Drive Sharing and Windows 2000

[dolemitecomputer]

I have had this problem for the last few months and can't seem to solve it. In windows it shows that all my drives are setup for sharing. If I change the setting to not share the drives and reboot they come back as sharing. I have Client for Microsoft networks and file/printer sharing disabled as well as NETBIOS for my network card but can't seem to solve this. Is it a service I need running or something that is disabled?

[samuknow]

I will check this out when I get home. Let you know what I find out.....

[Maddman]

Have you tried to access them remotly to see if they are accessable. with out the network protocols setup they shouldn't be accessable even if they are shared in windows explorer.

[Kingslayer]

When you activate sharing it assigns the drive a default share. If you name it something else, it will cache the default share, and use what you have named that particular drive. Right click on the drive and go to sharing, in that window you will see a drop down box, one at a time, set them and hit delete share.

This should rid the system of all cache shared and credentials and take away the little blue hand.

[dolemitecomputer]

Originally posted by Kingslayer
When you activate sharing it assigns the drive a default share. If you name it something else, it will cache the default share, and use what you have named that particular drive. Right click on the drive and go to sharing, in that window you will see a drop down box, one at a time, set them and hit delete share.

This should rid the system of all cache shared and credentials and take away the little blue hand.


That doesn't work because the default name is (for example) $C or $D. Windows does not allow me to delete that. Even if I disable the caching and then disable the file sharing they come back as being shared. Grrrr. This is bugging me.

[Kingslayer]

You say you are rebooting and they come back as shared. Is your computer shutting down properly?

If it's not shutting down properly it wont save the settings and this could be the reason you see it shared when you come back.

[dolemitecomputer]

Originally posted by Kingslayer
You say you are rebooting and they come back as shared. Is your computer shutting down properly?

If it's not shutting down properly it wont save the settings and this could be the reason you see it shared when you come back.

I will try shutting down again but I have tried it before. I will do it again and see what happens.

[Kingslayer]

Make sure you see the "Saving user settings" window, and that it shuts down and boots properly. Also see if you are getting any BSOD errors on shut down.

[dolemitecomputer]

Originally posted by Kingslayer
Make sure you see the "Saving user settings" window, and that it shuts down and boots properly. Also see if you are getting any BSOD errors on shut down.


I did that and made sure that it does say something like "saving settings". It did shutdown fine but comes back as having not just one but all drives being shared. I have used Windows 2000 for almost a year but have never really had this problem.

[Kingslayer]

When did this start happening? One of the properties of CodeRed, CodeBlue, and Nimda were transmitting through shared drives. They have thier own email clients, wouldnt suprise me if they can share their own drives either.

[Kingslayer]

I just read your other post about not being able to close port 135. And if you close it you can't boot into windows.

This is another property of CodeRed/Blue and Nimda.
Another possibility is that you have been hacked. RPC port 135 is a method that hackers use to gain access and remotely control your computer. There are other viruses that use 135 in order for your computer to be used to spoof someone.

[dolemitecomputer]

Originally posted by Kingslayer
I just read your other post about not being able to close port 135. And if you close it you can't boot into windows.

This is another property of CodeRed/Blue and Nimda.
Another possibility is that you have been hacked. RPC port 135 is a method that hackers use to gain access and remotely control your computer. There are other viruses that use 135 in order for your computer to be used to spoof someone.

I doubt I have a virus but I do have a packet sniffer program and I will let that run all day to see if anything is coming or going from port 135. The funny thing is even in windows 98 I have that port open. I have my drive dual booted and I never use windows 98 at all.

[dolemitecomputer]

I fixed the drive sharing problem. wOOT! :D Even though file and print sharing in the network properties was unchecked I went ahead and uninstalled it and client for microsoft networks. Once I rebooted now the file sharing option for every drive is completly gone. I still have port 135 open but for the few minutes I ran my packet sniffer program nothing was coming or going from it.

[Kingslayer]

Check your system.ini file on your win2k drive and see if there is anything out of the ordinary in there. It's one of the easiest ways to spot Nimda.

[dolemitecomputer]

Originally posted by Kingslayer
Check your system.ini file on your win2k drive and see if there is anything out of the ordinary in there. It's one of the easiest ways to spot Nimda.

I did and nothing looks unusual. Seems pretty normal.

[Kingslayer]

Good, now check your registry. HKEY_LOCAL_MACHINE, Software, and see if there is a SirCam folder in there, if not your clean.