Is this the symptom of worm activities in a network?

[treysha]

Hi,
My problem is a little complicated.

Since last week, my office network seemed to get slower and slower with each passing day. It got worse and worse each day, so bad that even network printing seems to take ages. Internet connectivity is so slow its frustrating.

Looking at my network switches I can see quite a lot of broadcasts going on in the network (based on the blinking lights). I checked with Ethereal and, indeed, there were a lot of ARP broadcasts going on (about 7-15% of the total data transactions). Problem was, the broadcasts were coming from random PCs in the office! I tried listing down the source IPs but found myself listing ALMOST ALL the IPs in the office.

Thinking it was the work of worms, viruses or spywares, I worked overnight and cleaned EVERY SINGLE PC in the office. I used updated versions of Stinger, Trendmicro free virus scanner, and Spybot Search & Destroy to carefully clean each PC. Sadly, even this does not seem to solve the issue. I still see ARP broadcasts and the network is STILL very slow.

Can someone PLEASE advise me what to do... I'm at my wits end.

[CuratoR]

Have you got a good firewall installed?
What operating system does those pc runs? Are they well patched?
Plzz, try to identify any suspicious processes, opening connections outside.
Monitor TCP connections. It maybe be worms/viruses/trojans or may even be intruders trying ARP poison routing. It maybe be something else though.
What happens when the network is not connected to the internet? Does the network remains slow?

[Budfred]

There are a number of things that will not show up on the scans you ran.... I suggest doing a HijackThis scan and posting it here for analysis...

To run HJT, extract it to a permanent folder such as one
you create like C:\HJT. Close all open windows and
browsers and make sure that all programs are enabled if
you use msconfig. Run it and Scan, then Save the log.
When the log window appears, Right click to Copy it, open
your browser and come here to Paste the entire log. Do
not make any changes until it is checked since most items
are either benign or essential to the computer.

http://www.subratam.org/?page=removal

There may be other deeper scans necessary, but this is a good way to check for the obvious...

[treysha]

But I have more than 50 stations on my network. Can possibly post all the HJT logs here?

[Budfred]

Just post one from a computer that you think has whatever infection might be there so we can look at the log and see if there is anything there... If it is infecting all the computers, you can use whatever fix is needed on all of them or you may even be able to do it with some sort of network based fix...