OK I have a server that the store.exe and an svchost.exe file are maxing the proc out. At first I thought it was the sasser worm cause the lsass.exe file was peaking as well. That has stoped and now it is just the store.exe and svchost.exe. I ran a virus scan to no avail with just recently updated definitions. Any ideas?

 

Thanks,
Shane

well now mad.exe and lsass.exe have kicked up. this has shut down email for this client and i need to fix it asap. all help is much appreciated.

 

shane

I have created a picture of the Local Area Network Properties. In the screenhot you can see that 'File and Printer Sharing' is checked. You should check this on the Network Adapter that is connected to your Lan.

I am having trouble connecting to the server at the moment so I am waiting for someone to reboot it but I believe that that check box is checked. I am assuming that we definately want it bound. Is it possible for it to become unbound from some error or another?

Thanks,

Shane

Ok, I am at the server now. The Local card is checked. The Wide area card is not. I think this is how it is supposed to be. This is what I have done to the server recently. I installed a USB2.0 pci card. I also migrated User Shared Folders from C: to D:. I am not sure what would cause this out of hte blue but I greatly appreciate your help.

 

Thanks,

Shane

Windows IP Configuration
   Host Name . . . . . . . . . . . . : ccserver1
   Primary Dns Suffix  . . . . . . . : ccdomain.local
   Node Type . . . . . . . . . . . . : Unknown
   IP Routing Enabled. . . . . . . . : Yes
   WINS Proxy Enabled. . . . . . . . : Yes
   DNS Suffix Search List. . . . . . : ccdomain.local

 

Ethernet adapter Local Area Connection - Inside:
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : 3Com EtherLink XL 10/100 PCI For Complete PC Management NIC (3C905C-TX)
   Physical Address. . . . . . . . . : 00-04-75-AA-6F-27
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 192.168.100.2
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . : 192.168.100.2
   Primary WINS Server . . . . . . . : 192.168.100.2

 

Ethernet adapter Wide Area Connection - Internet:
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) PRO/100+ Server Adapter (PILA8470B)
   Physical Address. . . . . . . . . : 00-30-48-24-76-93
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 66.255.117.42
   Subnet Mask . . . . . . . . . . . : 255.255.255.248
   Default Gateway . . . . . . . . . : 66.255.117.41
   DNS Servers . . . . . . . . . . . : 192.168.100.2
   Primary WINS Server . . . . . . . : 192.168.100.2
   NetBIOS over Tcpip. . . . . . . . : Disabled

I dont believe I changed anything on SMB signing. Im not even sure where I would go to do that.

 

I didnt change any policies.

 

It started this morning at 7am ish. I finished all of my work last night at 11:30pm.

 

I moved the folders using xCopy. I used the SBS2003 microsoft official document on moving data folders.

Hi Shane/Mariëtte,

 

1). does server run normally when exchange is stopped ? (disable sa service). ?

 

2). Mariette: Should DNS on wan card better point to ISP dns ?

No Pim. You should know this:

 

you're right mariëtte

kind of tired... started 05.00 this morning

but anyway, the WINS should be blank on WAN

 

(i assumed he had his ISP directly on WAN card )