Dupicate network connections (Long Post) 2

[damhna]

I'm running NT 4, SP-4 attached to a NT domain. Don't have a log-on script nor perm. connections to any of the network drives. Occasionally I will map to a network drive, but leave the reconnect at login unchecked. When I need to connect to a network drive, I either map it or go thru explorer to connect.<br>
Problem is: Duplicate network drives keep showing up on my computer, assigning all the availble drive letters to network drives that I have mapped to in the past. I have drives C:, D: & E: on my machine and the new drives will take up F: - Z: plus will list a couple of connections as (none) with a connection attached. I can access any resource attached to any of the drive letters.<br>
<br>
I have used the NET USE /delete command and also disconnectd from all the network drives from inside explorer. Throughout the day, the connections reappear.<br>
<br>
<br>
tried

 

[jsauce]

Wow that is a weird one. Could someone be messing with you, maybe using PC Anywhere or something to that effect?

 

[Zelandakh]

NT Workstation or server - silly question to some, but you never know...<br>
<br>
Check access rights from the network. Sounds like someone is playing about. Check your system tray for odd icons, check your startup folder and look for a file with the name of &lt;space&gt; (a space) .exe in your windows folder. If you find it, delete it.<br>

 

[damhna]

Not a possibility<br>
Happening oon a quite a few machines and I've used poledit to restrict the applications my users can run. No outside interference possible.<br>
Other things I've tried<br>
:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes has nothing<br>
I checked the registry, nothing loaded in persistant connections. I have logged on as local administrator, network administrator and myself, (I have complete administrative rights). The only protocols I have loaded are TCP/IP & NetBUI, bound in that order.

 

[damhna]

Ive checked for shortcuts and anything that might prompt an automatic connection.<br>
I've made sure the command scheduler isnt running anything I dont know about and I'm completely flummoxed

 

[jsauce]

This sounds like a bit of trickery. If this is happening on several machines, I think the odds support it. Check HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN<br>
make sure there is nothing in there you don't know about. Also load task manager and see what is running in the processes, see if there is anything suspicious.<br>
<br>
As I said before, sounds like trickery. <p>John D. Saucier<br><a href=mailto:jsauce@net1plus.com>jsauce@net1plus.com</a><br><a href=

http://www.net1plus.com/users/jsauce>Registry

Backup</a><br>Check out my site for information on the Windows Registry, and a program I have written to help back it up.

 

[damhna]

Tried there but to no avail.<br>
There are no untoward programsand I've already denied access to any registry editoing tools or foreign apps.<br>
<br>
I appreciate any input you can give me on how to identify and track down any malicious user