0

Coming into work today, I've found we have a few different computers (different companies/networks/OS versions - all windows based) that are all having the same issue.

1) Network NIC is not able to be viewed from network connections. If you refresh, its saying the service is not started. Services state the service is started and running.

2) USB devices are not recognized when plugged in, scan for hardware changes, etc.

We have managed AV, that is kept up to date, and a managed patch policy that has all these machines at the most recent patch.

I'm just wondering if anyone else has experienced these same symptoms, and what they have done to resolve them.

Updates:

11:23 AM - The issues are spreading, and things are progressively getting worse. Services are starting to shut down (windows installer, etc), ports are getting blocked. Rebooting into safe mode (w/ networking) still has these issues.

Patches: No patches went through last night.

Managed AV (McAfee): Nothing new from this point. This was un-installed and we still had the issues. No policy changes as far as blocking network access or other have been enabled.

Scanning: We've scanned with malwarebytes, the MS installer service shutdown before we could install any other software. Nothing came up in the scan.

Connections: Netstat showed no outgoing connections to any other machines, other than what was expected.

We are working remotely on a site that is 150 miles away. We have some IT staff on site, but so far nothing. What a great Thursday. :)

MJ.
  • 191
  • 3
  • 12

3 Answers3

1

You didn't say what your AV software is but if you are using SEP11 (Symantec Endpoint Protection) you may have set a policy to disable certain device classes. If you have a different security product it may have similar options. In SEP11 you will find this under Policies->"Application and Device Control" in the Management Console.

Matthew
  • 174
  • 5
  • +1 @Matthew Good thought Have seen that in our test environment. Too agressieve a policy applied and things stopped working – Dave M Mar 25 '10 at 17:39
0

Have you scanned for malware with Sopybot, Adaware, malwarebytes or other tools?

Dave M
  • 4,494
  • 21
  • 30
  • 30
0

Here are the steps I would take if I had this problem: Check for recent changes - did a patch get applied recently to the OS or other application? Did a configuration setting get changed recently? Check the event logs - any errors, warnings, or new event types start popping up recently? Run spyware scans with multiple products and do manual checking for running programs using HijackThis! or similar.

Matthew
  • 174
  • 5