Cannot access networked computer

[Guest]

This is a variation of what has been posted. I have run into a bit of
a wall....maybe this is a pun.

Configured a wireless router to host three hard connects and a
wireless laptop. No internet connection yet. Then configured router as
a hub to use ICS via a server PC. All PCs show up in the windows
explorer and all can be pinged...except that one cannot open files on
the ICS pc. The ICS works for all but the one that cannot get access,
even though the ISC pc can be pinged. The message that comes up is:

Access Permissions?
Logon failure. The user has not been granted the requested longon type
at this computer.

Only one Master Browser is running and the reg entry for restrict
anonymous is zero. Windows firewall is off and Zone Alarm allows all
IP addresses access. ICS works except for the one computer that cannot
access the server PC. I have checked all permissions and sharing etc
and simply cannot find the expection for this single PC.

Any suggestions??

Thanks.

Henry

 

[Chuck]

This is a variation of what has been posted. I have run into a bit of
a wall....maybe this is a pun.

Configured a wireless router to host three hard connects and a
wireless laptop. No internet connection yet. Then configured router as
a hub to use ICS via a server PC. All PCs show up in the windows
explorer and all can be pinged...except that one cannot open files on
the ICS pc. The ICS works for all but the one that cannot get access,
even though the ISC pc can be pinged. The message that comes up is:

Access Permissions?
Logon failure. The user has not been granted the requested longon type
at this computer.

Only one Master Browser is running and the reg entry for restrict
anonymous is zero. Windows firewall is off and Zone Alarm allows all
IP addresses access. ICS works except for the one computer that cannot
access the server PC. I have checked all permissions and sharing etc
and simply cannot find the expection for this single PC.

Any suggestions??

Thanks.

Henry

Henry,

This is a well known issue. The problem is generally in the server (ICS
computer, in your case), and is related to the account that you're trying to use
for access (and to Guest, if you're using SFS).
<http://nitecruzr.blogspot.com/2005/06/file-sharing-under-windows-xp.html#Help>
http://nitecruzr.blogspot.com/2005/06/file-sharing-under-windows-xp.html#Help

 

[Guest]

I am sure you are on the right track with my problem, but when I tried
to access the user accounts through control panel/admin tools, the
item for accounts and users under systems was not there. Couldn't get
the command line to work...if fact, I wasn't sure what I was
authenticating or enabling. Could you shed more light on this user
name, access, and authorization in a network?

Appreciate your help...as always, you are on top of the issues.

Henry

 

[Chuck]

I am sure you are on the right track with my problem, but when I tried
to access the user accounts through control panel/admin tools, the
item for accounts and users under systems was not there. Couldn't get
the command line to work...if fact, I wasn't sure what I was
authenticating or enabling. Could you shed more light on this user
name, access, and authorization in a network?

Appreciate your help...as always, you are on top of the issues.

Henry

Henry,

Thanks for your kind words. Did you look for Administrative Tools - Computer
Management? Then in the hierarchical menu (Computer Management window on the
left), you should have System Tools - Local Users and Groups - Users.

When you tried the command line utility, what exact error did you get?

 

[Guest]

Strange, but I don't have the Local Users and Groups - Users under
system tools. I do have a User Accounts in the control panel. I don't
have any entry in System Tools - Local Users and Groups - Users on any
computer...XP Home SP2 on all of them. I went to Add/Remove to see if
there was anything in XP I should load, but nothing made this entry
show up. Is there something missing from my OS load?

However, I went back to the command line and did several active:yes on
the various accounts...to make sure I got the right one and....

YOU DA MAN!!!!!

It works. I must have been lucky in the past not to run into this
problem.

On another sidebar issue, after my OS re-install, my MacAfee virus
catcher identified a program called lsass.exe as a virus. Is it really
or is it part of the OS? It shows up in the I386 file and in the
Windows subdirectory. I have blocked it and the only thing that has
happened is that an annoying hijack program for a registry cleaner has
disappeared. Can or should I delete it?

Thanks, and I appreciate your help on this tricky problem.

Henry

 

[Guest]

When I went in to enable the ICS, I got the old problem back. Went
through the whole permissions and active:yes enablement and still
won't let me see the server (ICS) PC. Now neither of the other two
computers can see the ICS files, though they can ping it.

If I read your article right, the net access is via the Guest
accounts. I have set all guest accounts Active:yes. On one machine, it
could not find the administrator's name, so I changed it to a simpler
name and rebooted. In Control Panel/Users, this new name shows up but
the Net User command line still shows the old name, which it claims it
cannot find to set active:yes.

I am clearly missing somethig. No firewall problems that I have found.

What, Obe Wan, am I doing wrong??

Henry

 

[Chuck]

Strange, but I don't have the Local Users and Groups - Users under
system tools. I do have a User Accounts in the control panel. I don't
have any entry in System Tools - Local Users and Groups - Users on any
computer...XP Home SP2 on all of them. I went to Add/Remove to see if
there was anything in XP I should load, but nothing made this entry
show up. Is there something missing from my OS load?

However, I went back to the command line and did several active:yes on
the various accounts...to make sure I got the right one and....

YOU DA MAN!!!!!

It works. I must have been lucky in the past not to run into this
problem.

On another sidebar issue, after my OS re-install, my MacAfee virus
catcher identified a program called lsass.exe as a virus. Is it really
or is it part of the OS? It shows up in the I386 file and in the
Windows subdirectory. I have blocked it and the only thing that has
happened is that an annoying hijack program for a registry cleaner has
disappeared. Can or should I delete it?

Thanks, and I appreciate your help on this tricky problem.

Henry

Henry,

Great, sounds like we're making progress.

The lsass.exe exploit has been used by a lot of bad guys - the most notorious
was Sasser, but there have been others. We can guess about it, or you can solve
the problem. Please don't just delete lsass.exe - it is a legitimate Windows
file, and if you delete it, you might not be able to login to the computer.

What You Should Know About the Sasser Worm and Its Variants:
<http://www.microsoft.com/security/incident/sasser.asp>
http://www.microsoft.com/security/incident/sasser.asp

The legit lsass.exe module should be in I386, and in Windows\System32. If
there's one in Windows\System, you may indeed have a bad one. Please don't
delete it (even if you can). Please read my online malware analysis article:
<http://nitecruzr.blogspot.com/2005/10/online-analysis-of-suspicious-files.html>
http://nitecruzr.blogspot.com/2005/10/online-analysis-of-suspicious-files.html

Use Jotti and Virustotal, and please report your findings.

 

[Chuck]

When I went in to enable the ICS, I got the old problem back. Went
through the whole permissions and active:yes enablement and still
won't let me see the server (ICS) PC. Now neither of the other two
computers can see the ICS files, though they can ping it.

If I read your article right, the net access is via the Guest
accounts. I have set all guest accounts Active:yes. On one machine, it
could not find the administrator's name, so I changed it to a simpler
name and rebooted. In Control Panel/Users, this new name shows up but
the Net User command line still shows the old name, which it claims it
cannot find to set active:yes.

I am clearly missing somethig. No firewall problems that I have found.

What, Obe Wan, am I doing wrong??

Henry

Henry,

With Simple File Sharing, the Guest account is the only one relevant to network
access. Please don't go renaming accounts - all that will do is cause
confusion, as you now see.

It sounds to me like you now have a browser problem. Though from your previous
post, I also suspect that you have a malware problem, so maybe that needs to be
dealt with first. One issue at a time please.

 

[Guest]

Henry,

Great, sounds like we're making progress.

The lsass.exe exploit has been used by a lot of bad guys - the most notorious
was Sasser, but there have been others. We can guess about it, or you can solve
the problem. Please don't just delete lsass.exe - it is a legitimate Windows
file, and if you delete it, you might not be able to login to the computer.

What You Should Know About the Sasser Worm and Its Variants:
<http://www.microsoft.com/security/incident/sasser.asp>
http://www.microsoft.com/security/incident/sasser.asp

The legit lsass.exe module should be in I386, and in Windows\System32. If
there's one in Windows\System, you may indeed have a bad one. Please don't
delete it (even if you can). Please read my online malware analysis article:
<http://nitecruzr.blogspot.com/2005/10/online-analysis-of-suspicious-files.html>
http://nitecruzr.blogspot.com/2005/10/online-analysis-of-suspicious-files.html

Use Jotti and Virustotal, and please report your findings.

Jotti and Virustotal show the lsass file as clean. None of my other
detection software has shown spy ware, hijack ware, viruses, or PUPs.I
downloaded the MS virus detection program and it shows everything
clean for what it checks for. I think the system is clean. Need to do
some housekeeping to improve efficiency. My issues with ICS and the
browser problem just seem to persist...touching one impacts another. I
have gone back through and used net user active:yes on all guest
accounts. I guess it is back to zero: disable ICS and just have a
plain hub arrangement and solve that problem first. Then add ICS back
in to see what is what.

Did notice that McAfee was grabbing 99% of the cpu resources and
stalling everything. don't know what that is all about....it was
checking e-mails...disabled that and we will see.

Thanks for the pointers and help.

Henry

 

[Chuck]

Jotti and Virustotal show the lsass file as clean. None of my other
detection software has shown spy ware, hijack ware, viruses, or PUPs.I
downloaded the MS virus detection program and it shows everything
clean for what it checks for. I think the system is clean. Need to do
some housekeeping to improve efficiency. My issues with ICS and the
browser problem just seem to persist...touching one impacts another. I
have gone back through and used net user active:yes on all guest
accounts. I guess it is back to zero: disable ICS and just have a
plain hub arrangement and solve that problem first. Then add ICS back
in to see what is what.

Did notice that McAfee was grabbing 99% of the cpu resources and
stalling everything. don't know what that is all about....it was
checking e-mails...disabled that and we will see.

Thanks for the pointers and help.

Henry

OK, Henry. Just try and keep the concept of ICS and Windows Networking (the
browser is a component of WN) separate. ICS is a software based NAT router. It
affects Windows Networking only as far as it provides IP settings, and TCP/IP is
the transport which supports NetBIOS Over TCP/IP.
<http://nitecruzr.blogspot.com/2005/07/windows-networking.html>
http://nitecruzr.blogspot.com/2005/07/windows-networking.html

Why is ICS involved anyway? You have a router, so why are we even discussing
ICS? I think you need to start there.

 

[Guest]

Henry,

With Simple File Sharing, the Guest account is the only one relevant to network
access. Please don't go renaming accounts - all that will do is cause
confusion, as you now see.

It sounds to me like you now have a browser problem. Though from your previous
post, I also suspect that you have a malware problem, so maybe that needs to be
dealt with first. One issue at a time please.

OK, the pc is clean. I have reverted to hub mode with no ICS. Still
the same issue. Now, however, my Firewall settings are strange. The
control panel/firewall settings are greyed out. Since all three PCs
have the same configuration, this one is different and this is also
the one that another PC can ping but not access....original problem.
Before, when I had the ICS PC configured for ICS, I could never really
access the Firewall without a message asking me to enable
ICS/Firewall. This was on both the dial up client...the actual ICS
access to the internet as well as on the network NIC going to the hub.
Something is definitely amiss on this system.

Any ideas what may be happening? I read a cryptic note on setting up
the network and ICS that said if the Firewall settings were greyed
out, then something was screwed up...no further instructions or
insights.

Any pointers on your web site that may be relevant...I am not sure
what to even call this problem.

Henry

 

[Chuck]

OK, the pc is clean. I have reverted to hub mode with no ICS. Still
the same issue. Now, however, my Firewall settings are strange. The
control panel/firewall settings are greyed out. Since all three PCs
have the same configuration, this one is different and this is also
the one that another PC can ping but not access....original problem.
Before, when I had the ICS PC configured for ICS, I could never really
access the Firewall without a message asking me to enable
ICS/Firewall. This was on both the dial up client...the actual ICS
access to the internet as well as on the network NIC going to the hub.
Something is definitely amiss on this system.

Any ideas what may be happening? I read a cryptic note on setting up
the network and ICS that said if the Firewall settings were greyed
out, then something was screwed up...no further instructions or
insights.

Any pointers on your web site that may be relevant...I am not sure
what to even call this problem.

Henry

Henry,

I would start from the bottom up.
<http://nitecruzr.blogspot.com/2005/05/troubleshooting-network-neighborhood.html>
http://nitecruzr.blogspot.com/2005/05/troubleshooting-network-neighborhood.html

 

[Guest]

JUst an update. I have started the "bottom up" diagnostics. No Winsock
or IP errors to correct. Replaced the new router/hub with the old
one...no improvement, same problem. Have uninstalled and re-installed
NICs and modem and as much software as seems relevant. No joy.

I am proceeding up the list of diagnostics. However, other issues seem
to point to a failing motherboard...so I may scrap this effort and get
a new PC. I will let you know where things stand on Monday.

Thanks for your help.

Henry

 

[Guest]

Oh, just an after thought. I have disabled ICS and am just working on
the hub configuration. I have set all static IPs. I have no gateway or
DNS addresses in the system...all three PCs should be equal in the
eyes of the network, but still there is one...the former ICS
server...that they cannot access...same permissions issue. I can ping
all systems but not access the files even though file sharing is
enabled, no firewalls are in place, and guest accounts are enabled and
web active.

Have a nice week end.

Henry