Re: [Full-disclosure] NETBIOS SMB IPC$ unicode share access

[Jerome Athias]

Hi,   you can try:   SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\AutoShareServer   create a dword called AutoShareServer and set its value to 0 (for a server) OR AutoShareWks=0 (for workstations). It removes all $ (hidden) shares EXCEPT IPC$ (need reboot)     net share ipc$ /delete (ie in: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run)     /JA ***************************************************************** http://www.athias.fr - Alertes et bulletins de sécurité ----- Original Message ----- From: Ramachandrand To: full-disclosure@lists.grok.org.uk Sent: Thursday, July 28, 2005 9:16 AM Subject: [Full-disclosure] NETBIOS SMB IPC$ unicode share access Hi,             AM NEW TO SNORT KINDLY HELP ME In my network all r 2000 & XP Pc in that all the users home folder was mapped as \\servername\username$ In server we use to create a folder and give access to the particular user. Recently we I have installed snort in that it keeps on alerting this msg “ NETBIOS SMB IPC$ unicode share access” How to stop this event ie not to detect for this event. plz tell me in brief note   Thanks in advance.     Regards, D.Ramachandran _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/