StevenUnderwood Posted October 27, 2006 Share Posted October 27, 2006 OK. I am getting my butt whipped by a machine problem that seems it should be easy to find. Please pipe up with any suggestions on where to look next. I am about ready to image a new machine for this user, but I still want to find the cause... Problem started last Friday about 1PM EDT. Part of our network started having dropouts of services. I was at another site but the people there tracked the problem down to one machine by visual inspection of the switch activity lights. Removing this machine from the network fixed all the other problems immeditely and stayed fine over the weekend. Skip forward to Monday... I have the machine and scan for viruses using our Corporate Edition Norton, nothing found. Scan for Spyware using corporate Webroot Spysweeper, nothing found. Search the registry for strange RUn and RunOnce, etc. entries, all check out. Run msconfig and check out the .ini files, etc., nothing. Place the machine on our test network and do not notice anything unusual happening. Put the machine back on the network and let the user start working again, while monitoring the network. Works fine from 1PM Monday until ~3AM Tuesday, when services start dropping again. At 7:30 AM, on-site person pulls the plug again (because of high activity) and services resume. I arrive at 8AM, again finding nothing unusual running (since the network drop caused the network port to drop everything). Repeating above scans show nothing. Use safety.live.com (MS scanner), Spybot Search & Destroy, and Ad-Aware which all show clean. Checking the firewall logs (for SMTP traffic from the machine, figuring some kind of remote spammer program) reveals that every 10 minutes since the attack started, while it is on the network, the machine makes an http request to a few different IP addresses(184.108.40.206, 220.127.116.11, and 18.104.22.168). The firewall does not list the actual command or directory being attempted. It also shows one connection each night to a server on the conversent.net 22.214.171.124 - Searches on the web for this IP address turns up nothing. It currently resolves to zsexygirls.com, a live web site. 126.96.36.199 - Searches on the web for this IP addresses only turns up one group response from 2004 (According to that post, at that time spamcop Tracking link: http://www.dumpsmarket.net Resolves to 188.8.131.52) (SpamCop version 1.3.4 © SpamCop.net, Inc. 1998-2004 All Rights Reserved, BTW). This site is currently running Apache/1.3.37 [at] localhost 184.108.40.206 - Searches on the web for this IP address turns up nothing. This site is currently running Apache/2.0.54 (Fedora) [at] secure-server.suroot.com. A lookup on that name does resolve back to the same IP address. Firewall logs further shows no other attempts to those same 3 sites, so the problem seems localized to this machine. I have setup the firewall to outright drop connection attempts to those IPs. I put the computer back on the network and have not seen the network problem since. I assume this process is looking for a command from the website, then starts some sort of search on the local network, but I can find no indication of this. If this sounds familiar to anybody, or if you see something I have missed, please let me know. I am trying to block a couple other sites that this machine has connected to once over noght, but lots of our machines connect to those servers (only since 03-sep-2006 if that makes a difference) and I'm not sure it is related or not. Those sites are both converent.net hosts. Link to comment Share on other sites More sharing options...
This topic is now archived and is closed to further replies.