Losing connection to shared drives

viclobo · 17th April 2008

Hello all,

I really need help on this..!!!!

I have a windows Small business 2003 running. I have a comun drive (s:\) which the size is around 150GB. I also have a printer shared on the server.

Frecuently my users stop accessing the S:\ drive as well as the printer.

When that happens:

This is what I can do the following:
- I can ping the server by IP
- I can ping the server by host name
- I can remote desktop the server by IP or Hostname.
- I can print
- I can access the S:\ locally on the server which is the D:\comun\. the S:\ drive is a folder named comun which is shared and mapped on the users workstation on with the S:\

This is What I cannot do:
- On the server locally. I can not access the local shared is I try \\servername\sharefolder.
- From the workstation I cannot access any shared drive
- From the workstation I cannot print

I thought the problem was the antivirus and I unistalled it....the same problem
I thought it was problem with a Network interface...the same problem

The only way to fix this is by rebooting the server and everything starts working fine. some time this happen in the morning...some time in the afternoon.

Any help will be really aprreciated

thanks
VL

mflynn · 17th April 2008

Hi viclobo

Welcome to the BBS!

Yes it could be a virus scanner problem! By your virus scanner not working!

There are some Virus's that will cause this.

But first let us get a little more info.

Any events related to this?

Clear (save if you want) the event logs so you will not need to sort thru so much later when it happens again. Check them immediately next time this happens.

Other things to do next incident.

1. Check in Services if the Server service is still running.
It should be set to start automaticlly.
Even if it appears to be running stop it and restart it. Then see if it corrects your problem.

2. If 2 above is not effective.
Run Taskmgr kill Explorer (desktop should go blank or just restart and restore desktop) if it does not restart while still in Taskmgr go to File-new Task (Run...) and restart Explorer.
Then see if it corrects your problem.

3. If you have not done so yet unshare both drive and printer. Restart computer and then reshare them.

4. Rule out a USB or backup device grabing the drive letter.

While waiting for the next incident we need to see if you do have a Virus.

I believe you have a culprit!

So!

Go here read and understand this page.
http://windowsbbs.com/announcement.php?f=41

Then
1. run ATF-Cleaner
2. Run HiJackThis and post Log back to here
3. Run Deckard and post all 3 logs (you can edit, over write any confidential info with * if you need)

Download and and run the following:

XCleanMicro http://www.xblock.com/download/xclean_micro.exe
Remove all it finds decline the reboot on items it cleans until it finishes then reboot if it found anything.

Prevx http://info.prevx.com/downloadcsi.asp

MalwareBytes AntiSpyware http://www.malwarebytes.org/mbam.php

Finally the Big boy of Stand alone Virus cleaners:

Kaspersky AVP Tool 7.0.0.180 17\04\2008
http://majorgeeks.com/Kaspersky_AVP_Tool_d4515.html

Mike

viclobo · 17th April 2008

Thanks Mike

I will try tonight

Cheers

viclobo · 17th April 2008

the ATF Cleanner is not supported on Wndows 2003 small Business...

Have you tried this on SBS 2003 ?

Thanks

victor Lobo

mflynn · 17th April 2008

Hmmm

No not on SBS, but on Standard and Advavced 2003 server they do!

I just checked one of my 2003 servers and did a clean with it.

Some of the older versions did not. Did you get the newest version?

This will do, "DiskCleaner", I have used it and ATF-Cleaner for years even back to Win98 days for DiskCleaner. Both Atf-Cleaner and DiskCleaner will find things the other missed so I run them both.

http://www.diskcleaner.nl/download.php

The point here is to cleanup so if the new ATF-Cleaner does work then run them both.

You should also get CCleaner and do both temp and reg clean!
get the slim version http://www.ccleaner.com/download/builds

If you could get the HJT and Deckards Logs in before tonight it would be nice to have when this incident happens again.

But the others will require a reboot so tonight is good for them.

Mike

**ReggieB** · 17th April 2008

To be honest, before I dived down the "this looks like a virus" route, I'd check something more basic. This could be a permissions problem.

It is the sort of thing you can get if you have done the most essential thing that you MUST do with a 2003 server network - get the name resolution working right. The key to that is getting DNS working right. Have a look at this post:

Set your Windows 2003 as the primary DNS server

Make sure all your PCs are using the SBS server as their primary DNS server.

If your systems don't resolve DNS via the server, they fall back on NetBIOS which can have intermittent problems. During those periods the systems can't resolve Active Directory object names and therefore can't authenticate and you get permissions issues.

Even if this is not a DNS issue, I'd still be looking at an intermittent permissions problem as that fit the symptoms (basic TCP/IP functions like ping don't rely on AD authentication)

mflynn · 17th April 2008

Hi Vic and Reg

Could be Reggie. But since he had some issues with the Virus scanner won't hurt to be sure.

The HJT and Deckards should give us some insight.

The pings by name and ip make me think it is more a sharing issue. If it is
DNS it would likely be the cache.

So Vic not yet but when we give you the go ahead do the below.

This link do only post #4 Begin at "To do this from the command line use this"

Netware client slows down access to Windows server

Mike

mflynn · 22nd April 2008

Hi Vic

If this was resolved please post what was done.

It may be of help to others.

Mike