Every time I look at the "sharing" status of my C: drive I set it back
to "not shared", but a few hours later it will have reverted to
"shared" again.  Any idea how I can track down which program is
resetting this?  Or is there some way of stopping any program doing
this?

I am operating a Toshiba notebook PC with Windows 2000 Professional
(fully up to date with all Windows Updates)+ Zone Alarm firewall +
McAfee Virus checker (all 100% up to date).  I also run 30-40 other
programs, so it would not be easy to disable them individually and see
when it happens.

I assume with the ZA firewall, I am not really in any danger if the C:
drive becomes "shared" (or am I wrong?) but I would like to get to the
bottom of this.

---

Request for Question Clarification by joseleon-ga on 11 Sep 2002 23:57 PDT

Hello, dogbreath:
 Take a look at this article, and try to disable the sharing service:

Securing shared drives
http://www.microsoft.com/windows2000/en/server/help/default.asp?url=/windows2000/en/server/help/ntshrui_security.htm

This is not a solution because you could not share information over
the net, but I don't know of any program that shares a drive without
user permission. It could be a trojan or a virus, but with McAfee and
Zone Alarm, you seem to be pretty secure.

Tell me your experience disabling the service.

Regards.

---

Clarification of Question by dogbreath-ga on 12 Sep 2002 11:36 PDT

Thanks very much for this clarification request and the comment from
jeroemb. It looks like my "problem" is not actually a problem, so I
can relax on that issue.  I have reduced the list price on this
question from $20 to $10 as the question turned out to be a smaller
issue than I had expected.  Do feel free to click on the "answer"
button to collect the money ('joseleon' that is)as I have an answer of
sorts now which I am happy with.

Hello, dogbreath: 
 Thanks a lot for your words, and I'm happy you found my information
useful, as you can read on the article I posted:
 
Securing shared drives 
http://www.microsoft.com/windows2000/en/server/help/default.asp?url=/windows2000/en/server/help/ntshrui_security.htm

"In Windows 2000, all drives on your computer, such as drive C or D,
are automatically shared using the name drive letter$, such as C$ or
D$. These drives are not shown with the hand icon that indicates
sharing in My Computer or Windows Explorer, and they are also hidden
when users connect to your computer remotely."

Also it says how to disable the sharing service, which I strongly
recommend if you don't need it, there are many ways a 'hacker' could
get profit of this service.

Here are a couple of links:

How to configure shared Windows folders for maximum network protection
http://service2.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2000091415173339

Windows 2000 Security Checklist 
http://www.labmice.net/articles/securingwin2000.htm


Search strategy

windows 2000 share drive
://www.google.com/search?hl=en&lr=&ie=UTF-8&q=windows+2000+share+drive&spell=1

Regards.

Thanks for the answer which is fine.

Windows 2000 shares your drives by default, but don't worry they're
not shared with access for everyone by default. The shares are being
reset by Windows 2000 itself, which creates the shares for easy
administrative access for domain administrators.

If you want, you can turn it off like this:

Right-click on the drive and choose Sharing. Rename the sharename from
"C$" to "C". Click OK. Then right-click on the drive again, this time
you can set it to not shared without Windows 2000 resetting it. The $
in the sharename causes Windows 2000 to do this.

Hope this helps, I'm on Windows XP right now so I can't verify it
directly.