microsoft related issue after migration

[kcpant]

Dear friends,

I'm glad to inform you all that I've migrated completely a setup of M$ from M$ excahnge 2000/M$ ISA 2000 to RH Linux 8.0 based SQUID & Sendmail solution with proper iptables & MailScanner setup. setup is around 100 user base.everything is working properly frm last 1 week. But I'm facing an intermittant problem, for which I'm again here to gat help from you all.the problem is, some MS outlook 2000 clients facing problem in recieving & sending mails. when I check their systems, I found MAPISP32.exe is chuking 99-100% of CPU. I have done so many things to resolve this , like, reinstalled ms office 2000, scanned pst files, copied all contents to new pst and so on...but no luck! so, friends, please help me to tackle this problem, as it would make me difficult to establish my linux solution against M$ stuff.

thanks & regards,

[Steven E. Protter]

You should next look at the maillog file in /var/log on the Linux system and see if there are errors.

I'm thinking there is some kind of failed connection that is being tried over and over again. It could have to do with Linux security, permissions of iptables settings.

Or it could be a Microsoft enhancement designed to stop people from doing what you are doing.

SEP

[kcpant]

hi steven,
I haven't found any error in maillog. the problem , as I said , is intermittant. those clients were able to send mails before, but suddenly it started hapening they could not able to send/recieve. I 've checked systems for virus/spy but not found anything. only 4-5 systems out of 60 are creating this kind of problem...
please help to solve it...

[Steven E. Protter]

You've done spyware and virus checks.

What about the event logs on the affected systems?

There may be clues there as to the problem.

Have you done the microsoft update and gotten these systems current with thelatest microsoft security fixes. If they are XP they must have Service Pack 2 installed to be safe.

To help you further I need more data.

You may want to check with network administration and see if there are funky settings on the switch these users are connected to.

Sherlock Holmes time.Try and find a common factor, a hub, a firewall, an ip subnet, something to make this possible.

Alternately if you have a standard microsoft install image, re-image the workstations.

SEP

[kcpant]

hi steven,

I found on cheking the systems with latest spy sweeper , that spy infection is present there. thanks for your suggestions.

[Nobody's Hero]

We have been experiencing a major problem in our network that has the symptoms you are experiencing. Take a look under c:/winnt/system32 and see if there is an IEXPLORER.EXE. If you see it, it probably is killing the system by making the box busy. We had to get all security and IE updates in safe mode, delete the IEXPLORER.EXE file and clean the registry. I can post the cleanup and fix if you need more info.

[Nobody's Hero]

If you are running win2k, you may need to go to SP4. This explorer worm will spread through your network and clobber any pc without the proper updates and SP level.

[kcpant]

closing thread