Networks

Ask something
Question Locked

Microsoft Windows Network unknown groups

0 helpful
11 replies

by neoklis

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Dear All,

I have a primary Domain Controller and a backup Domain controller running windows server 2003. I have 80 users on the network.
My problem is that in "My Network Places" - "Entire Network" - "Microsoft Windows Network"
I should have only the NETBIOS name of my domain example "DOMAIN1".
Since yesterday several other domains appeared and I cannot determine which PC is broadcasting this NETBIOS names. The new names are "Dbg", "Defsa", "Indogopartners", "Mbc" and even "Mshome".
Is this a virus or a Trojan?
How can I detect whose PC is broadcasting these fake domains?
I have the Trend Micro?s Enterprise Solution where each client has antivirus, spyware detection, and some other but it still doesn?t detect anything.

11 replies

by cg it

MSHome is the default name for Windows XP workgroup.

sounds like people are bringing in their personal computers and using the network or you have a very leaky wireless access. If you have wireless access for users.

by bizintelligence

It seems that people are bringing their personal computers and plugging into the network or connecting to your wireless network from outside (as stated by CG IT).

If you are running a DHCP server on Windows server then have a look into the DHCP leases. In that way, you can find if there is any unknown computer name (only if you have standard computer naming convention for your company).

In case of wireless, check your wireless AC.

Cheers !

by neoklis

The DHCP has only reserved IP addresses and I don't have wireless. Wireless is from a different connection and subnet.
Any Ideas?

by neoklis

THank you, i will try it and let you know..

by bizintelligence

If you have reserved IP addresses for all users then it shows user(s) is/are becoming master browsers.

Try using following command:

NBTSTAT -a NETBIOS_NAME

This command useful only if you have computers in listed workgroups or domains.

Third party software such as Ethereal/LANSpy/Wireshark/WinPCap are also useful (also stated by other tmalo627)

Good Luck !

by neoklis

I tried LanSpy but the results seem ok to me. All IPs have valid Netbios names. Nothing weird. Same as the nbtstat -a netbiso_name. (Thank you).

Now the Microsoft Windows Network shows "Mbc", "Mazeikai", "Ins", "Inicioms" and "Indogopartners" and my domain_name.

This means every now and then the fake domain names keep changing.

I scanned all PCs with trend micro antivirus, spyware enterprise software, nothing detected.

Those fake domains still there.

by shasca

Looks like the built in utilities aren't gleening enough info to help your cause. Netmon is a monitoring tool that you install on the master browser. Pc's will eventually have to check in, and the sniffer will snag them and give the info necessary to find it/them.

http://www.netmon.ca/downloads

This is a link to freeware sniffers also, but they usually fall short of the full capacity that Netmon does.

http://www.netmon.org/tools.htm

by bizintelligence

If you have laptop users then target them and check their network configurations. In the mean time I will search IT Manager's head. :-)

by neoklis

I finally got the Virus/Trojan after I manually update of Trend Micros OfficeScan and scheduled a scan all users PCs and laptops on Thursday night.
It detected a user with a virus or trojan and cleaned it. On Friday the network worked ok. All PCs and laptops were online and in Microsoft Windows Network it showed only my domain. I didn?t check the logs yet to get the virus name, as soon as I get it I will post it.
Thank you everyone. (I will try Netmon to see how it works, thnx!)

This discussion is closed to new replies.