiment, I become more perplexed...

I just "moved" the active Computer Browser service from the
machine that had been vanishing, to another on our lan.

(Specifically on the "disappearing" system I turned the
Computer Browser Service, set it to Disabled, and then
turned it on on another system.

Now, on the machine with the Disabled Computer Service, if I
click on Network, all shared populate immediately. But, if I
click on View Workgroup Computers, it takes fully 50 seconds
to display anything, and when it does, 5 of our 6 systems
display.

The missing one...? Well, that's the one that (now) has the
Computer Browser Service running.

Then, if I go to that machine, and click on Network, it
populates immediately, but if I click on View Workgroup
Computers, for 35 seconds, nothing (visible) happens, and
then I see the error that the workgroup is not accessible.

I thank you once again, and look forward to any help you
might provide.

All the best,

 

[Kenneth]

Kenneth,

Let's look at logs from "browstat status", "ipconfig /all", "net config server",
and "net config workstation", from the problem computer. Read this article, and
linked articles, and follow instructions precisely (download browstat!):
<http://nitecruzr.blogspot.com/2005/05/troubleshooting-network-neighborhood.html#AskingForHelp>
http://nitecruzr.blogspot.com/2005/05/troubleshooting-network-neighborhood.html#AskingForHelp

And at the same time, look at "browstat status" logs from the other computers.
We also might see a clue from comparing "browstat status" for the problem
computer, when the problem is observed and when it isn't.

Hi Chuck,

Here we go...

So that we can communicate about all this in a reasonable
way, let's do this:

We have 6 systems on our office lan. Some of these are
Win2000 Pro, and some XP SP2. They are Peer-to-peer, that
is, we do NOT have a Windows Server. All but one have
Computer Browser Service set to OFF-DISABLED. One has that
service set to ON-AUTOMATIC.

For the sake of our discussion, let's call that system
BROWSERBOX. Any other system will be called REMOTE1,
REMOTE2, etc.

Here is the IPCONFIG result run on BROWSERBOX: (XP SP2)




Windows IP Configuration



Host Name . . . . . . . . . . . . : K06

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Hybrid

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No



Ethernet adapter Local Area Connection:



Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Broadcom
NetXtreme 57xx Gigabit Controller

Physical Address. . . . . . . . . :
00-18-8B-01-03-7F

Dhcp Enabled. . . . . . . . . . . : No

IP Address. . . . . . . . . . . . : 192.168.1.107

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.1.1

DNS Servers . . . . . . . . . . . : 192.168.1.1



Ethernet adapter Hamachi:



Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Hamachi Network
Interface

Physical Address. . . . . . . . . :
7A-79-05-77-7D-66

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 5.119.125.102

Subnet Mask . . . . . . . . . . . : 255.0.0.0

Default Gateway . . . . . . . . . :

DHCP Server . . . . . . . . . . . : 5.0.0.1

Lease Obtained. . . . . . . . . . : Saturday,
September 15, 2007 2:33:31 PM

Lease Expires . . . . . . . . . . : Saturday,
September 15, 2007 2:37:46 PM



Next, this is from BROWSERBOX:

Server Name \\K06
Server Comment

Software version Windows 2002
Server is active on
NetbiosSmb (000000000000)
NetBT_Tcpip_{470370FF-66C9-442F-BD65-2AA1004FFD21}
(00188b01037f)
NetBT_Tcpip_{9B15E68E-A7F9-42C9-B037-F120964CDB1E}
(7a7905777d66)


Server hidden No
Maximum Logged On Users 10
Maximum open files per session 16384

Idle session time (min) 15
The command completed successfully.

Computer name \\K06
Full Computer name K06
User name Kenneth

Workstation active on
NetbiosSmb (000000000000)
NetBT_Tcpip_{9B15E68E-A7F9-42C9-B037-F120964CDB1E}
(7A7905777D66)
NetBT_Tcpip_{470370FF-66C9-442F-BD65-2AA1004FFD21}
(00188B01037F)

Software version Windows 2002

Workstation domain OFFICE
Workstation Domain DNS Name (null)
Logon domain K06

COM Open Timeout (sec) 0
COM Send Count (byte) 16
COM Send Timeout (msec) 250
The command completed successfully.


and this from REMOTE1:

Server Name \\NOTE05
Server Comment

Software version Windows 2002
Server is active on
NetbiosSmb (000000000000)
NetBT_Tcpip_{DD99A45D-B267-4B3D-8AD6-039FCE4E885B}
(001422d2da35)


Server hidden No
Maximum Logged On Users 10
Maximum open files per session 16384

Idle session time (min) 15
The command completed successfully.

Computer name \\NOTE05
Full Computer name note05
User name Kenneth

Workstation active on
NetbiosSmb (000000000000)
NetBT_Tcpip_{DD99A45D-B267-4B3D-8AD6-039FCE4E885B}
(001422D2DA35)

Software version Windows 2002

Workstation domain OFFICE
Workstation Domain DNS Name (null)
Logon domain NOTE05

COM Open Timeout (sec) 0
COM Send Count (byte) 16
COM Send Timeout (msec) 250
The command completed successfully.



This is from BROWSERBOX:



Status for domain OFFICE on transport
\Device\NetBT_Tcpip_{470370FF-66C9-442F-BD65-2AA1004FFD21}
Browsing is NOT active on domain.
Master browser name is held by: K06
Master browser is running build 2600


Status for domain OFFICE on transport
\Device\NetBT_Tcpip_{9B15E68E-A7F9-42C9-B037-F120964CDB1E}
Browsing is NOT active on domain.
Master browser name is held by: K06
Master browser is running build 2600


and this from REMOTE1:



Status for domain OFFICE on transport
\Device\NetBT_Tcpip_{DD99A45D-B267-4B3D-8AD6-039FCE4E885B}
Browsing is active on domain.
Master browser name is: K06
Master browser is running build 2600
1 backup servers retrieved from master K06
\\K06
There are 6 servers in domain OFFICE on transport
\Device\NetBT_Tcpip_{DD99A45D-B267-4B3D-8AD6-039FCE4E885B}
There are 0 domains in domain OFFICE on transport
\Device\NetBT_Tcpip_{DD99A45D-B267-4B3D-8AD6-039FCE4E885B}



Well, if I have properly interpreted your site, those logs
should be what you asked for.

Of course, if I have neglected to send something (or if I
generated any of these improperly) please just let me know.

As before, please accept my sincere thanks,

 

[Chuck [MVP]]

Hi Chuck,

Here we go...

So that we can communicate about all this in a reasonable
way, let's do this:

We have 6 systems on our office lan. Some of these are
Win2000 Pro, and some XP SP2. They are Peer-to-peer, that
is, we do NOT have a Windows Server. All but one have
Computer Browser Service set to OFF-DISABLED. One has that
service set to ON-AUTOMATIC.

For the sake of our discussion, let's call that system
BROWSERBOX. Any other system will be called REMOTE1,
REMOTE2, etc.

Well, if I have properly interpreted your site, those logs
should be what you asked for.

Of course, if I have neglected to send something (or if I
generated any of these improperly) please just let me know.

As before, please accept my sincere thanks,

That's a good start, Kenneth. We may need more, but start here.

Ethernet adapter Hamachi:

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Hamachi Network Interface

Physical Address. . . . . . . . . : 7A-79-05-77-7D-66
and

Server Name \\K06
Server Comment

Software version Windows 2002
Server is active on
NetbiosSmb (000000000000)
NetBT_Tcpip_{470370FF-66C9-442F-BD65-2AA1004FFD21} (00188b01037f)
NetBT_Tcpip_{9B15E68E-A7F9-42C9-B037-F120964CDB1E} (7a7905777d66)

That's a problem. Send NetBT down the Hamachi binding, who knows if it ever is
seen. I can't say for sure if that's your only problem, but it's a good place
to start.

--
Cheers,
Chuck, MS-MVP 2005-2007 [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My email is AT DOT
actual address pchuck mvps org.

 

[Kenneth]

That's a good start, Kenneth. We may need more, but start here.






That's a problem. Send NetBT down the Hamachi binding, who knows if it ever is
seen. I can't say for sure if that's your only problem, but it's a good place
to start.

Hey Chuck,

Though I do not completely understand your comment just
above...

(I reinterpreted it as "Get rid of Hamachi, and let's see if
that solves the problem).

So I disabled Hamachi on the two boxes that had it. One was
BROWSERBOX, and the other REMOTE2.
^

(Please note that the second box with Hamachi was NOT the
system from which I had originally be doing the checking on
status. That was REMOTE1.)

Then, I rebooted both.

Next, on BROWSERBOX, and REMOTE1, I clicked on Network, and
then on View Workgroup Computers.

The behavior is UNchanged from prior to killing Hamachi.

Thanks for anything further you might be able to spot.

All the best,

 

[Kenneth]

On Sun, 16 Sep 2007 08:01:44 -0400, Kenneth


Hi again,

I should clarify:

On boxes that ran Hamachi, I went to Network | Properties,
clicked on Hamachi, and chose "Disable."

I did not in any other way, remove it from either system.

Thanks,

 

[Chuck [MVP]]

On Sun, 16 Sep 2007 08:01:44 -0400, Kenneth


Hi again,

I should clarify:

On boxes that ran Hamachi, I went to Network | Properties,
clicked on Hamachi, and chose "Disable."

I did not in any other way, remove it from either system.

Thanks,

OK, after you "Disabled" Hamachi, did you look at an updated "browstat status"
log? How long did you wait before testing again? Please read about the
Browser, and the challenges it presents:
<http://nitecruzr.blogspot.com/2005/04/nt-browser-or-why-cant-i-always-see.html>
http://nitecruzr.blogspot.com/2005/04/nt-browser-or-why-cant-i-always-see.html

--
Cheers,
Chuck, MS-MVP 2005-2007 [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My email is AT DOT
actual address pchuck mvps org.

 

[Kenneth]

OK, after you "Disabled" Hamachi, did you look at an updated "browstat status"
log? How long did you wait before testing again? Please read about the
Browser, and the challenges it presents:
<http://nitecruzr.blogspot.com/2005/04/nt-browser-or-why-cant-i-always-see.html>
http://nitecruzr.blogspot.com/2005/04/nt-browser-or-why-cant-i-always-see.html

Hi Chuck,

It has been about three hours since killing the two
instances of Hamachi... (and after disabling each, I
re-booted the boxes that had 'em...)

I am currently running the Computer Browser service ONLY on
BROWSERBOX.

The behavior is as it has been, that is:

On BROWSERBOX, if I click Network, it populates in a few
seconds. Then, if I click View Workgroup Computers, after
about a minute, I get the error that the Workgroup is not
accessible.

On REMOTE1, it takes about the same amount of time to
populate the Network list as does BROWSERBOX, but when I
click on View Workgroup Computers, it populates very
quickly, but absent BROWSERBOX.

On REMOTE2, (a 2000 pro system), Computers Near Me populates
immediately, but absent BROWSERBOX.

All that said, here are the current browstat logs for
BROWSERBOX, and REMOTE1:

BROWSERBOX:

Status for domain OFFICE on transport
\Device\NetBT_Tcpip_{470370FF-66C9-442F-BD65-2AA1004FFD21}
Browsing is NOT active on domain.
Master browser name is held by: K06
Master browser is running build 2600


REMOTE1:

Status for domain OFFICE on transport
\Device\NetBT_Tcpip_{DD99A45D-B267-4B3D-8AD6-039FCE4E885B}
Browsing is active on domain.
Master browser name is: K06
Master browser is running build 2600
1 backup servers retrieved from master K06
\\K06
There are 5 servers in domain OFFICE on transport
\Device\NetBT_Tcpip_{DD99A45D-B267-4B3D-8AD6-039FCE4E885B}
There are 0 domains in domain OFFICE on transport
\Device\NetBT_Tcpip_{DD99A45D-B267-4B3D-8AD6-039FCE4E885B}


Thanks for any further thoughts,

 

[Kenneth]

On Fri, 14 Sep 2007 20:47:52 -0400, Kenneth


Hi (yet) again Chuck,

As I continue to experiment, I become more perplexed...

I just "moved" the active Computer Browser service from the
machine that had been vanishing, to another on our lan.

(Specifically on the "disappearing" system I turned the
Computer Browser Service, set it to Disabled, and then
turned it on on another system.

Now, on the machine with the Disabled Computer Service, if I
click on Network, all shared populate immediately. But, if I
click on View Workgroup Computers, it takes fully 50 seconds
to display anything, and when it does, 5 of our 6 systems
display.

The missing one...? Well, that's the one that (now) has the
Computer Browser Service running.

Then, if I go to that machine, and click on Network, it
populates immediately, but if I click on View Workgroup
Computers, for 35 seconds, nothing (visible) happens, and
then I see the error that the workgroup is not accessible.

I thank you once again, and look forward to any help you
might provide.

All the best,

Hi Chuck,

Well sir, there is the possibility that this is a spyware
problem...

I just ran Spybot (as I do frequently) on BROWSERBOX, and it
found ZLOB DNS Changer. It removed it, but then, on a re-run
of Spybot, ZLOB was back.

I'll try to learn how to remove it, or just might go back to
an earlier image of the system.

More soon... Thanks again,

 

[Chuck [MVP]]

Hi Chuck,

Well sir, there is the possibility that this is a spyware
problem...

I just ran Spybot (as I do frequently) on BROWSERBOX, and it
found ZLOB DNS Changer. It removed it, but then, on a re-run
of Spybot, ZLOB was back.

I'll try to learn how to remove it, or just might go back to
an earlier image of the system.

More soon... Thanks again,

Kenneth,

Please don't do this on your own. Zlob is nasty. Get professional (free) help.
<http://nitecruzr.blogspot.com/2005/05/dealing-with-malware-adware-spyware.html>
http://nitecruzr.blogspot.com/2005/05/dealing-with-malware-adware-spyware.html

--
Cheers,
Chuck, MS-MVP 2005-2007 [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My email is AT DOT
actual address pchuck mvps org.

 

[Kenneth]

Kenneth,

Please don't do this on your own. Zlob is nasty. Get professional (free) help.
<http://nitecruzr.blogspot.com/2005/05/dealing-with-malware-adware-spyware.html>
http://nitecruzr.blogspot.com/2005/05/dealing-with-malware-adware-spyware.html

Hi Chuck,

I believe that I am doing what your site suggests...

I run Kaspersky, Spybot, SpywareBlaster, and AdAware.

I searched fora and found tools that were to remove Zlob,
but after it returned, found guidance for appropriate manual
removal.

Are you suggesting that I do something other than that?

Also, is there any possibility, in your opinion, that this
trojan could be causing the problems I have described to
you? I thought it a possibility because of the name DNS
Changer.

Sincere thanks,