One of our users noted that on startup, their PC automatically opened a command prompt. Thinking nothing of it, they left it open and went about their business. After a short while, they came back to see this:
They were connected to the local server network at the time (CRESVR01), and claimed that they didn't do anything with the command prompt, or anything in the server.
Interestingly enough, there is no T:
or U:
on the server, (and there never was). I also attempted to use the same commands on my PC (net use T:
and net use U:
) but all that returned was
The network connection could not be found.
More help is available by typing NETHELPMSG 2250
The worst part is, that PC has been (allegedly) reported to have malware on it, though no proof has yet been found.
What are these commands attempting to do? And why was this running without user input?