Strange Command prompt functions

Question

One of our users noted that on startup, their PC automatically opened a command prompt. Thinking nothing of it, they left it open and went about their business. After a short while, they came back to see this:

They were connected to the local server network at the time (CRESVR01), and claimed that they didn't do anything with the command prompt, or anything in the server.

Interestingly enough, there is no T: or U: on the server, (and there never was). I also attempted to use the same commands on my PC (net use T: and net use U:) but all that returned was

The network connection could not be found.

More help is available by typing NETHELPMSG 2250

The worst part is, that PC has been (allegedly) reported to have malware on it, though no proof has yet been found.

What are these commands attempting to do? And why was this running without user input?

Answer 1

That was most likely a batch file.

The batch file seemed to be remounting certain network drives to some locations on your server (by doing net use /delete on them and then mounting them again), either just to point the drives to a new location or, as you predicted, for malicious purposes to delete the server's Users folder.

You need to check your startup items and make sure that this batch file is not doing anything harmful.