Security Incidents mailing list archives
RE: SPM2000$ Rouge Share
From: Harlan Carvey <keydet89 () yahoo com>
Date: Tue, 18 Mar 2003 12:50:29 -0800 (PST)
Jon,
If I go to the management console> shared folders> shares> Right-click and properties> I get the following: "This has been shared for administrative purposes. The share permissions and file security cannot be
set."
When I got into that same interface, I see a column next to the shared folder called "Path". What does it say in the case of this SPM2000$ share? When you see the dialogue box you describe above, and click on "Ok", you should see a Properties dialogue box. Is there any information there, perhaps under Path or Comment, that might be of use? What other shares are available in the main console window? Are there any sessions or open files?
However, I'm not able to reboot the server at this time as it's currently in production, so the reoccurrence of the share is simply an assumption.
Okay, just wanted to be clear on that. It's important to separate assumptions from facts when dealing w/ incidents.
I'd just like to know why this share exists.
Okay, that's a little different from what your original post stated. Without knowing more about what applications are installed, or have been installed and since removed, it's kind of hard to tell. Maybe someone out there will have seen this exact issue before, and be able to answer authoritatively and accurately. Aside from that, though, w/o knowing more about how the systems are set up and following basic troubleshooting procedures, anything else you get from the list is likely to be speculation. Have you looked into the issue any further? Harlan __________________________________________________ Do you Yahoo!? Yahoo! Platinum - Watch CBS' NCAA March Madness, live on your desktop! http://platinum.yahoo.com ---------------------------------------------------------------------------- <Pre>Lose another weekend managing your IDS? Take back your personal time. 15-day free trial of StillSecure Border Guard.</Pre> <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>
Current thread:
- SPM2000$ Rouge Share Robinson, Jonathon (Mar 18)
- Re: SPM2000$ Rouge Share Harlan Carvey (Mar 19)
- <Possible follow-ups>
- RE: SPM2000$ Rouge Share Robinson, Jonathon (Mar 19)
- RE: SPM2000$ Rouge Share Robinson, Jonathon (Mar 19)
- RE: SPM2000$ Rouge Share Harlan Carvey (Mar 19)
- RE: SPM2000$ Rouge Share Jonathan Rickman (Mar 19)