• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Windows automatically looks for share.cmd share.bat etc?

H

hotzen

Limp Gawd
Joined
Jan 29, 2011
Messages
349
Hello,

I am currently seeing very strange behaviour of my tiny HTPC-box, following dmesg of the ZFS server:
Code: 
Dec 23 18:54:15 knecht smbsrv: [ID 421734 kern.notice] NOTICE: [KNECHT\htpc]: filme.bat share not found
Dec 23 18:54:15 knecht last message repeated 1 time
Dec 23 18:54:15 knecht smbsrv: [ID 421734 kern.notice] NOTICE: [KNECHT\htpc]: filme.cmd share not found
Dec 23 18:54:15 knecht last message repeated 1 time
Dec 23 18:54:15 knecht smbsrv: [ID 421734 kern.notice] NOTICE: [KNECHT\htpc]: filme.exe share not found
Dec 23 18:54:15 knecht last message repeated 1 time
Dec 23 18:54:15 knecht smbsrv: [ID 421734 kern.notice] NOTICE: [KNECHT\htpc]: filme.com share not found
Dec 23 18:54:15 knecht last message repeated 1 time
Dec 23 18:54:15 knecht smbsrv: [ID 421734 kern.notice] NOTICE: [KNECHT\htpc]: filme.pif share not found
Dec 23 18:54:15 knecht last message repeated 1 time
Dec 23 18:54:15 knecht smbsrv: [ID 421734 kern.notice] NOTICE: [KNECHT\htpc]: filme.lnk share not found

the server is actually providing a share "filme" and the HTPC-box (Win 7) has very minimal software, so I think it is some weird windows-behaviour...
Has anyone seen such a behaviour? It looks somewhat virii :confused:
 
I know this is an ancient thread but I just found the same behaviour. One of my Windows clients is doing this...

Code: 
Oct 10 21:36:22 GLaDOS smbsrv: [ID 421734 kern.notice] NOTICE: [NT Authority\Anonymous]: tank_photos access denied: IPC only
Oct 10 21:36:22 GLaDOS last message repeated 19 times
Oct 10 21:36:22 GLaDOS smbsrv: [ID 421734 kern.notice] NOTICE: [NT Authority\Anonymous]: tank_photos.exe share not found
Oct 10 21:36:22 GLaDOS last message repeated 1 time
Oct 10 21:36:22 GLaDOS smbsrv: [ID 421734 kern.notice] NOTICE: [NT Authority\Anonymous]: tank_photos.dll share not found
Oct 10 21:36:22 GLaDOS last message repeated 2 times
Oct 10 21:36:22 GLaDOS smbsrv: [ID 421734 kern.notice] NOTICE: [NT Authority\Anonymous]: tank_photos.lnk share not found
Oct 10 21:36:22 GLaDOS last message repeated 1 time
Oct 10 21:36:22 GLaDOS smbsrv: [ID 421734 kern.notice] NOTICE: [NT Authority\Anonymous]: tank_photos.cmd share not found
Oct 10 21:36:22 GLaDOS last message repeated 1 time
Oct 10 21:36:22 GLaDOS smbsrv: [ID 421734 kern.notice] NOTICE: [NT Authority\Anonymous]: tank_photos.bat share not found
Oct 10 21:36:22 GLaDOS last message repeated 1 time
Oct 10 21:36:22 GLaDOS smbsrv: [ID 421734 kern.notice] NOTICE: [NT Authority\Anonymous]: tank_photos.com share not found
Oct 10 21:36:22 GLaDOS last message repeated 1 time
Oct 10 21:36:22 GLaDOS smbsrv: [ID 421734 kern.notice] NOTICE: [NT Authority\Anonymous]: tank_photos.pif share not found
Oct 10 21:36:22 GLaDOS last message repeated 1 time
 
These both look like viruses or adware trying to spread. I would check the source computer and run a MalwareBytes scan on it.
 
You must log in or register to reply here.
Back
Top