Trouble sharing files......

[squishy]

I tried to connect to a WinXP machine on my network that is in the same
domain as my other 2 XP PCs and has folders shared for use by everyone.

But, when I tried to connect to that PC to view the shared folders, I got a
message that said "XXXXXXX is not accessible. You might not have permission
to use this network resource. Access is denied."

When I searched for a solution, I found a KB article at Microsoft
(http://support.microsoft.com/kb/913628) that explained that the problems
could be due to the
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous"
setting being set to "1". The article said to set this to "0" to allow
anonymous file sharing on the local network.

So, I set the "restrictanonymous" setting to "0" and rebooted as the KB
article said. But, when my PC rebooted, I still had the same problem and the
"restrictanonymous" setting was back at "1".

I tried to change it several more times - each time I got the same result.

Finally (thinking that something may be changing it before logging off) I
reset "restrictanonymous" to "0" and did a hard reboot by hitting my
system's restart button. But, again, the "restrictanonymous" setting was
back to "1".

I even tried disabling the XP firewall (no reboot) and got the same error.

I am running NOD32 antivirus (www.eset.com) and Windows XP Firewall. No
other security applications are running (AFAIK).

I have worked with a lot of XP PCs, but I have never seen this before.

What could be resetting my
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous"
setting to "1"?

squishy

 

[squishy]

I tried to connect to a WinXP machine on my network that is in the same
domain as my other 2 XP PCs and has folders shared for use by everyone.

But, when I tried to connect to that PC to view the shared folders, I got
a message that said "XXXXXXX is not accessible. You might not have
permission to use this network resource. Access is denied."

When I searched for a solution, I found a KB article at Microsoft
(http://support.microsoft.com/kb/913628) that explained that the problems
could be due to the
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous"
setting being set to "1". The article said to set this to "0" to allow
anonymous file sharing on the local network.

So, I set the "restrictanonymous" setting to "0" and rebooted as the KB
article said. But, when my PC rebooted, I still had the same problem and
the "restrictanonymous" setting was back at "1".

I tried to change it several more times - each time I got the same result.

Finally (thinking that something may be changing it before logging off) I
reset "restrictanonymous" to "0" and did a hard reboot by hitting my
system's restart button. But, again, the "restrictanonymous" setting was
back to "1".

I even tried disabling the XP firewall (no reboot) and got the same error.

I am running NOD32 antivirus (www.eset.com) and Windows XP Firewall. No
other security applications are running (AFAIK).

I have worked with a lot of XP PCs, but I have never seen this before.

What could be resetting my
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous"
setting to "1"?

squishy

I found the problem.....it was the C:\WINDOWS\retadpu173.exe
Win32/TrojanDownloader.Agent.NKY trojan.

This file resets the "restrictanonymous" setting in addition to downloading
other naty crap to your PC.

I am running the latest updated version of NOD32 (www.eset.com) and had done
4 deep system scans. NOD32 never caught it or cleaned it.

NOD32 also missed a file named "avp.exe" that tried to pass itself off as
Kapersky or McAfee antivirus. I have never loaded either of thiose on my
system.

Deleted both files after submitting them to Eset, and I can share just fine.

Maybe I should run 2 antivirus programs.......

squishy

 

[Lanwench [MVP - Exchange]]

I found the problem.....it was the C:\WINDOWS\retadpu173.exe
Win32/TrojanDownloader.Agent.NKY trojan.

This file resets the "restrictanonymous" setting in addition to
downloading other naty crap to your PC.

I am running the latest updated version of NOD32 (www.eset.com) and
had done 4 deep system scans. NOD32 never caught it or cleaned it.

NOD32 also missed a file named "avp.exe" that tried to pass itself
off as Kapersky or McAfee antivirus. I have never loaded either of
thiose on my system.

Deleted both files after submitting them to Eset, and I can share
just fine.
Maybe I should run 2 antivirus programs.......

squishy

Glad you found the issue, but another thing to mention - if you have a
domain, don't use local workstations to store (or share) data. All data
should be on your server(s) and shared/controlled from there.