RE: Unknown workgroup in Microsoft Windows Network

From: David Vincent (david.vincent@mightyoaks.com)
Date: 11/13/02 

From: David Vincent <david.vincent@mightyoaks.com>
To: "'gary_palmer@attbi.com'" <gary_palmer@attbi.com>, focus-ms@securityfocus.com
Date: Tue, 12 Nov 2002 22:00:16 -0800

if you're running a WINS server i'd have a look at that database.

-d

-----Original Message-----
From: gary_palmer@attbi.com [mailto:gary_palmer@attbi.com]
Sent: Tuesday, November 12, 2002 1:13 PM
To: focus-ms@securityfocus.com
Subject: Unknown workgroup in Microsoft Windows Network

Recently a new workgroup name appeared in our organizations "Network
Neighborhood > Microsoft Windows Network" The workgroup or domain is
called "Gotcha." Not a particularly pleasing name for a workgroup.

Having verified that no staff members have plugged in new hardware recently,

and verifying that there are no unauthorized logins to our wireless network,

I'm somewhat at a loss to explain this. I found information on an SMB hack
that, as a side-effect causes a rogue workgroup to show up in Network
Neighborhood in order to sniff cleartext passwords from Windows 95 machines,

but our firewall blocks ports 137 and 139, and there's nothing unusual in
the
firewall logs.

My question is this--what's the best way to track down an IP address
associated with a domain or workgroup listing in Network Neighborhood. Is
this
possible? This would at least give me an idea of where on the physical
network
this is coming from. Does anyone have recommendations on tracing this
problem?

Thank you,

Gary 

--
gpalmer@attbi.com

Relevant Pages

  • Re: Network Neighborhood
    ... > inability to browse by using Network Neighborhood in Windows 95 or Windows ... > communicated effectively with the other workgroup computers. ... > not have a common networking protocol, a common workgroup, and common user ... the computer that is running Windows ...
    (microsoft.public.win2000.networking)
  • Re: WindowsXP and RISC OS computers
    ... >> - You can however ping Nixiyo from the windows XP machine, ... > workgroup: WORKGROUP ... > Name as M$ calls it, had been changed on the centrex machine. ... > Neither icon appears in My Network Places on the centrex. ...
    (comp.sys.acorn.networking)
  • clarification sought in using XP Pro laptop for domain at work and workgroup at home
    ... I am inquiring for a friend. ... The XP Pro laptop was once configured for a two-computer workgroup. ... "WORKGROUP" as the name of its network affiliation. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Setting up a network using XP and Vista
    ... In XP I have gone to Network Set Up Wizard the default Workgroup is MSHOME. ... a misconfigured firewall or overlooked firewall (including a stateful ...
    (microsoft.public.windowsxp.general)
  • Re: Networks : Workgroups and Domains. How Do I Use Them?
    ... I think the problem is from my lack of understanding whether these machines are together as a workgroup or domain. ... If I want to configure solely for a workgroup network, then I would think I do not need to provide a domain name, and vice versa for a domain network. ... It's not clear whether any of your computers is running Windows 2000 *Server.* If not, you don't have a "domain" and shouldn't be using domain names. ... Problems sharing files between computers on a network are generally caused by 1) a misconfigured firewall or overlooked firewall; or 2) inadvertently running two firewalls such as the built-in Windows Firewall and a third-party firewall; and/or 3) not having identical user accounts and passwords on all Workgroup machines; 4) trying to create shares where the operating system does not permit it. ...
    (microsoft.public.windowsxp.network_web)