ntlanman !?!?!?

PangingJr · Jun 12, 2004, 12:13 PM

Quote:

Originally posted by BWX
Ok, well I already had the simple shares clicked in the folder options.

the Use simple file sharing.... options in checked or unchecked??

PangingJr · Jun 12, 2004, 12:24 PM

Quote:

Originally posted by BWX
Yeah, it has all those except the security tab.

Originally posted by Net
go to the Folder options, then remove the dot or uncheck in front of the Use simple file sharing..

Quote:

Originally posted by Net
"No folder option anywhere in that file's properties, nothing about sharing at all.."
sorry i thought you knew..
you can find the "Folder Options" in Control Panel..
or open any folder and go to Tools -> Folder Options -> View tab -> Uncheck the Use simple file sharing... if it's checked and see if the Security tap is show up..

Quote:

Originally posted by Net
in the Security tab, try taking ownership of the file and give a full control (permissions)

-----------------------------

Quote:

Originally posted by BWX
I'll just have to find out how to delete that file somehow.

try taking ownership of the file and give a full control (permissions) to you then backup and delete it.

BWX · Jun 12, 2004, 12:35 PM

Quote:

Originally posted by Net
the Use simple file sharing.... options in checked or unchecked??

It was checked, so I unchecked it- but it didn't make any difference- Maybe I'll try to reboot and see if that helps. I have file sharing turned off anyway, not sure if that makes any difference..

PangingJr · Jun 12, 2004, 04:33 PM

OK, compress the funny file with password and email the compressed file to me.

BWX · Jun 12, 2004, 05:24 PM

Quote:

Originally posted by Net
OK, compress the funny file with password and email the compressed file to me.

Actually I was trying to see what would happen if I sent the file with the 'right click- send', and I actually sent it to the documents and now I have a "copy of funny.exe" in there too-
Same problem with that file- lol.

Ok, I just compressed it with a PW- it worked

Interesting the file was 0k before, now the compressed .rar is 92 bytes, on disk size is 16,384 bytes... Interesting.

PM me your email and I'll send it.

PangingJr · Jun 12, 2004, 06:41 PM

the funny file is nothing really,
running this file wont make any change to your system,
only a few MRU registry changes, it's for a record in windows just like you open a text file. you can delete it.

you can make this file yourself and test it...
create a .txt file then rename it to .exe..
just like the funny2.exe and funny3.exe...

PangingJr · Jun 12, 2004, 06:49 PM

email the ntlanman.exe to me if you still have it. it's the real one.

BWX · Jun 12, 2004, 06:50 PM

[QUOTE]Originally posted by Net
the funny file is nothing really,
running this file wont make any change to your system,
only a few MRU registry changes, it's for a record in windows just like you open a text file. you can delete it.

you can make this file yourself and test it...
create a .txt file then rename it to .exe..
just like the funny2.exe and funny3.exe...

[/QUOTE

Yes but I cannot change the extension, I get a pop up saying it's being used by another person or program. If I change anything in the file, it makes a shortcut to itself in the same folder and the changes aren't saved.. I dunno- it must not be the same once it's not on the same system that it was infected on.

BWX · Jun 12, 2004, 06:57 PM

Quote:

Originally posted by Net
email the ntlanman.exe to me if you still have it. it's the real one.

Oh crap I deleted it. That sux- Must be that's why the funny.exe is different once on someone else's PC..

PangingJr · Jun 12, 2004, 07:00 PM

Quote:

Originally posted by BWX
Yes but I cannot change the extension, I get a pop up saying it's being used by another person or program. If I change anything in the file, it makes a shortcut to itself in the same folder and the changes aren't saved.. I dunno- it must not be the same once it's not on the same system that it was infected on.

i didnt tell you to change the original funny file extension..
create a new one just like i mentioned and test it.

you cannot do anything to the file until you adjust your system security./
otherewiz it keeps creating a new one when you try to delete it, or saying whatever when you try to rename...

PangingJr · Jun 12, 2004, 07:03 PM

Quote:

Originally posted by BWX
That sux- Must be that's why the funny.exe is different once on someone else's PC..

i don't think so.
i think the ntlanman.exe has nothing to do with the funny.exe.

BWX · Jun 12, 2004, 07:15 PM

Quote:

Originally posted by Net
i didnt tell you to change the original funny file extension..
create a new one just like i mentioned and test it.

you cannot do anything to the file until you adjust your system security./
otherewiz it keeps creating a new one when you try to delete it, or saying whatever when you try to rename...

Oh yeah I see what you mean. That's messed up- I'll have to get that security tab to start up, I don't have filesharing turned on though.

That's probably why it won't show up... I don't know because I never use filesharing.. and never have.

PangingJr · Jun 12, 2004, 07:31 PM

Set Owner/Set Permissions.

You may not be able to delete a file if the file uses an Access Control List (ACL). To resolve this issue, change the permissions on the file. You may have to take ownership of the files to be able to change the permissions.

Administrators have the implicit ability to take ownership of any file even if they have not been explicitly granted any permission to the file. File owners have the implicit ability to modify file permissions even if they are not explicitly granted any permissions to the file. Therefore, you may have to take ownership of a file, give yourself permissions to delete the file, and then delete the file.

note-- NTFS treats folders as a special type of file. Therefore, the word "file" indicates either a file or folder.

That's one of the reason that you cannot delete a file in NTFS, see if you can change it then try removing the file.

BWX · Jun 12, 2004, 09:13 PM

I can't even get that security tab to show up for some reason-- really bugging me. I turned on file sharing, I removed check from that simple shares setting too-

I don't know what else to do.. I'll have to do some searching. I guess it was a coincidence that I saw that funny.exe file the same time I noticed that ntlanman trying to access the internet--

Now that I think about it, I think it was a website that got me somehow, because I didn't even open any emails when that started happening.. All of it is very strange.

PangingJr · Jun 12, 2004, 09:17 PM

but you can see the security tab on any other files/folders ?

BWX · Jun 12, 2004, 09:38 PM

Quote:

Originally posted by Net
but you can see the security tab on any other files/folders ?

Nope- none of them-

I found this- the first search I did-
http://windows.about.com/library/tips/bltip542.htm

"If you have Windows XP, and your hard drive is formatted as NTFS, you can set permissions on files so that only users you specify can access them. However, if your Windows XP computer is not part of a Domain on a network, you may notice that there is no Security tab when you right-click a file and choose Properties. For some reason, the default for Windows XP computers that are part of a Domain is to have that visible. For Windows XP computers that are not part of a Domain (they are stand-alone, or part of a workgroup), the default is to have the Security tab hidden.

To reveal the Security tab, open Windows Explorer, and choose Folder Options from the Tools menu. On the View tab, scroll to the bottom of the Advanced Settings and clear (click) the check box next to "Use Simple File Sharing." Click OK to apply the change, and you should now have a Security tab when viewing the properties of a file on an NTFS volume"

Guess what-- I'm using FAT32- maybe that's why.. I usually don't mess with this stuff, because I have no need to most of the time. I can't believe that when I create a .txt file and rename it to an .exe file, I loose all control over that file- What a stupid thing that is.. The fact that I have to be part of a Domain to access files that I just created is ridiculous. But still, I'm not using NTFS, so maybe that's why.

PangingJr · Jun 12, 2004, 09:52 PM

lol

BWX · Jun 12, 2004, 09:53 PM

http://www.dbforums.com/archive/index.php/t-960939.html
--Dave
"I installed XP Pro (SP1) as a new install over an XP Home
installation and several folders and files are
inaccessible no matter how I set permissions. One article
I read on making such folders/files accessible suggested
a change in the Security section of Properties. Right-
clicking any folder/file on my machine and selecting
Properties shows no Security tab. So after further
research, several articles suggest going into My
Computer, choosing Tools-Folder Options-View and
deselecting Use Simple File Sharing (recommended) and
clicking OK to apply the change. This, in theory, would
make the Security tab appear. All articles agreed on
this. But after following those instructions, I still
have no Security tab and am becoming frustrated at no
being able to acces my files. Short of backing-up and
reformatting as FAT32 instead of NTFS, is there any other
way to make these folders/files accesible again? Any help
would be greatly appreciated.

Thank you"

So it is something to do with that I think-- Oh well- I'll keep searching.

PangingJr · Jun 12, 2004, 10:14 PM

Quote:

Originally posted by BWX
[url]... But after following those instructions, I still
have no Security tab

"NoSecurityTab" can be applied using Windows registry or in gpedit.msc.

PangingJr · Jun 12, 2004, 10:21 PM

Quote:

Originally posted by BWX

So it is something to do with that I think-- Oh well- I'll keep searching.

What are you trying to search? security tab?
you use fat32 yun won't have it.

do you still want to delete the funny.exe file?

BWX · Jun 13, 2004, 12:02 AM

Quote:

Originally posted by Net
What are you trying to search? security tab?
you use fat32 yun won't have it.

do you still want to delete the funny.exe file?

Well I wanted to, but if it's that big of a pain and I know now that it isn't anything dangerous, maybe it's easier to just leave it there..

I seem to remember a news article here at DH with a program called "Delete any file" or something like that- I think I'll find that and try it..

I think I was searching for:
"security tab"
"security tab fat32"

But then I gave up and figured I'd try tomorrow, and install the new Cat drivers and play some games for a while.

PangingJr · Jun 13, 2004, 12:43 AM

you must be running NTFS as your file system otherwise the Security tab wont be there.

if you like to remove the file or the other files you wil have prob with you can use a free file utility called GiPo@MoveOnBoot, it'll delete the file on the next system boot.
go to the program site - http://www.gibinsoft.net/gipoutils/ -> File Utilities -> GiPo@MoveOnBoot -> Old Version (Freeware).

BWX · Jun 13, 2004, 03:34 AM

Quote:

Originally posted by Net
you must be running NTFS as your file system otherwise the Security tab wont be there.

if you like to remove the file or the other files you wil have prob with you can use a free file utility called GiPo@MoveOnBoot, it'll delete the file on the next system boot.
go to the program site - http://www.gibinsoft.net/gipoutils/ -> File Utilities -> GiPo@MoveOnBoot -> Old Version (Freeware).

Hey cool, I'll try that..

"Our Experience

We have wide experience in development of:

Windows - UNIX / Linux distributed applications.
Multithreaded & multiprocess software.
Windows NT / 2000 / XP Services.
Windows COM / DCOM servers (*.exe or *.dll).
CORBA servers for Windows / Linux / UNIX.
ActiveX controls.
Windows shell extensions.
MMC Snap-Ins.
Windows console applications.
Screen savers.
DOS applications (system / user / graphics).
some other types of applications.

Tools & Technologies

We master the following tools & technologies:

Microsoft Visual C++.
Microsoft Visual BASIC, VBA.
STL, ATL, WTL, MFC.
Java.
COM, ActiveX / DCOM.
CORBA (using ORBACUS broker or VisiBroker).
Windows 9x / NT / 2000 / XP API & Kernel Objects.
HTML, DHTML, CSS.
XML, XSL, DTD.
DOM.
Java Script, VB Script.
HTML Help.
SQL.
OLE DB, ODBC, ADO, DAO.
MSMQ.
DOS development using C / C++ / BASIC language.
BIOS & DOS interrupts.
some other tools & technologies. "

Ummm, wtf.. is there anything these people don't know?

PangingJr · Jun 13, 2004, 09:30 AM

hmm there must be something , maybe alot of thing they don't know. why don't you ask them to put it on their site ?/ lol

BWX · Jun 13, 2004, 12:57 PM

Well it worked, so that's cool..

PangingJr · Jun 14, 2004, 08:48 AM

Cool.

--------------------------

here're couple more cases just like your ntlanman i think.,

an EXE which is named after a DLL in the same directory...

mqqm.dll Windows NT MQ Queue Manager.

Quote:

http://computercops.biz/postp176258.html

I also just encountered the same thing, except in my case my executable was named mqqm.exe. My firewall blocked it from accessing search.requestlookup.net port 80. (206.58.237.248:80)

Mine is a 52KB file

C:\WINDOWS\SYSTEM32
Size: 51.3 KB (52,626 bytes)
Size on disk: 52.0 KB (53,248 bytes)

I blocked it and renamed it ...Symantec anti-virus, Adaware, and Spybot didn't find anything

d3d8.dll Microsoft Direct3D.

Quote:

http://computercops.biz/postp176258.html
Me too. My file is d3d8.exe and it is in the Windows\system32 directory. Zone Alarm alerted me this was trying to connect. Hopefully we will figure out what this thing is soon.

BWX · Jun 14, 2004, 12:45 PM

Quote:

Originally posted by Net
Cool.

--------------------------

here're couple more cases just like your ntlanman i think.,

an EXE which is named after a DLL in the same directory...

mqqm.dll Windows NT MQ Queue Manager.

d3d8.dll Microsoft Direct3D.

Yeah, Adaware, Spybot, and virus checkers should find stuff like this. Hopefully they will figure it out soon.

PangingJr · Jun 14, 2004, 12:56 PM

you were good at checking yourself as i saw on your initial post, everything is in there and it was good...

BWX · Jun 14, 2004, 01:53 PM

Yeah I think we found a new virus/adaware/worm/trojan type thing, or at least one that nothing detects except people paying attention to their firewalls..

I just noticed in my logs when I turned on my PC that something was trying to ICMP out, it could not do it because I block ALL ICMP in and out. It was ntoskrnl.exe in Windows\system32\ -but I looked at the fie and it looks like a normal file.. Weird. svhost.exe from the same folder also tried to ICMP out- they looked like they were trying to ICMP to my own ISP server, so it's probably nothing..

Jun 12, 2004, 06:50 PM	Thread Starter #68
BWX unplugged Join Date: Nov 2002 Location: USNY Posts: 19,665 Rep Power: 109 System Specs	[QUOTE]Originally posted by Net the funny file is nothing really, running this file wont make any change to your system, only a few MRU registry changes, it's for a record in windows just like you open a text file. you can delete it. you can make this file yourself and test it... create a .txt file then rename it to .exe.. just like the funny2.exe and funny3.exe... [/QUOTE Yes but I cannot change the extension, I get a pop up saying it's being used by another person or program. If I change anything in the file, it makes a shortcut to itself in the same folder and the changes aren't saved.. I dunno- it must not be the same once it's not on the same system that it was infected on. __________________

Jun 12, 2004, 09:13 PM	Thread Starter #74
BWX unplugged Join Date: Nov 2002 Location: USNY Posts: 19,665 Rep Power: 109 System Specs	I can't even get that security tab to show up for some reason-- really bugging me. I turned on file sharing, I removed check from that simple shares setting too- I don't know what else to do.. I'll have to do some searching. I guess it was a coincidence that I saw that funny.exe file the same time I noticed that ntlanman trying to access the internet-- Now that I think about it, I think it was a website that got me somehow, because I didn't even open any emails when that started happening.. All of it is very strange. __________________

Jun 12, 2004, 09:53 PM	Thread Starter #78
BWX unplugged Join Date: Nov 2002 Location: USNY Posts: 19,665 Rep Power: 109 System Specs	http://www.dbforums.com/archive/index.php/t-960939.html --Dave "I installed XP Pro (SP1) as a new install over an XP Home installation and several folders and files are inaccessible no matter how I set permissions. One article I read on making such folders/files accessible suggested a change in the Security section of Properties. Right- clicking any folder/file on my machine and selecting Properties shows no Security tab. So after further research, several articles suggest going into My Computer, choosing Tools-Folder Options-View and deselecting Use Simple File Sharing (recommended) and clicking OK to apply the change. This, in theory, would make the Security tab appear. All articles agreed on this. But after following those instructions, I still have no Security tab and am becoming frustrated at no being able to acces my files. Short of backing-up and reformatting as FAT32 instead of NTFS, is there any other way to make these folders/files accesible again? Any help would be greatly appreciated. Thank you" So it is something to do with that I think-- Oh well- I'll keep searching. __________________

Jun 13, 2004, 12:57 PM	Thread Starter #85
BWX unplugged Join Date: Nov 2002 Location: USNY Posts: 19,665 Rep Power: 109 System Specs	Well it worked, so that's cool.. __________________

Jun 12, 2004, 04:33 PM	#64
PangingJr Member Join Date: Mar 2003 Posts: 5,989 Rep Power: 69	OK, compress the funny file with password and email the compressed file to me.

Jun 12, 2004, 06:41 PM	#66
PangingJr Member Join Date: Mar 2003 Posts: 5,989 Rep Power: 69	the funny file is nothing really, running this file wont make any change to your system, only a few MRU registry changes, it's for a record in windows just like you open a text file. you can delete it. you can make this file yourself and test it... create a .txt file then rename it to .exe.. just like the funny2.exe and funny3.exe...

Jun 12, 2004, 06:49 PM	#67
PangingJr Member Join Date: Mar 2003 Posts: 5,989 Rep Power: 69	email the ntlanman.exe to me if you still have it. it's the real one.

Jun 12, 2004, 07:31 PM	#73
PangingJr Member Join Date: Mar 2003 Posts: 5,989 Rep Power: 69	Set Owner/Set Permissions. You may not be able to delete a file if the file uses an Access Control List (ACL). To resolve this issue, change the permissions on the file. You may have to take ownership of the files to be able to change the permissions. Administrators have the implicit ability to take ownership of any file even if they have not been explicitly granted any permission to the file. File owners have the implicit ability to modify file permissions even if they are not explicitly granted any permissions to the file. Therefore, you may have to take ownership of a file, give yourself permissions to delete the file, and then delete the file. note-- NTFS treats folders as a special type of file. Therefore, the word "file" indicates either a file or folder. That's one of the reason that you cannot delete a file in NTFS, see if you can change it then try removing the file.

Jun 12, 2004, 09:17 PM	#75
PangingJr Member Join Date: Mar 2003 Posts: 5,989 Rep Power: 69	but you can see the security tab on any other files/folders ?

Jun 12, 2004, 09:52 PM	#77
PangingJr Member Join Date: Mar 2003 Posts: 5,989 Rep Power: 69	lol

Jun 13, 2004, 12:43 AM	#82
PangingJr Member Join Date: Mar 2003 Posts: 5,989 Rep Power: 69	you must be running NTFS as your file system otherwise the Security tab wont be there. if you like to remove the file or the other files you wil have prob with you can use a free file utility called GiPo@MoveOnBoot, it'll delete the file on the next system boot. go to the program site - http://www.gibinsoft.net/gipoutils/ -> File Utilities -> GiPo@MoveOnBoot -> Old Version (Freeware).

Jun 13, 2004, 09:30 AM	#84
PangingJr Member Join Date: Mar 2003 Posts: 5,989 Rep Power: 69	hmm there must be something , maybe alot of thing they don't know. why don't you ask them to put it on their site ?/ lol

Jun 14, 2004, 12:56 PM	#88
PangingJr Member Join Date: Mar 2003 Posts: 5,989 Rep Power: 69	you were good at checking yourself as i saw on your initial post, everything is in there and it was good...

Jun 14, 2004, 01:53 PM	Thread Starter #89
BWX unplugged Join Date: Nov 2002 Location: USNY Posts: 19,665 Rep Power: 109 System Specs	Yeah I think we found a new virus/adaware/worm/trojan type thing, or at least one that nothing detects except people paying attention to their firewalls.. I just noticed in my logs when I turned on my PC that something was trying to ICMP out, it could not do it because I block ALL ICMP in and out. It was ntoskrnl.exe in Windows\system32\ -but I looked at the fie and it looks like a normal file.. Weird. svhost.exe from the same folder also tried to ICMP out- they looked like they were trying to ICMP to my own ISP server, so it's probably nothing..