Strange folders in network places appear

[D@nny]

I went from just folder name : SharedDocs on Cerion's PC (Cp331908-a) now its a new folder along with that one : Documentos c on VERO (Veronica) . I'm really scared how is this happening who is doing this to me and how can I tell for sure if I'm connected to another computer. I have everything[i think] disabeled for sharing. Actually probably not but regardless how is this happening . And does anyone know how to over ride this stupid error message i get when workgroup is trying to be accessed from network places? The error doesn't come up anymore like it used to be when I access workgroup places i just see my computers id in their. No other computers. Is it possible that they can be hidden or does this mean there is no other computer connected to mine some how with the router I use.

 

[DelJo63]

first step is to DISABLE FILE SHARING and in your firewall, disable all exceptions.

describe your setup.
is it a wired lan, wireless, or a mix of both?
which firewall are you using?

 

[D@nny]

no firewall its over a dlink router. How do I disable firesharing over my firewall and I disable C$ file sharing but it says after every reboot it will re enable its self. How do I disable firesharing over windows firewall? Also why do you think those network places are popping up?

 

[DelJo63]

no firewall its over a dlink router.
How do I disable firesharing over my firewall and I disable C$ file sharing but it says after every reboot it will re enable its self.
How do I disable firesharing over windows firewall?
Also why do you think those network places are popping up?

You're running to fast here, one step at at time.
First ignore the router.
Second, cp->Windows Firewall (assuming this is the one you're using)
click on and Don't Allow Exceptions. This will BLOCK ALL file/print sharing.

To control the shares, you must be logged in as Admin. Then
cp->Admin Tools->Computer Mgmt
Expand System Tools and then Shared Folders, click on Shares
ALL Your shares are shown.
"Note A dollar sign ($) appears after the name of the share on every volume on your computer that is shared. These shares are hidden administrative shares that you cannot modify."


FOR XP/Pro, you can control the shares with this article
but that doesn't work for XP/Home.

If you turn off Simple File Sharing (in XP/Pro), you have more control over the permissions to individual users. However, you must have advanced knowledge of NTFS and share permissions to help keep your folders and files more secure. If you turn off Simple File Sharing, the Shared Documents feature is not turned off.

To turn Simple File Sharing on or off in Windows XP Professional, follow these steps:
1. Double-click My Computer on the desktop.
2. On the Tools menu, click Folder Options.
3. Click the View tab, and then select the Use Simple File Sharing (Recommended) check box to turn on Simple File Sharing. (Clear this check box to turn off this feature.)

Turning on and turning off Simple File Sharing
Simple File Sharing is always turned on in Windows XP Home Edition-based computers. By default, the Simple File Sharing UI is turned on in Windows XP Professional-based computers that are joined to a workgroup. Windows XP Professional-based computers that are joined to a domain use only the classic file sharing and security interface. When you use the Simple File Sharing UI (that is located in the folder's properties), both share and file permissions are configured.

 

[D@nny]

You're running to fast here, one step at at time.
First ignore the router.
Second, cp->Windows Firewall (assuming this is the one you're using)
click on and Don't Allow Exceptions. This will BLOCK ALL file/print sharing.

To control the shares, you must be logged in as Admin. Then
cp->Admin Tools->Computer Mgmt
Expand System Tools and then Shared Folders, click on Shares
ALL Your shares are shown.
"Note A dollar sign ($) appears after the name of the share on every volume on your computer that is shared. These shares are hidden administrative shares that you cannot modify."


FOR XP/Pro, you can control the shares with this article
but that doesn't work for XP/Home.



Turning on and turning off Simple File Sharing
Simple File Sharing is always turned on in Windows XP Home Edition-based computers. By default, the Simple File Sharing UI is turned on in Windows XP Professional-based computers that are joined to a workgroup. Windows XP Professional-based computers that are joined to a domain use only the classic file sharing and security interface. When you use the Simple File Sharing UI (that is located in the folder's properties), both share and file permissions are configured.

oK well I had already discovered about disabling simple file sharing . How ever in administrative tools what does the $ dollar sign mean in less complex terms. Someone else told me it was just like a wildcard symbol err...where it designates to what drive should be in C's place even if you named it something else it will still point to that drive. Well I disabled C$ and D$ but you said I can't modify them. So no matter what I do i'm basically screwed into sharing it or does not sharing C$ and D$ actually help me out?

 

[DelJo63]

It is unwise to share the whole C:\ or any other volume -- instead only
share folders, specifically folders within \Documents and Settings.

Shares ending in $ are system shares and not under your control.
The home LAN user will never access using these shares.

 

[D@nny]

yeah I don't want to share any folders. Lol. Also what does use the C$ function? Could disabling it mess up programs that run in C:? New network appeared in network places , the old ones are not appearing ,created at 8:20 today. Name FRH-C2411FC4928 whats inside? a ini file for a game a game file for a diffirent game some registry entry for a game and a GSRouters.dat file. Also I did 3 scans search and destroy , superantispyware , and ad-aware 6.0 to scan for keyloggers. my internet connection firewall for local area connection is on and disabled others to connect to my computer through a network. Can someone explain to me why i'm seeing strange network folders appear in network places with random junk?

 

[zef]

"Shares ending in $ are system shares and not under your control.
The home LAN user will never access using these shares."

Clearly you have a complete lack of understanding about networking protocol. having a $ after a share simply makes in invisible ie: you can't see it by connecting to a system, to access it you need to type the full path. It does not imply ownership or permissions at all.

 

[D@nny]

oh okay thanks for clearing that up!
I'm still looking for an explanation as too why it seems almost everyday strange network places like these appear folders I can't access and have no idea where there naming come from keep popping up why is this? http://img138.imageshack.us/img138/2276/dsafdsafdr2.png
And can it be a sign that someone else is still accessing my computer over a lan network like microsoft windows network which also has strange workgroups in it like 4 of them with names like smallbusiness and the usual mshome. Does having these indicate a possible sign of people on the other side of this network to access me?

 

[zef]

Is it possible they are old shared folders from when another system was connected to your network? Windows has funny ideas about auto detecting shares and only ridding itself of them after a certain amount of times it cant be found. There is a manual way to remove any old shares but i cant recall it and google is being uncooperative.

If that is not the case and you have a wireless router then I would look to it as a possible security risk, if you are not using the wireless functionality login to it and disable the wireless component, also remove the aerial(s) if you are paranoid. Note that the shares wont go away immediately however.

Before and after removing wireless access it is advisable to do a "net view" in the command prompt to see what computers are detected on your workgroup.
If you see "\\EMRE" in addition to \\[yourcomputername] then EMRE is active on your network. remove wireless and repeat, if you no longer see EMRE then he is not on your network and you need to either keep wireless disabled or secure it up.

**EDIT**

After re reading your post it is almost certain your network security has been breached, disable wifi or enable some serious security on your router. WEP does not count as security, WAP and Mac address filtering at the very least is advisable.

 

[D@nny]

Is it possible they are old shared folders from when another system was connected to your network? Windows has funny ideas about auto detecting shares and only ridding itself of them after a certain amount of times it cant be found. There is a manual way to remove any old shares but i cant recall it and google is being uncooperative.

If that is not the case and you have a wireless router then I would look to it as a possible security risk, if you are not using the wireless functionality login to it and disable the wireless component, also remove the aerial(s) if you are paranoid. Note that the shares wont go away immediately however.

Before and after removing wireless access it is advisable to do a "net view" in the command prompt to see what computers are detected on your workgroup.
If you see "\\EMRE" in addition to \\[yourcomputername] then EMRE is active on your network. remove wireless and repeat, if you no longer see EMRE then he is not on your network and you need to either keep wireless disabled or secure it up.

**EDIT**

After re reading your post it is almost certain your network security has been breached, disable wifi or enable some serious security on your router. WEP does not count as security, WAP and Mac address filtering at the very least is advisable.

I don't use a wireless network but maybe someone around here is and is hacking into me? But also how do I view netview in cmd? Can you be more specific as too how I can stop this? Will disabling the share ICP$ do anything or is that not under my control like C$ and D$ shares. I read somewhere theres an ICP$ exploit that people use to access other computers files? Is this credible?
I'm pretty sure someone has hacked into my network also underwork group theres this computer named Cherry-stringofnumbers What the **** is going on! How do I get rid of this whole mess!

 

[DelJo63]

I don't use a wireless network but maybe someone around here is and is hacking into me?

just use your browser to access the router and DISABLE wireless.

But also how do I view netview in cmd?
Can you be more specific as too how I can stop this? Will disabling the share ICP$ do anything or is that not under my control like C$ and D$ shares.
I read somewhere theres an ICP$ exploit that people use to access other computers files?

ShareNames$ with an ending '$' ARE NOT UNDER YOUR CONTROL, eg
ICP$ C$ D$ so just stop fussing with them

To remove fileshares you dislike, use My Computer, right-click the share to be deleted, and pull down to DISCONNECT

 

[D@nny]

well that's nice to know but none OF THE SHARES IN Microsoft Windows Network have a disconnect option... Zeroping Doma smsnet all these new workgroup or shares whatever they are they keep appearing why?

 

[zef]

just use your browser to access the router and DISABLE wireless.

ShareNames$ with an ending '$' ARE NOT UNDER YOUR CONTROL, eg
ICP$ C$ D$ so just stop fussing with them

To remove fileshares you dislike, use My Computer, right-click the share to be deleted, and pull down to DISCONNECT

Stop giving incorrect information. Just because it ends in a $ does not mean it is not under your control (see my first post). And unless I am very much mistaken default system shares can be modified if you know what you are doing.

D@nny, answer this question with a YES or NO: Does your router have wireless capabilities? (ie: does it have an aerial)

 

[D@nny]

No I'm not using a wireless router.
SharedDocs on Sale (Salecomp) a new folder now in my network places and under Microsoft Windows Network has a workshare called group 1 that I can't access. I can't access the sharesdoc folder or the workgroup/share. I don't understand how the folders under my network places keep appearing with different names every time. Could it be someone with a wireless router is doing all this unintentionally, or worse intentionally for some reason?

 

[DelJo63]

Stop giving incorrect information. Just because it ends in a $ does not mean it is not under your control (see my first post). And unless I am very much mistaken default system shares can be modified if you know what you are doing.

humm; I referencing the XP/Home user. XP/Pro can do special operations
with xxx$ shares as these are intended for Admins on Domain Controlled system. The HOME user has no control of these whatsoever.

 

[D@nny]

since more different network places folders are appearing in my network places and I still can't find a way to stop it what can I assume the other computer is trying to do? Hack into me using these shares? It would be sort of understandable if I was using a wireless connection but since I'm not can someone take a guess at this phenomenon?