RE: SPM2000$ Rouge Share

From: Harlan Carvey (keydet89@yahoo.com)
Date: 03/18/03

  • Next message: Jonathan Rickman: "RE: SPM2000$ Rouge Share" 
    Date: Tue, 18 Mar 2003 12:50:29 -0800 (PST)
From: Harlan Carvey <keydet89@yahoo.com>
To: "'incidents@securityfocus.com'" <incidents@securityfocus.com>

    Jon,
     
    > If I go to the management console> shared folders>
    > shares> Right-click and
    > properties> I get the following:
    >
    > "This has been shared for administrative purposes.
    > The share permissions and file security cannot be
    set."
    >

    When I got into that same interface, I see a column
    next to the shared folder called "Path". What does it
    say in the case of this SPM2000$ share?

    When you see the dialogue box you describe above, and
    click on "Ok", you should see a Properties dialogue
    box. Is there any information there, perhaps under
    Path or Comment, that might be of use?
     
    What other shares are available in the main console
    window? Are there any sessions or open files?

    > However, I'm not able to reboot the server at this
    > time as it's currently in
    > production, so the reoccurrence of the share is
    > simply an assumption.

    Okay, just wanted to be clear on that. It's important
    to separate assumptions from facts when dealing w/
    incidents.
     
    > I'd just like to know why this share exists.

    Okay, that's a little different from what your
    original post stated.

    Without knowing more about what applications are
    installed, or have been installed and since removed,
    it's kind of hard to tell. Maybe someone out there
    will have seen this exact issue before, and be able to
    answer authoritatively and accurately. Aside from
    that, though, w/o knowing more about how the systems
    are set up and following basic troubleshooting
    procedures, anything else you get from the list is
    likely to be speculation.

    Have you looked into the issue any further?

    Harlan

    __________________________________________________
    Do you Yahoo!?
    Yahoo! Platinum - Watch CBS' NCAA March Madness, live on your desktop!
    http://platinum.yahoo.com

    ----------------------------------------------------------------------------

    <Pre>Lose another weekend managing your IDS?
    Take back your personal time.
    15-day free trial of StillSecure Border Guard.</Pre>
    <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>

  • Next message: Jonathan Rickman: "RE: SPM2000$ Rouge Share"