Problems with Networks

[FanacooL]

I have 3 main problems n im using a single thread for it.

1) Networkin Problem: -

I have a network with a WIN2K Server and 15 clients WIN98. (Seems to be a pretty stupid network ) ANyway the server has both DHCP and DNS installed and obviously AD. The problem is that he clients are unable to find DHCP server the DNS is workin fine. When i check IP configuration of clients its showing the DNS entry there. But on DHCP just the broadcast address.
Since the DHCP is not workin so the clients get the IP Automatic assigned that 169.... series. I have created the users accounts in the AD. One more thing one i try to logged into the Domain from the clients i received the message that no DNS server is there to authenticate or ....... When i checked the help file. Its says when the clients dont find DHCP this message will appear.

I have check the log files no error message is there or rather there is no service which is clashing over. Can anyone tell me where the problem is... Im using 10.0 series address. One more thing im using ISA server in integerated mode on the server.

2) Problem With Gateway Configuration: -

In this network the server and clients are of WIN98. The network has a Cable net line which i want to share. Heres the configuration of the network:-
Server:-

LAN CARD 1 : Main Line or cable line with Static IP 192.168.1.24
LAN CARD 2 : Internal network with IP 10.0.0.1
Gateway define on the card 1 is the server IP address which is 192.168.1.1. The problem is with the gateway of the card 2 here when no gateway is defined then sharing is done using CCProxy n when i use the gateway of the server 192.168.1.1 the networks dont work

Is this the right configuration casue i have doubt abt this.
One more thing Wingate is not workin alright here, the clients r getting gatewat timout request.


3) Problem With ISA Server 2004: -

This is the most important issue that i must mention here and for which i need comments and help frm u ppl. On the server ISA 2004 is running and WIndows 2000. No DHCP, AD and DNS. Clients are WIN98. The problem is actually on client side. When we start the server every service and application runs fine including YAHOO Messenger. After around 1 hour or 45 mins. when we close the yahoo messenger then the clients are unable to open the yahoo messenger. You can see it running in the background and icon will be in the tray but u cant open it. So all u have to do is to restart the computer which is really irretating.

With same hardward and OS ISA server 2000 was running fine. ISA configuration is fine cause i have even checked it with default options and configuring manually.

Well the problem has been rectified but the solution is just not acceptable or doesn't satisy us. What we have done is that we change the clients we have use the clients of ISA 2000. I mean the ISA server is 2004 but clients are 2000 one. Now no such problem is there.

Tell me wht could be the problem with this ISA 2004.

[CXGJarrod]

Ok...

Question 1: Did you authorize the DHCP server in active directory? That can cause the DHCP server not to work with AD. I believe on the DHCP server page you can right click the name and it has the option to authorise this DHCP range.

Question 2: The way I have my network setup is that all the client machines have their DNS server as the main DNS server in our network with the gateway machine IP as the gateway. Then the gateway machines DNS points to our ISP's DNS servers. (192.168.1.1 for the DNS and 192.168.1.101 for the gateway)

I would also set the IP address of the internal ISA server network card to something in the 192.168.1.x range so that it can talk with your DNS server. If its 10.x.x.x it will be on another subnet correct? Make sure this address is static.

Also, is that the real IP for the cable line? (192.168.1.24) This is an internal IP address.

[CaZy_DuEcE]

This is one of the most recent virus that i have seen on the internet and it was downloaded from a friend of mine and it was quite easy to depose of if catch it in time if not this is the way that you can get rid of the dang thing and this info is thanks to norton online

When W32.HLLW.Winur is executed, it does the following:


Copies itself as these two files:
C:\klez_removal.exe
A:\Important - read this.doc <62 spaces> .exe

NOTE: There are 62 blank spaces between the first extension (.doc) and the second extension (.exe) to make you think that the file is a Microsoft Word document when it is actually an executable file.


Creates the hidden folder, C:\Winrun.


Copies itself to the C:\Winrun folder as the following files:
.exe
Adobe Photoshop cracker.exe
Age of Empire crack.exe
Age of Mythology cracker.exe
All Microsoft games cracker.exe
Anastacia game.exe
AOL hacker.exe
AOL password stealer.exe
Britney spears game.exe
Bugbear remover.exe
Christina Aguilera game.exe
Die another Day DVD full.exe
Die another day flash movie(1).exe
Die another day flash movie.exe
Dvd ripper.exe
EA games Keygen.exe
Esafe desktop protection crack.exe
Frontpage cracker.exe
Hotmail account hacker in 30 minutes.exe
Hotmail hacker.exe
Hotmailhacker v1.0.exe
ICQ hacker.exe
ICQ password stealer.exe
Jack the ripper v1.0.exe
Jackie chan dvd collection.exe
James Bond game - Die another day.exe
John the ripper v1.0.exe
Justin Timberlake Debute movie.exe
kazaa.exe
kazaa.url.exe
Klez fixtool.exe
Lord of the rings VCD.exe
Love calculator.exe
Mcafee virusscanner crack.exe
Microangelo cracker.exe
Most important hacker tool ever!.exe
msconfig.exe
MSN Messenger commercial cracker.exe
MSN Password stealer.exe
MXlinx 0.30 crack.exe
Nikki cox game and movie.exe
Norton antivirus cracker.exe
Office XP license cracker.exe
pornmovie (hardcore sex adult asian).exe
Red Alert cracker - All versions.exe
Rollercoaster tycoon cracker.exe
Shriek DVD crack patch.exe
Stop the war (intro).exe
Super 2000key keygen.exe
Theme park world cracker.exe
UnIcOrn Gift.exe
Warcraft 3 cracker.exe
Website hacker v1.0.exe
Windows Me crack.exe
Windows XP license cracker.exe
Yaha Fixtool.exe
star trek bridge commander.iso

Adds the value:

msconfig C:\winrun\msconfig.exe

to the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

so that the worm runs when you start Windows.


Adds the value:

winrun c:\winrun\msconfig.exe

to the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunServices

so that the worm runs when you start Windows.


Adds the value:

"IMWarning"="(M)Warning: The person who you are talking to is infected with a virus. Send him the removal tool that can be found in C:\klez_removal.exe(M)"

to the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\MessengerService\Policies

This generates a warning message in MSN Messenger encouraging the user, with the infected system, to send a copy of the worm to his/her contacts.


Decreases the security level of the KaZaA file-sharing software (if you have the software installed), by adding or modifying the following values:
ScanFolder 0x00000001

in these registry keys:

HKEY_CURRENT_USER\Software\KAZAA\\Advanced
HKEY_USERS\.DEFAULT\Software\KAZAA\Advanced

IgnoreAll 0x00000001

in these registry keys:

HKEY_CURRENT_USER\Software\KAZAA\InstantMessaging
HKEY_USERS\.DEFAULT\Software\KAZAA\InstantMessaging

AutoConnected 0x00000001

in these registry keys:

HKEY_CURRENT_USER\Software\KAZAA\UserDetails
HKEY_USERS\.DEFAULT\Software\KAZAA\UserDetails

FolderWarning 0x00000000

in these registry keys:

HKEY_CURRENT_USER\Software\KAZAA\Settings
HKEY_USERS\.DEFAULT\Software\KAZAA\Settings

The following values:

dir0 13263:C:\Winrun
DisableSharing 0x00000000

in these registry keys:

HKEY_CURRENT_USER\Software\KAZAA\LocalContent
HKEY_CURRENT_USER\Software\KAZAA\LocalContent

The following values:

adult_filter_level 0x00000000
bogus_filter 0x00000000
fiwewall_fileter 0x00000000
virus_filter 0x00000000

in these registry keys:

HKEY_CURRENT_USER\Software\KAZAA\ResultsFilter
HKEY_USERS\.DEFAULT\Software\KAZAA\ResultsFilter

Quarantine %Windows%\%StartupPath%

in these registry keys:

HKEY_CURRENT_USER\Software\KAZAA\Settings
HKEY_USERS\.DEFAULT\Software\KAZAA\Settings


Creates the following files:
C:\Autostart.bat
C:\Ntwrk32.dll

NOTE: These files are not malicious, and thus Symantec antivirus products do not detect them as such. You should manually delete them if found.


Attempts to perform a DDoS attack on three specific Web sites.


When W32.HLLW.Winur is executed, it does the following:


Copies itself as these two files:
C:\klez_removal.exe
A:\Important - read this.doc <62 spaces> .exe

NOTE: There are 62 blank spaces between the first extension (.doc) and the second extension (.exe) to make you think that the file is a Microsoft Word document when it is actually an executable file.


Creates the hidden folder, C:\Winrun.


Copies itself to the C:\Winrun folder as the following files:
.exe
Adobe Photoshop cracker.exe
Age of Empire crack.exe
Age of Mythology cracker.exe
All Microsoft games cracker.exe
Anastacia game.exe
AOL hacker.exe
AOL password stealer.exe
Britney spears game.exe
Bugbear remover.exe
Christina Aguilera game.exe
Die another Day DVD full.exe
Die another day flash movie(1).exe
Die another day flash movie.exe
Dvd ripper.exe
EA games Keygen.exe
Esafe desktop protection crack.exe
Frontpage cracker.exe
Hotmail account hacker in 30 minutes.exe
Hotmail hacker.exe
Hotmailhacker v1.0.exe
ICQ hacker.exe
ICQ password stealer.exe
Jack the ripper v1.0.exe
Jackie chan dvd collection.exe
James Bond game - Die another day.exe
John the ripper v1.0.exe
Justin Timberlake Debute movie.exe
kazaa.exe
kazaa.url.exe
Klez fixtool.exe
Lord of the rings VCD.exe
Love calculator.exe
Mcafee virusscanner crack.exe
Microangelo cracker.exe
Most important hacker tool ever!.exe
msconfig.exe
MSN Messenger commercial cracker.exe
MSN Password stealer.exe
MXlinx 0.30 crack.exe
Nikki cox game and movie.exe
Norton antivirus cracker.exe
Office XP license cracker.exe
pornmovie (hardcore sex adult asian).exe
Red Alert cracker - All versions.exe
Rollercoaster tycoon cracker.exe
Shriek DVD crack patch.exe
Stop the war (intro).exe
Super 2000key keygen.exe
Theme park world cracker.exe
UnIcOrn Gift.exe
Warcraft 3 cracker.exe
Website hacker v1.0.exe
Windows Me crack.exe
Windows XP license cracker.exe
Yaha Fixtool.exe


Adds the value:

msconfig C:\winrun\msconfig.exe

to the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

so that the worm runs when you start Windows.


Adds the value:

winrun c:\winrun\msconfig.exe

to the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunServices

so that the worm runs when you start Windows.


Adds the value:

"IMWarning"="(M)Warning: The person who you are talking to is infected with a virus. Send him the removal tool that can be found in C:\klez_removal.exe(M)"

to the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\MessengerService\Policies

This generates a warning message in MSN Messenger encouraging the user, with the infected system, to send a copy of the worm to his/her contacts.


Decreases the security level of the KaZaA file-sharing software (if you have the software installed), by adding or modifying the following values:
ScanFolder 0x00000001

in these registry keys:

HKEY_CURRENT_USER\Software\KAZAA\\Advanced
HKEY_USERS\.DEFAULT\Software\KAZAA\Advanced

IgnoreAll 0x00000001

in these registry keys:

HKEY_CURRENT_USER\Software\KAZAA\InstantMessaging
HKEY_USERS\.DEFAULT\Software\KAZAA\InstantMessaging

AutoConnected 0x00000001

in these registry keys:

HKEY_CURRENT_USER\Software\KAZAA\UserDetails
HKEY_USERS\.DEFAULT\Software\KAZAA\UserDetails

FolderWarning 0x00000000

in these registry keys:

HKEY_CURRENT_USER\Software\KAZAA\Settings
HKEY_USERS\.DEFAULT\Software\KAZAA\Settings

The following values:

dir0 13263:C:\Winrun
DisableSharing 0x00000000

in these registry keys:

HKEY_CURRENT_USER\Software\KAZAA\LocalContent
HKEY_CURRENT_USER\Software\KAZAA\LocalContent

The following values:

adult_filter_level 0x00000000
bogus_filter 0x00000000
fiwewall_fileter 0x00000000
virus_filter 0x00000000

in these registry keys:

HKEY_CURRENT_USER\Software\KAZAA\ResultsFilter
HKEY_USERS\.DEFAULT\Software\KAZAA\ResultsFilter

Quarantine %Windows%\%StartupPath%

in these registry keys:

HKEY_CURRENT_USER\Software\KAZAA\Settings
HKEY_USERS\.DEFAULT\Software\KAZAA\Settings


Creates the following files:
C:\Autostart.bat
C:\Ntwrk32.dll

NOTE: These files are not malicious, and thus Symantec antivirus products do not detect them as such. You should manually delete them if found.


Attempts to perform a DDoS attack on three specific Web sites.

known as:
WORM_WINUR.A [Trend], W32/Winur.worm.a [McAfee], Worm.P2P.Winur [KAV]

W32.HLLW.Winur
Discovered on: February 03, 2003
Last Updated on: May 19, 2003 01:07:42 PM







W32.HLLW.Winur is a worm that uses the KaZaA and WinMX file-sharing programs to spread itself. This worm can also perform Distributed Denial of Service (DDoS) attacks.

W32.HLLW.Winur is written in Microsoft Visual Basic, version 6.


Also Known As: WORM_WINUR.A [Trend], W32/Winur.worm.a [McAfee], Worm.P2P.Winur [KAV]

Type: Worm
Infection Length: 61,440 bytes



Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
Systems Not Affected: Windows 3.x, Macintosh, OS/2, UNIX, Linux

[magnoon]

CaZy_DuEcE

Not only off topic for the thread but yesterday's news.

Discovered on: February 03, 2003

[FanacooL]

CXGJarrod regarding the Authorization of DHCP server, i forgot to mention that it is authorize. So no problem with authorization, scope is working fine and i have even changed the option to unlimited time for leasing. Well what someone suggest about this problem is that running both DNS and DHCP on a same network usually cause services to conflict. But believe me i have done this numerous time before no such problem has occured n the network is working fine but as this network is concerned... things messed up.

In the second reply wht i have concived frm here is that u have DNS server on seperate machine and your gateway on another. The problem here in my case is something different maybe i am unable to explain it right anyways...... I have used the same class address for the external and internal network. i mean as external is 192.168.1.X i use 192.168.10.X for internal. Ok fine the clients are pinging to my internal address of the NIC2 which is 192.168.10.1. Again when i try to use proxy server to share the external network (cable net). Clients dont seem to get the request means simply no results to the web request. Again i have asked few of my friends abt this problem and somebody told me that i should use the different class address for the internal network. So thats why i switch to class A series.

But the problem is still there the internal network is seperate frm the external network and clients are not able to access the internal net. and the only problem that comes to my mind is the gateway of the NIC2 that is my internal network.

Just simply tell me NIC 1 is external with address 192.168.1.24 have gateway 192.168.1.1 rite and NIC 2 has address 10.0.0.1 gateway ?. NIC 1 is my cable net line and NIC 2 is internal network. So what gateway should i use on clients and one NIC 2.?