administrative share of C and D drives looks suspicious

[ka]

HEllo --

just recently we've noticed that all machines on our NT4 workstation network (running off of a Novell 4.11 file and print server) have their C: and D: shared. When you log into any workstation as local Administrator, view a local drive's sharing properties, you see that the shared name is C$ and the comment is "Default share". If you click on "permissions" you get the following pop-up error: "This has been shared for administrative purposes. The permissions cannot be set." You can remove this share but it just re-appears after a reboot.

We noticed these local shares after one of our new IT staff installed a shareware program that allows one Administrative access to any NT machine on the network to change user settings, registry entries, etc (i cannot think of the name of this at the moment). This software was not approved and installed without management's knowledge.
However, removal of this "network management" software did not remove the local shares.

I'm in another regional office of ours with a similar technical setup and am now noticing the same thing. Except in this office, the IT officer/web designer has a PC full of shareware and some hideous trojan viruses! I'm wondering if these new C and D shares are also a symptom of a virus? Has anyone seen anything like this before?

..... ka

 

[AnonGod]

actually, these are not New shares at all. NT is made for business applications and networking. Default shares are setup on machines when NT sets up. all hard drives are shared, as well as an IPC$ share, and and ADMIN$ share.
Without these shares, remote administration would be a real bit*%.
Really nothing to worry about as long as you control who is put into the local admin groups on your pc's.

Good Luck!
>:O> anongod@hotmail.com

"Drawing on my fine command of language, I said nothing."

 

[dm7941]

By default, if you delete the Administrative shares, they will be recreated when you reboot. You can disable this feature by editing the registry key:

for server:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters\AutoShareServer=0

for workstation:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters\AutoShareWks=0

the registry type is REG_DWORD.
0 (disable) or 1 (enable)

That is IF you really want to remove them! David Moore
dm7941@sbc.com

 

[MasterRacker]

If you don't want to manage your network, go ahead and delete them. A better choice would be to control who is an administrator.
Jeff
masterracker@hotmail.com

If everything seems to be going well: you don't have enough information.......