Re: [Full-disclosure] NETBIOS SMB IPC$ unicode share access

["Jerome Athias" <jerome.athias@xxxxxxx>]

Hi,

you can try:

SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\AutoShareServer

create a dword called AutoShareServer and set its value to 0 (for a server) OR 
AutoShareWks=0 (for workstations). It removes all $ (hidden) shares EXCEPT IPC$ 
(need reboot)


net share ipc$ /delete
(ie in: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run)


/JA
*****************************************************************
http://www.athias.fr - Alertes et bulletins de sécurité
  ----- Original Message ----- 
  From: Ramachandrand 
  To: full-disclosure@xxxxxxxxxxxxxxxxx 
  Sent: Thursday, July 28, 2005 9:16 AM
  Subject: [Full-disclosure] NETBIOS SMB IPC$ unicode share access


  Hi,

              AM NEW TO SNORT KINDLY HELP ME 

  In my network all r 2000 & XP Pc in that all the users home folder was mapped 
as 

  \\servername\username$ In server we use to create a folder and give access to 
the particular user. 

  Recently we I have installed snort in that it keeps on alerting this msg

  " NETBIOS SMB IPC$ unicode share access"

  How to stop this event ie not to detect for this event. plz tell me in brief 
note

   

  Thanks in advance.

   

   

  Regards,

  D.Ramachandran



------------------------------------------------------------------------------


  _______________________________________________
  Full-Disclosure - We believe in it.
  Charter: http://lists.grok.org.uk/full-disclosure-charter.html
  Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/