TechSpot

Strange folders in network places appear

By D@nny
Mar 24, 2007
  1. I went from just folder name : SharedDocs on Cerion's PC (Cp331908-a) now its a new folder along with that one : Documentos c on VERO (Veronica) . I'm really scared how is this happening who is doing this to me and how can I tell for sure if I'm connected to another computer. I have everything[i think] disabeled for sharing. Actually probably not but regardless how is this happening . And does anyone know how to over ride this stupid error message i get when workgroup is trying to be accessed from network places? The error doesn't come up anymore like it used to be when I access workgroup places i just see my computers id in their. No other computers. Is it possible that they can be hidden or does this mean there is no other computer connected to mine some how with the router I use.
     
  2. jobeard

    jobeard TS Ambassador Posts: 9,330   +622

    first step is to DISABLE FILE SHARING and in your firewall, disable all exceptions.

    describe your setup.
    is it a wired lan, wireless, or a mix of both?
    which firewall are you using?
     
  3. D@nny

    D@nny TS Rookie Topic Starter Posts: 176

    no firewall its over a dlink router. How do I disable firesharing over my firewall and I disable C$ file sharing but it says after every reboot it will re enable its self. How do I disable firesharing over windows firewall? Also why do you think those network places are popping up?
     
  4. jobeard

    jobeard TS Ambassador Posts: 9,330   +622

    You're running to fast here, one step at at time.
    First ignore the router.
    Second, cp->Windows Firewall (assuming this is the one you're using)
    click on and Don't Allow Exceptions. This will BLOCK ALL file/print sharing.

    To control the shares, you must be logged in as Admin. Then
    cp->Admin Tools->Computer Mgmt
    Expand System Tools and then Shared Folders, click on Shares
    ALL Your shares are shown.
    "Note A dollar sign ($) appears after the name of the share on every volume on your computer that is shared. These shares are hidden administrative shares that you cannot modify."


    FOR XP/Pro, you can control the shares with this article
    but that doesn't work for XP/Home.

    Turning on and turning off Simple File Sharing
    Simple File Sharing is always turned on in Windows XP Home Edition-based computers. By default, the Simple File Sharing UI is turned on in Windows XP Professional-based computers that are joined to a workgroup. Windows XP Professional-based computers that are joined to a domain use only the classic file sharing and security interface. When you use the Simple File Sharing UI (that is located in the folder's properties), both share and file permissions are configured.
     
  5. D@nny

    D@nny TS Rookie Topic Starter Posts: 176

    oK well I had already discovered about disabling simple file sharing . How ever in administrative tools what does the $ dollar sign mean in less complex terms. Someone else told me it was just like a wildcard symbol err...where it designates to what drive should be in C's place even if you named it something else it will still point to that drive. Well I disabled C$ and D$ but you said I can't modify them. So no matter what I do i'm basically screwed into sharing it or does not sharing C$ and D$ actually help me out?
     
  6. jobeard

    jobeard TS Ambassador Posts: 9,330   +622

    It is unwise to share the whole C:\ or any other volume -- instead only
    share folders, specifically folders within \Documents and Settings.

    Shares ending in $ are system shares and not under your control.
    The home LAN user will never access using these shares.
     
  7. D@nny

    D@nny TS Rookie Topic Starter Posts: 176

    yeah I don't want to share any folders. Lol. Also what does use the C$ function? Could disabling it mess up programs that run in C:? New network appeared in network places , the old ones are not appearing ,created at 8:20 today. Name FRH-C2411FC4928 whats inside? a ini file for a game a game file for a diffirent game some registry entry for a game and a GSRouters.dat file. Also I did 3 scans search and destroy , superantispyware , and ad-aware 6.0 to scan for keyloggers. my internet connection firewall for local area connection is on and disabled others to connect to my computer through a network. Can someone explain to me why i'm seeing strange network folders appear in network places with random junk?
     
  8. zef

    zef TS Rookie

    "Shares ending in $ are system shares and not under your control.
    The home LAN user will never access using these shares."

    Clearly you have a complete lack of understanding about networking protocol. having a $ after a share simply makes in invisible ie: you can't see it by connecting to a system, to access it you need to type the full path. It does not imply ownership or permissions at all.
     
  9. D@nny

    D@nny TS Rookie Topic Starter Posts: 176

    oh okay thanks for clearing that up!
    I'm still looking for an explanation as too why it seems almost everyday strange network places like these appear folders I can't access and have no idea where there naming come from keep popping up why is this? http://img138.imageshack.us/img138/2276/dsafdsafdr2.png
    And can it be a sign that someone else is still accessing my computer over a lan network like microsoft windows network which also has strange workgroups in it like 4 of them with names like smallbusiness and the usual mshome. Does having these indicate a possible sign of people on the other side of this network to access me?
     
  10. zef

    zef TS Rookie

    Is it possible they are old shared folders from when another system was connected to your network? Windows has funny ideas about auto detecting shares and only ridding itself of them after a certain amount of times it cant be found. There is a manual way to remove any old shares but i cant recall it and google is being uncooperative.

    If that is not the case and you have a wireless router then I would look to it as a possible security risk, if you are not using the wireless functionality login to it and disable the wireless component, also remove the aerial(s) if you are paranoid. Note that the shares wont go away immediately however.

    Before and after removing wireless access it is advisable to do a "net view" in the command prompt to see what computers are detected on your workgroup.
    If you see "\\EMRE" in addition to \\[yourcomputername] then EMRE is active on your network. remove wireless and repeat, if you no longer see EMRE then he is not on your network and you need to either keep wireless disabled or secure it up.

    **EDIT**

    After re reading your post it is almost certain your network security has been breached, disable wifi or enable some serious security on your router. WEP does not count as security, WAP and Mac address filtering at the very least is advisable.
     
  11. D@nny

    D@nny TS Rookie Topic Starter Posts: 176

    I don't use a wireless network but maybe someone around here is and is hacking into me? But also how do I view netview in cmd? Can you be more specific as too how I can stop this? Will disabling the share ICP$ do anything or is that not under my control like C$ and D$ shares. I read somewhere theres an ICP$ exploit that people use to access other computers files? Is this credible?
    I'm pretty sure someone has hacked into my network also underwork group theres this computer named Cherry-stringofnumbers :( What the **** is going on! How do I get rid of this whole mess!
     
  12. jobeard

    jobeard TS Ambassador Posts: 9,330   +622

    just use your browser to access the router and DISABLE wireless.
    ShareNames$ with an ending '$' ARE NOT UNDER YOUR CONTROL, eg
    ICP$ C$ D$ so just stop fussing with them

    To remove fileshares you dislike, use My Computer, right-click the share to be deleted, and pull down to DISCONNECT
     
  13. D@nny

    D@nny TS Rookie Topic Starter Posts: 176

    well that's nice to know but none OF THE SHARES IN Microsoft Windows Network have a disconnect option... Zeroping Doma smsnet all these new workgroup or shares whatever they are they keep appearing why?
     
  14. zef

    zef TS Rookie

    Stop giving incorrect information. Just because it ends in a $ does not mean it is not under your control (see my first post). And unless I am very much mistaken default system shares can be modified if you know what you are doing.

    D@nny, answer this question with a YES or NO: Does your router have wireless capabilities? (ie: does it have an aerial)
     
  15. D@nny

    D@nny TS Rookie Topic Starter Posts: 176

    No I'm not using a wireless router.
    SharedDocs on Sale (Salecomp) a new folder now in my network places and under Microsoft Windows Network has a workshare called group 1 that I can't access. I can't access the sharesdoc folder or the workgroup/share. I don't understand how the folders under my network places keep appearing with different names every time. Could it be someone with a wireless router is doing all this unintentionally, or worse intentionally for some reason?
     
  16. jobeard

    jobeard TS Ambassador Posts: 9,330   +622

    humm; I referencing the XP/Home user. XP/Pro can do special operations
    with xxx$ shares as these are intended for Admins on Domain Controlled system. The HOME user has no control of these whatsoever.
     
  17. D@nny

    D@nny TS Rookie Topic Starter Posts: 176

    since more different network places folders are appearing in my network places and I still can't find a way to stop it what can I assume the other computer is trying to do? Hack into me using these shares? It would be sort of understandable if I was using a wireless connection but since I'm not can someone take a guess at this phenomenon?
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...