[eurotrash]

I have an environment with only ONE server period. It is SBS 2003 SP2. It is the server in a small office with about 20 XP clients on a simple Flat network with just a simple snapgear router and a T1. Recently had the Vondu trojan infect the server and had to clean it out with otscan and Malwarebytes followed by a reinstall of SP2 and Trendmicro SMB. Now everymorning at exactly 08:10:09 the event log shows this error.
Multiple domain controllers running Windows Server 2003 for Small Business Server have been detected in your domain. To prevent this computer from shutting down in the future, you must remove all but one of these from the domain.
then 30 mins later again saying its going to shut down. Then at 09:10:09 the server shutsdown saying the same error and its shutting down for EULA compliance. If I had to take a guess, I would say this has to be something to do with DNS or wins? DNS pointed to the provider and the clients pointed to the server for DNS, But I'm not Familiar with the new AD DNS snap in and how it is supposed to be configured. I have NO other servers so there cant be another DC involved. Sometimes the "Server service" stops also, and the mapped drives (just mapped to its own shares) become unmapped but yet I can ping out and the gateway. I can also map a drive to a NAS device fine , but it wont map to its own shares.... Any ideas ?

[Advertisements]

I guess nobody wants to touch this one ??

[eurotrash]

I guess nobody wants to touch this one ??

[eurotrash]

What the...?

[dsenette]

One of the causes of this problems can be that your server may not be hold
all the necessary roles. The SBS server must hold all the FSMO roles, and
be a Global Catalog Server. Here are a couple of links to help you
determine the status of your server. Run through those and post back what
you find.

http://www.petri.co....ole_holders.htm

http://technet2.micr...3.mspx?mfr=true

[eurotrash]

Thanks for replying
I went through all of those settings and they are all correct
Schema CORRECT
Domain Naming CORRECT
RID CORRECT
PDC Emulator CORRECT
Infrastructure CORRECT

The Global Catalog check box was also selected ? However, there was no "Query Policy" selected and the drop down for query policy only offers "default query policy" ? Just below this setting is "DNS ALIAS" and it has this "E1EF6028-B2F9-43E6-876E-6F9A872D38B4._msdcs.tate.local" ?? which appears to be a hash but the name of the server is not _msdcs the servername is "somethingelse.tate.local" What do you think ?

[dsenette]

E1EF6028-B2F9-43E6-876E-6F9A872D38B4._msdcs.tate.local"

the msdcs (microsoft Domain Controler something...i think service) is something that MS appends to a DC record

now other services are terminating also.... along with the occasional shutdown because it thinks there is another domain controller .....I dont know if the other services are dependencies etc .... I still think the trojans that this had before may have messed up DNS or some DLLs

from your PM
...i'm not 100 percent sure what's going on....

can you open up a topic in the malware forum (just to be sure)

Please go to the malware forum and follow the instructions at the top....Especially the CLICK HERE.

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty (and you may not be) then post a hijackthis log in THE MALWARE FORUM forum.
(Posting HiJack This logs in any other forum other than the malware forum is forbidden. If you post an HJT log in any other forum, it will be removed and it will take you longer to get help, so please make sure you only post HJT logs in the malware forum)

If you are still having problems after getting a clean bill of health from the malware expert, please return to this thread..