SPM2000$ Rouge Share

From: Robinson, Jonathon (Jonathon.Robinsonat_private)
Date: Tue Mar 18 2003 - 11:26:32 PST

  • Next message: Andrew Bates: "Re: CodeRed Observations. ##"

    I have two [NT and 2K] servers that have an administrative share named
    SPM2000$. 
    This share has full access rights to drive C for the Everyone group. 
    I can deactivate it, but since it's an administrative share it's going to
    come back at reboot.
    
    After "Googling" the string, I found something called Service Pack Manager
    2000, but I don't think that's what created this as this software uses the
    default ADMIN$ share.
    Have any of you seen this share anywhere before?
     
    
    Thanks,
    
    Jonathon W. Robinson
    Network Security Specialist
    
    This information is intended only for the person or entity to which it is
    addressed and may contain confidential or privileged material. Any review,
    retransmission, dissemination, or other use of, or taking of any action in
    reliance upon, this information by persons or entities other than the
    intended recipient is prohibited. If you received this in error, please
    contact the sender and delete the material from any computer.
    
    
    ----------------------------------------------------------------------------
    
    <Pre>Lose another weekend managing your IDS?
    Take back your personal time.
    15-day free trial of StillSecure Border Guard.</Pre>
    <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>
    



    This archive was generated by hypermail 2b30 : Tue Mar 18 2003 - 11:50:32 PST