One box keeps vanishing from Workgroup...?

[Kenneth]

Kenneth,

Please don't do this on your own. Zlob is nasty. Get professional (free) help.
<http://nitecruzr.blogspot.com/2005/05/dealing-with-malware-adware-spyware.html>
http://nitecruzr.blogspot.com/2005/05/dealing-with-malware-adware-spyware.html

Hi Chuck,

I have good news, and bad news...

With your help (and the help of some others) I have managed
to remove ZLOB.DNSCHANGER (at least Spybot, which had found
it, no longer does.)

But:

The Computer Browser problem I have had, remains as before.

The behavior is as it has been, as I wrote before the zlob
digression:

On BROWSERBOX, if I click Network, it populates in a few
seconds. Then, if I click View Workgroup Computers, after
about a minute, I get the error that the Workgroup is not
accessible.

On REMOTE1, it takes about the same amount of time to
populate the Network list as does BROWSERBOX, but when I
click on View Workgroup Computers, it populates very
quickly, but absent BROWSERBOX.

On REMOTE2, (a 2000 pro system), Computers Near Me populates
immediately, but absent BROWSERBOX.

All that said, here are the current browstat logs for
BROWSERBOX, and REMOTE1:

BROWSERBOX:

Status for domain OFFICE on transport
\Device\NetBT_Tcpip_{470370FF-66C9-442F-BD65-2AA1004FFD21}
Browsing is NOT active on domain.
Master browser name is held by: K06
Master browser is running build 2600


REMOTE1:

Status for domain OFFICE on transport
\Device\NetBT_Tcpip_{DD99A45D-B267-4B3D-8AD6-039FCE4E885B}
Browsing is active on domain.
Master browser name is: K06
Master browser is running build 2600
1 backup servers retrieved from master K06
\\K06
There are 5 servers in domain OFFICE on transport
\Device\NetBT_Tcpip_{DD99A45D-B267-4B3D-8AD6-039FCE4E885B}
There are 0 domains in domain OFFICE on transport
\Device\NetBT_Tcpip_{DD99A45D-B267-4B3D-8AD6-039FCE4E885B}




Please let me know what you might suggest as next steps,
and, as before, accept my sincere thanks,

 

[Kenneth]

On Sun, 16 Sep 2007 21:05:11 -0400, Kenneth

Hi again Chuck,

I believe that I have the problem resolved...!

As I continued to read, I came upon folks who use Kaspersky
Anti-Virus and have trouble seeing their whole workgroup.

They were running a KAV function called "NDIS Filtering."

I just tried to kill that on the two systems we have been
working with, and, bingo... All systems are visible.

Whew...!

Now with that happy result, I do have a question:

With six boxes on our lan, am I best off having only ONE
running the Computer Browser Service (as I do right now) or
should I have two?

Am I correct that if I have two, they will fight it out to
determine a Master, and a Backup, or must I somehow
designate them that way?

Thanks again for all your fine help,

 

[Chuck [MVP]]

Hi Chuck,

I believe that I am doing what your site suggests...

I run Kaspersky, Spybot, SpywareBlaster, and AdAware.

I searched fora and found tools that were to remove Zlob,
but after it returned, found guidance for appropriate manual
removal.

Are you suggesting that I do something other than that?

Also, is there any possibility, in your opinion, that this
trojan could be causing the problems I have described to
you? I thought it a possibility because of the name DNS
Changer.

Sincere thanks,

Kenneth,

With newer malware, such as Zlob, you should proceed to DSLR Security Cleanup,
or SpywareInfo, or a similar security forum.
<http://nitecruzr.blogspot.com/2006/03/get-reliable-online-malware-advice.html>
http://nitecruzr.blogspot.com/2006/03/get-reliable-online-malware-advice.html
<http://www.dslreports.com/forum/cleanup>
http://www.dslreports.com/forum/cleanup
<http://forums.spywareinfo.com/index.php?showtopic=227>
http://forums.spywareinfo.com/index.php?showtopic=227

I think it's quite likely that a side effect of the trojan would be corruption
in the LSP / Winsock. So after you remove Zlob, I'll be advising you in that
direction.
<http://nitecruzr.blogspot.com/2005/05/problems-with-lsp-winsock-layer-in.html>
http://nitecruzr.blogspot.com/2005/05/problems-with-lsp-winsock-layer-in.html

--
Cheers,
Chuck, MS-MVP 2005-2007 [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My email is AT DOT
actual address pchuck mvps org.

 

[Chuck [MVP]]

On Sun, 16 Sep 2007 21:05:11 -0400, Kenneth

Hi again Chuck,

I believe that I have the problem resolved...!

As I continued to read, I came upon folks who use Kaspersky
Anti-Virus and have trouble seeing their whole workgroup.

They were running a KAV function called "NDIS Filtering."

I just tried to kill that on the two systems we have been
working with, and, bingo... All systems are visible.

Whew...!

Now with that happy result, I do have a question:

With six boxes on our lan, am I best off having only ONE
running the Computer Browser Service (as I do right now) or
should I have two?

Am I correct that if I have two, they will fight it out to
determine a Master, and a Backup, or must I somehow
designate them that way?

Thanks again for all your fine help,

Kenneth,

Tuning the browser infrastructure is a lot of fun. If you have one computer
that's on and online constantly, you could use that one reliably as the only
browser. If you don't have a single computer that's on and online constantly,
then you will need a primary and a backup. If you have 2 browsers, and you are
methodical when restarting them, then you should do fine. If you add browsers,
you increase the possibility of having a browser conflict.
<http://nitecruzr.blogspot.com/2005/04/nt-browser-or-why-cant-i-always-see.html>
http://nitecruzr.blogspot.com/2005/04/nt-browser-or-why-cant-i-always-see.html

--
Cheers,
Chuck, MS-MVP 2005-2007 [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My email is AT DOT
actual address pchuck mvps org.

 

[Kenneth]

If you have 2 browsers, and you are
methodical when restarting them, then you should do fine.

Hi Chuck,

Am I correct to understand that would mean start the Master
first, then the "Backup" and they will sort it out?

Thanks again for your kind help,

 

[Chuck [MVP]]

Hi Chuck,

Am I correct to understand that would mean start the Master
first, then the "Backup" and they will sort it out?

Thanks again for your kind help,

Kenneth,

If you have 2 computers running the browser, and you want to force one to be
elected master browser:
1) Power both computers off.
2) Power the desired master browser server on, and bring it up and online.
3) When the master browser is online, bring the backup browser server up and
online.

Any time that the backup browser can't see the master browser, it is required to
start an election. It will, most likely, elect itself. This is where master
browser conflicts start. Note that "Any time" will include a latency period of
up to 6 minutes.

This is why some helpers here start their advice with "In my opinion, using
Network Neighborhood to locate other computers is unreliable...".

If you maintain your home / small business LAN reliably, and follow good
business practices, there's no reason why your home LAN can't be as reliable as
any domain. You do need to understand the issues though.
<http://nitecruzr.blogspot.com/2005/04/nt-browser-or-why-cant-i-always-see.html>
http://nitecruzr.blogspot.com/2005/04/nt-browser-or-why-cant-i-always-see.html

For details, refer to the Microsoft TechNet white paper.
<http://www.microsoft.com/technet/archive/winntas/deploy/prodspecs/ntbrowse.mspx?mfr=true>
http://www.microsoft.com/technet/archive/winntas/deploy/prodspecs/ntbrowse.mspx?mfr=true

--
Cheers,
Chuck, MS-MVP 2005-2007 [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My email is AT DOT
actual address pchuck mvps org.

 

[Kenneth]

On Mon, 17 Sep 2007 08:39:58 -0700, "Chuck [MVP]"


Hi Chuck,

Many thanks...!

 

[Chuck [MVP]]

On Mon, 17 Sep 2007 08:39:58 -0700, "Chuck [MVP]"


Hi Chuck,

Many thanks...!

Glad to help, Kenneth. Good luck!

--
Cheers,
Chuck, MS-MVP 2005-2007 [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My email is AT DOT
actual address pchuck mvps org.