0

One of our users noted that on startup, their PC automatically opened a command prompt. Thinking nothing of it, they left it open and went about their business. After a short while, they came back to see this:

enter image description here

They were connected to the local server network at the time (CRESVR01), and claimed that they didn't do anything with the command prompt, or anything in the server.

Interestingly enough, there is no T: or U: on the server, (and there never was). I also attempted to use the same commands on my PC (net use T: and net use U:) but all that returned was

The network connection could not be found.

More help is available by typing NETHELPMSG 2250

The worst part is, that PC has been (allegedly) reported to have malware on it, though no proof has yet been found.

What are these commands attempting to do? And why was this running without user input?

1 Answer 1

1

That was most likely a batch file.

The batch file seemed to be remounting certain network drives to some locations on your server (by doing net use /delete on them and then mounting them again), either just to point the drives to a new location or, as you predicted, for malicious purposes to delete the server's Users folder.

You need to check your startup items and make sure that this batch file is not doing anything harmful.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.