Printers still not working

Hi
here are the symptoms.
all network printers give status as "unable to connect"
when trying to browse the network i get the error message "RTWilliams is not
accessable. The server is not configured for transactions"
this all seems to have come about at the same time as a virus was detected
and deleted.
however the client computers can still access the internet and folders on
the network from desktop shortcuts and exchange is working ok.
I have tried restarting the server a number of times and have tried
restarting the printer spool service.
Any ideas?
thanks
Andrew

Phil
Wed Jul 13 09:15:19 CDT 2005

In article <82B6DF8D-1D2E-413D-B4F8-1004E5E1EC7F@microsoft.com>, Andrew
<Andrew@discussions.microsoft.com> writes
>Hi
>here are the symptoms.
>all network printers give status as "unable to connect"
>when trying to browse the network i get the error message "RTWilliams is not
>accessable. The server is not configured for transactions"
>this all seems to have come about at the same time as a virus was detected
>and deleted.
>however the client computers can still access the internet and folders on
>the network from desktop shortcuts and exchange is working ok.
>I have tried restarting the server a number of times and have tried
>restarting the printer spool service.
>Any ideas?
>thanks
>Andrew
>
Sounds like the virus *may* have altered something.

I would...
1. Shutdown the Server.
2. Pull the power from the Server.
3. Power down the printers AND separate print-server boxes (if any).
4. Bring the Server back up.
5. WAIT..... and then wait a bit longer! ;-) - Give the Server 5-10
minutes to settle.

Then start testing printing.
Do you have a local printer on the Server?
If not, can you connect one? - Prove you can print from the Server to
this printer. -- Spooler is working, and local printer port works.
Share this printer..
Fire up a Client PC.
Can this PC print to the locally attached printer on the Server?
Power up a network printer, and print server if necessary. Can the
Client print to this printer?
If possible, can you connect directly to the network printer from the
Client PC?

Try these for a start.

Also, if known, put the virus name into Google and see what comes up. It
may well have happened to someone else, and the answer may be on an AV
vendors website.

HTH,
Phil Partridge
philp@pebbleGRIT.demon.co.uk
Remove the grit to reply

Andrew
Wed Jul 13 10:37:02 CDT 2005

hi Phil,
am just about to try shutting down as per your instrructions.
The server can print to all printers, its just the client computers that
have a problem, and also the client computers cant browse the network,
however they can access network folders from existing shortcuts.
will let you know how it goes.
thanks
Andrew

"Phil Partridge" wrote:

> Sounds like the virus *may* have altered something.
>
> I would...
> 1. Shutdown the Server.
> 2. Pull the power from the Server.
> 3. Power down the printers AND separate print-server boxes (if any).
> 4. Bring the Server back up.
> 5. WAIT..... and then wait a bit longer! ;-) - Give the Server 5-10
> minutes to settle.
>
> Then start testing printing.
> Do you have a local printer on the Server?
> If not, can you connect one? - Prove you can print from the Server to
> this printer. -- Spooler is working, and local printer port works.
> Share this printer..
> Fire up a Client PC.
> Can this PC print to the locally attached printer on the Server?
> Power up a network printer, and print server if necessary. Can the
> Client print to this printer?
> If possible, can you connect directly to the network printer from the
> Client PC?
>
> Try these for a start.
>
> Also, if known, put the virus name into Google and see what comes up. It
> may well have happened to someone else, and the answer may be on an AV
> vendors website.
>
> HTH,
> Phil Partridge
> philp@pebbleGRIT.demon.co.uk
> Remove the grit to reply
>

Andrew
Wed Jul 13 12:27:05 CDT 2005

Hi, none of this made any difference im afraid.
any other suggestions?
ps
when trying to browse the network from a client computer i still get the error
"the server is not configured for transactions"

"Phil Partridge" wrote:

> In article <82B6DF8D-1D2E-413D-B4F8-1004E5E1EC7F@microsoft.com>, Andrew
> <Andrew@discussions.microsoft.com> writes
> >Hi
> >here are the symptoms.
> >all network printers give status as "unable to connect"
> >when trying to browse the network i get the error message "RTWilliams is not
> >accessable. The server is not configured for transactions"
> >this all seems to have come about at the same time as a virus was detected
> >and deleted.
> >however the client computers can still access the internet and folders on
> >the network from desktop shortcuts and exchange is working ok.
> >I have tried restarting the server a number of times and have tried
> >restarting the printer spool service.
> >Any ideas?
> >thanks
> >Andrew
> >
> Sounds like the virus *may* have altered something.
>
> I would...
> 1. Shutdown the Server.
> 2. Pull the power from the Server.
> 3. Power down the printers AND separate print-server boxes (if any).
> 4. Bring the Server back up.
> 5. WAIT..... and then wait a bit longer! ;-) - Give the Server 5-10
> minutes to settle.
>
> Then start testing printing.
> Do you have a local printer on the Server?
> If not, can you connect one? - Prove you can print from the Server to
> this printer. -- Spooler is working, and local printer port works.
> Share this printer..
> Fire up a Client PC.
> Can this PC print to the locally attached printer on the Server?
> Power up a network printer, and print server if necessary. Can the
> Client print to this printer?
> If possible, can you connect directly to the network printer from the
> Client PC?
>
> Try these for a start.
>
> Also, if known, put the virus name into Google and see what comes up. It
> may well have happened to someone else, and the answer may be on an AV
> vendors website.
>
> HTH,
> Phil Partridge
> philp@pebbleGRIT.demon.co.uk
> Remove the grit to reply
>

Phil
Wed Jul 13 13:27:04 CDT 2005

In article <D71A183F-168F-42F5-8FFC-9848F9542523@microsoft.com>, Andrew
<Andrew@discussions.microsoft.com> writes
>Hi, none of this made any difference im afraid.
>any other suggestions?
>ps
>when trying to browse the network from a client computer i still get the error
>"the server is not configured for transactions"
>
OK.

If you right-click My Computer on Server,
Click on Manage
Expand shares and click it.. You should see all the shares in the right-
hand pane.
Is there a share 'IPC$' ?
If not, open a command prompt and type "net share ipc$" without the
quotes and press enter.

Then report back.
Phil Partridge
philp@pebbleGRIT.demon.co.uk
Remove the grit to reply

Andrew
Thu Jul 14 03:02:01 CDT 2005

Hi
i followed your instructions and found i needed to add the IPC$ share. i
got the mesage "IPC$ was shared sucessfully", when i refreshed the shares it
appeared in the right hand pane, this made no difference to the printing or
network browsing issues.
ps
when i reopened the shares, the IPC$ had dissapeared from the list.



"Phil Partridge" wrote:

> In article <D71A183F-168F-42F5-8FFC-9848F9542523@microsoft.com>, Andrew
> <Andrew@discussions.microsoft.com> writes
> >Hi, none of this made any difference im afraid.
> >any other suggestions?
> >ps
> >when trying to browse the network from a client computer i still get the error
> >"the server is not configured for transactions"
> >
> OK.
>
> If you right-click My Computer on Server,
> Click on Manage
> Expand shares and click it.. You should see all the shares in the right-
> hand pane.
> Is there a share 'IPC$' ?
> If not, open a command prompt and type "net share ipc$" without the
> quotes and press enter.
>
> Then report back.
> Phil Partridge
> philp@pebbleGRIT.demon.co.uk
> Remove the grit to reply
>

Phil
Fri Jul 15 03:22:41 CDT 2005

In article <9F514F09-3EDB-4357-9C50-3104A750CD01@microsoft.com>, Andrew
<Andrew@discussions.microsoft.com> writes
>Hi
>i followed your instructions and found i needed to add the IPC$ share. i
>got the mesage "IPC$ was shared sucessfully", when i refreshed the shares it
>appeared in the right hand pane, this made no difference to the printing or
>network browsing issues.
>ps
>when i reopened the shares, the IPC$ had dissapeared from the list.
>
>

Andrew,

You have two threads running, and obviously the problems are both
connected.
Which AV product do you use?
What was the virus reported that you had?

I think this is a DNS/hosts problem, but would like more info before
suggesting tweaking DNS and host settings.

You could try another AV product, say www.panda.co.uk and try the
activescan link. - This must be done from the Server.
you may pick up something your other AV product has missed, or it may
have been compromised by the original infection.

Phil.
>
>"Phil Partridge" wrote:
>
>> In article <D71A183F-168F-42F5-8FFC-9848F9542523@microsoft.com>, Andrew
>> <Andrew@discussions.microsoft.com> writes
>> >Hi, none of this made any difference im afraid.
>> >any other suggestions?
>> >ps
>> >when trying to browse the network from a client computer i still get the
>error
>> >"the server is not configured for transactions"
>> >
>> OK.
>>
>> If you right-click My Computer on Server,
>> Click on Manage
>> Expand shares and click it.. You should see all the shares in the right-
>> hand pane.
>> Is there a share 'IPC$' ?
>> If not, open a command prompt and type "net share ipc$" without the
>> quotes and press enter.
>>
>> Then report back.
>> Phil Partridge
>> philp@pebbleGRIT.demon.co.uk
>> Remove the grit to reply
>>

Phil Partridge
philp@pebbleGRIT.demon.co.uk
Remove the grit to reply

Andrew
Fri Jul 15 08:08:03 CDT 2005

Hi
we are running sophos anti virus(version 5.0.4) and i have also done a full
scan with Avert stinger which found nothing. the virus that came in
immediately before it all stopped working was "W32/Agobot-Fam"
all of the other network folders and shortcuts are accesible, its just the
printers report "not connected" and inability to browse the network.
there is also a lot of unknown internet activity.
Many Thanks for your help so far, it is genuinely apreciated
Andrew

"Phil Partridge" wrote:

> In article <9F514F09-3EDB-4357-9C50-3104A750CD01@microsoft.com>, Andrew
> <Andrew@discussions.microsoft.com> writes
> >Hi
> >i followed your instructions and found i needed to add the IPC$ share. i
> >got the mesage "IPC$ was shared sucessfully", when i refreshed the shares it
> >appeared in the right hand pane, this made no difference to the printing or
> >network browsing issues.
> >ps
> >when i reopened the shares, the IPC$ had dissapeared from the list.
> >
> >
>
> Andrew,
>
> You have two threads running, and obviously the problems are both
> connected.
> Which AV product do you use?
> What was the virus reported that you had?
>
> I think this is a DNS/hosts problem, but would like more info before
> suggesting tweaking DNS and host settings.
>
> You could try another AV product, say www.panda.co.uk and try the
> activescan link. - This must be done from the Server.
> you may pick up something your other AV product has missed, or it may
> have been compromised by the original infection.
>
> Phil.
> >
> >"Phil Partridge" wrote:
> >
> >> In article <D71A183F-168F-42F5-8FFC-9848F9542523@microsoft.com>, Andrew
> >> <Andrew@discussions.microsoft.com> writes
> >> >Hi, none of this made any difference im afraid.
> >> >any other suggestions?
> >> >ps
> >> >when trying to browse the network from a client computer i still get the
> >error
> >> >"the server is not configured for transactions"
> >> >
> >> OK.
> >>
> >> If you right-click My Computer on Server,
> >> Click on Manage
> >> Expand shares and click it.. You should see all the shares in the right-
> >> hand pane.
> >> Is there a share 'IPC$' ?
> >> If not, open a command prompt and type "net share ipc$" without the
> >> quotes and press enter.
> >>
> >> Then report back.
> >> Phil Partridge
> >> philp@pebbleGRIT.demon.co.uk
> >> Remove the grit to reply
> >>
>
> Phil Partridge
> philp@pebbleGRIT.demon.co.uk
> Remove the grit to reply
>

Andrew
Fri Jul 15 09:34:07 CDT 2005

FYI
im running "panda activescan" now

"Phil Partridge" wrote:

> In article <9F514F09-3EDB-4357-9C50-3104A750CD01@microsoft.com>, Andrew
> <Andrew@discussions.microsoft.com> writes
> >Hi
> >i followed your instructions and found i needed to add the IPC$ share. i
> >got the mesage "IPC$ was shared sucessfully", when i refreshed the shares it
> >appeared in the right hand pane, this made no difference to the printing or
> >network browsing issues.
> >ps
> >when i reopened the shares, the IPC$ had dissapeared from the list.
> >
> >
>
> Andrew,
>
> You have two threads running, and obviously the problems are both
> connected.
> Which AV product do you use?
> What was the virus reported that you had?
>
> I think this is a DNS/hosts problem, but would like more info before
> suggesting tweaking DNS and host settings.
>
> You could try another AV product, say www.panda.co.uk and try the
> activescan link. - This must be done from the Server.
> you may pick up something your other AV product has missed, or it may
> have been compromised by the original infection.
>
> Phil.
> >
> >"Phil Partridge" wrote:
> >
> >> In article <D71A183F-168F-42F5-8FFC-9848F9542523@microsoft.com>, Andrew
> >> <Andrew@discussions.microsoft.com> writes
> >> >Hi, none of this made any difference im afraid.
> >> >any other suggestions?
> >> >ps
> >> >when trying to browse the network from a client computer i still get the
> >error
> >> >"the server is not configured for transactions"
> >> >
> >> OK.
> >>
> >> If you right-click My Computer on Server,
> >> Click on Manage
> >> Expand shares and click it.. You should see all the shares in the right-
> >> hand pane.
> >> Is there a share 'IPC$' ?
> >> If not, open a command prompt and type "net share ipc$" without the
> >> quotes and press enter.
> >>
> >> Then report back.
> >> Phil Partridge
> >> philp@pebbleGRIT.demon.co.uk
> >> Remove the grit to reply
> >>
>
> Phil Partridge
> philp@pebbleGRIT.demon.co.uk
> Remove the grit to reply
>

Andrew
Fri Jul 15 12:05:04 CDT 2005

Hi
some interesting developments. panda scan found 16 viruses, it disinfected
14 and i manually deleted the other two.
i rebooted and when the system came back up the printers are now working,
but the internet is not.
(its as if the network cable is unplugged.) i assume that the problem has
shifted from the printers to the internet.
Any ideas?
Thanks again
Andrew

"Phil Partridge" wrote:

> In article <9F514F09-3EDB-4357-9C50-3104A750CD01@microsoft.com>, Andrew
> <Andrew@discussions.microsoft.com> writes
> >Hi
> >i followed your instructions and found i needed to add the IPC$ share. i
> >got the mesage "IPC$ was shared sucessfully", when i refreshed the shares it
> >appeared in the right hand pane, this made no difference to the printing or
> >network browsing issues.
> >ps
> >when i reopened the shares, the IPC$ had dissapeared from the list.
> >
> >
>
> Andrew,
>
> You have two threads running, and obviously the problems are both
> connected.
> Which AV product do you use?
> What was the virus reported that you had?
>
> I think this is a DNS/hosts problem, but would like more info before
> suggesting tweaking DNS and host settings.
>
> You could try another AV product, say www.panda.co.uk and try the
> activescan link. - This must be done from the Server.
> you may pick up something your other AV product has missed, or it may
> have been compromised by the original infection.
>
> Phil.
> >
> >"Phil Partridge" wrote:
> >
> >> In article <D71A183F-168F-42F5-8FFC-9848F9542523@microsoft.com>, Andrew
> >> <Andrew@discussions.microsoft.com> writes
> >> >Hi, none of this made any difference im afraid.
> >> >any other suggestions?
> >> >ps
> >> >when trying to browse the network from a client computer i still get the
> >error
> >> >"the server is not configured for transactions"
> >> >
> >> OK.
> >>
> >> If you right-click My Computer on Server,
> >> Click on Manage
> >> Expand shares and click it.. You should see all the shares in the right-
> >> hand pane.
> >> Is there a share 'IPC$' ?
> >> If not, open a command prompt and type "net share ipc$" without the
> >> quotes and press enter.
> >>
> >> Then report back.
> >> Phil Partridge
> >> philp@pebbleGRIT.demon.co.uk
> >> Remove the grit to reply
> >>
>
> Phil Partridge
> philp@pebbleGRIT.demon.co.uk
> Remove the grit to reply
>

Phil
Sat Jul 16 12:55:32 CDT 2005

In article <78A01D5A-0BDB-403D-A62C-D52BE7072214@microsoft.com>, Andrew
<Andrew@discussions.microsoft.com> writes
>Hi
>some interesting developments. panda scan found 16 viruses, it disinfected
>14 and i manually deleted the other two.
>i rebooted and when the system came back up the printers are now working,
>but the internet is not.
>(its as if the network cable is unplugged.) i assume that the problem has
>shifted from the printers to the internet.
>Any ideas?
>Thanks again
>Andrew
>

Ah, we are getting somewhere..

I haven't gone through the lot, but two things to try:

1. type 'w32/agodot-fam' into Google.. First link I get is to Sophos.
Followed this to a page about said virus and removal tools.
Work through these to see that all has been cleared. - Especially the
services and registry keys. **Normal caveats about fiddling with the
registry. - ERD and backup, then backup again ;-)
2. Have a look through this link to the Symantec page on the same virus.
- They name it differently, but Agobot is an alias.
http://securityresponse.symantec.com/avcenter/venc/data/w32.gaobot.dx.ht
ml

HTH,
Phil Partridge
philp@pebbleGRIT.demon.co.uk
Remove the grit to reply

Andrew
Mon Jul 18 03:52:04 CDT 2005

HI
got it working but dont really know what i did, followed the instructions on
symantec, but there was nothing in the registry,downloaded a patch, kept on
rebooting then uninstalled and reinstallted the network card and all seems ok
for now.
thanks for all of your help
Andrew

"Phil Partridge" wrote:

> In article <78A01D5A-0BDB-403D-A62C-D52BE7072214@microsoft.com>, Andrew
> <Andrew@discussions.microsoft.com> writes
> >Hi
> >some interesting developments. panda scan found 16 viruses, it disinfected
> >14 and i manually deleted the other two.
> >i rebooted and when the system came back up the printers are now working,
> >but the internet is not.
> >(its as if the network cable is unplugged.) i assume that the problem has
> >shifted from the printers to the internet.
> >Any ideas?
> >Thanks again
> >Andrew
> >
>
> Ah, we are getting somewhere..
>
> I haven't gone through the lot, but two things to try:
>
> 1. type 'w32/agodot-fam' into Google.. First link I get is to Sophos.
> Followed this to a page about said virus and removal tools.
> Work through these to see that all has been cleared. - Especially the
> services and registry keys. **Normal caveats about fiddling with the
> registry. - ERD and backup, then backup again ;-)
> 2. Have a look through this link to the Symantec page on the same virus.
> - They name it differently, but Agobot is an alias.
> http://securityresponse.symantec.com/avcenter/venc/data/w32.gaobot.dx.ht
> ml
>
> HTH,
> Phil Partridge
> philp@pebbleGRIT.demon.co.uk
> Remove the grit to reply
>