Workstations prompting to login as another user

Workstations prompting to login as another user - Bearshare?

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Andrew H - 30 Dec 2003 15:12 GMT

I've just had an incident where users on several workstations had a login
screen popping up asking them to log in to the network as one of the other
users, say "Jim". I checked Jim's machine - he was running BearShare and
LimeWare, which I see are Gnutella clients, as well as several other pieces
of malware. I removed these from his machine, and scanned him for viruses
(clean).

My questions are:
What was Jim's machine doing that caused the other machines to attempt to
login as him?
What might be infected/affected?
What do I need to clean up?
What can I do to prevent this happening again?

Reply to this Message

Cris Hanna \(SBS-MVP\) - 30 Dec 2003 16:01 GMT

These are pretty much all cases of P2P(Peer to Peer File Sharing) software
which have absolutely no business being installed in a business enviroment.
Kazaa, another P2P network, had a terrible virus going around for a while.

Sounds like some sort of Trojan/spyware at work.
I would get a copy of Spybot Search and Destroy and load it on that machine
http://www.safer-networking.org/index.php?page=spybotsd and see what it
finds (you will probably be amazed

And then to be on the safe side also get Ad Aware from lavasoftusa.com.
Sometimes it finds a thing or two that Spybot does not. Both programs have
the ability to "immunize"

Finally a written policy needs to be in place that outlines acceptable
internet access and email usage as well as outlining the procedure for
approval for installing new software. And after they have been properly
warned, random audits are a good thing.

Signature

Cris Hanna [SBS-MVP]
-------------------------
Please do not directly to me but rather reply to the newsgroup so that all
may benefit from the information.

> I've just had an incident where users on several workstations had a login
> screen popping up asking them to log in to the network as one of the other
[quoted text clipped - 9 lines]
> What do I need to clean up?
> What can I do to prevent this happening again?

Reply to this Message

Andrew H - 31 Dec 2003 12:07 GMT

I have already run AD-Aware against the rogue users machine, and (no
surprise) found plenty that didn't belong there. But part of my question
relates to what else I need to scan - every machine on the LAN, the machines
where the login prompt appeared, etc?

> These are pretty much all cases of P2P(Peer to Peer File Sharing) software
> which have absolutely no business being installed in a business enviroment.
[quoted text clipped - 33 lines]
> > What do I need to clean up?
> > What can I do to prevent this happening again?

Reply to this Message

Cris Hanna \(SBS-MVP\) - 31 Dec 2003 16:18 GMT

If this is happening on several machines...yes...scan it all.
And you may never make it go away without flattening the machines...but I
strongly suggest spybot as well as Ad Aware.

Signature

Cris Hanna [SBS-MVP]
-------------------------
Please do not directly to me but rather reply to the newsgroup so that all
may benefit from the information.

> I have already run AD-Aware against the rogue users machine, and (no
> surprise) found plenty that didn't belong there. But part of my question
[quoted text clipped - 46 lines]
> > > What do I need to clean up?
> > > What can I do to prevent this happening again?

Reply to this Message

Mark Mancini - 30 Dec 2003 16:30 GMT

enforce a company policy that fires these people if they install it!

Signature

Sincerely,
Mark Mancini, CCA, CCNA, Master CIW&CI, CNE 4&5, MCSE+I 4&2000
www.MCSE2000.com
www.AppLauncher.com

Reply to this Message