The administrative shares can be deleted by a user with Administrators membership but the administrative shares will be recreated automatically at the next reboot.
The following registry configuration change e.g. using Regedit can completely hide all administrative shares. If the setting is not present then you must create it.
Servers
Windows NT 4.0 Server, Windows 2000 Server, Windows Server 2003
Hive: HKEY_LOCAL_MACHINE
Key: SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
Name: AutoShareServer
Data Type: REG_DWORD
Value: 0
Clients
Windows NT 4.0 Workstation, Windows 2000 Professional, Windows XP
Hive: HKEY_LOCAL_MACHINE
Key: SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
Name: AutoShareWks
Data Type: REG_DWORD
Value: 0
How to disable
Microsoft does not detail any method to disable administrative shares. The command:
NET SHARE C$ /delete
Can be executed in order to disable the root share in a networked computer. The problem is that after a reboot, the share will be automatically recreated.
A common workaround is to create a batch file with commands to disable all administrative shares (they can be viewed by running the "NET SHARE" command), and then scheduling the script to run at every system startup by using the Windows Task Scheduler.
Usually, the following commands, under a batch file, can successfully disable shares on a Windows XP or Windows Vista system:
NET SHARE C$ /delete
NET SHARE D$ /delete
NET SHARE admin$ /delete
Preventing access
Disabling the Administrative shares mitigates many known security
risks. For example, viruses such as Conficker Worm performs dictionary attacks on Administrative shares.
Alternative approaches to prevent remote browsing of the disk contents include:
* Remove "Administrators" from the Security tab of the drive in question. This will prevent any external local admin from accessing the drive yet still allow the local admin access
* disable File and Printer Sharing (or unbind the NetBT protocol)
* Stop and/or disable the Workstation service
* set IPSec block rules that prevent inbound connections on 445/tcp and 445/udp
* remove membership in the Administrators group for those users/groups you wish to block
* encrypt the files that must remain confidential using a file-based encryption technology (such as EFS or RMS) that requires access to per-user decryption keys to gain access to plaintext contents of the files
IPC$ Share Null Session Exploit
What is the IPC$ share exploit and how to exploit it…
What is the IPC$ Share?
IPC stands for Inter-Process Communication. This share is used for data sharing between applications and computers. With this share a hacker can take total control of a PC. It has been said that one group of individuals on the net managed to dominate an entire companies network through a single persons PC. This exploit can be discovered easily with many NSS, the one i prefer using is GFI.
How a hacker abused the exploit?
So firstly we have established using our NSS that the IPC$ share is available, we also have the admin password (during writing this article i discovered that the target machine had no admin password, however using a program like the big red button or the Net Bios Auditing tool you can obtain this)
Using the NET commands within DOS we can find and map to shares on remote computer.
Now when going for an NT machine make sure port 139 is open, this can be found out using a normal port scanner, open up DOS and type in the following:
C:\>NET USE \\TARGET\IPC$ “” /USER:”"
This is basically saying you want to use the IPC share on the specified target with the password “” and the user name “”. Now we have just asked to make a null session on the target share. Chances are slim that you will obtain it like this so its always handy when the admin password has not been set . When you want to log in as an administrator to the share you would type in the following:
C:\>NET USE \\123.213.123.123\IPC$ “” /USER:Administrator
This is stating that you want to connect under the local account “Administrator” with no password.
After starting a null connection you could try to access the hidden shares. The default hidden shares are: C$, PRINT$, ADMIN$, IPC$. These folders will be invisible to the average user due to the $ sign being placed at the end. Sometimes shares don’t have passwords so you can use them without the admins password. Null sessions raerely get you onto shared folders as its not all that dissimilar from a homeless man asking for the keys to the playboy mansion. Null sessions have very little rights on the system.. Next you could try using net view. To do this open the DOS window and type:
C:\>net view \\123.123.123.123 <— This will display all shares on this machine (WILL NOT DISPLAY THE IPC$ OR ANY OTHER SILENT SHARES)
C:\>net view /workgroup:MSHome <— Same as above but for workgroups Replace “MSHome” with the name of the workgroup
C:\>net view /domain:Domain <— Same as above but with domains Replace “Domain” with the domain name.
source : whiskeycola
What is the IPC$ Share?
IPC stands for Inter-Process Communication. This share is used for data sharing between applications and computers. With this share a hacker can take total control of a PC. It has been said that one group of individuals on the net managed to dominate an entire companies network through a single persons PC. This exploit can be discovered easily with many NSS, the one i prefer using is GFI.
How a hacker abused the exploit?
So firstly we have established using our NSS that the IPC$ share is available, we also have the admin password (during writing this article i discovered that the target machine had no admin password, however using a program like the big red button or the Net Bios Auditing tool you can obtain this)
Using the NET commands within DOS we can find and map to shares on remote computer.
Now when going for an NT machine make sure port 139 is open, this can be found out using a normal port scanner, open up DOS and type in the following:
C:\>NET USE \\TARGET\IPC$ “” /USER:”"
This is basically saying you want to use the IPC share on the specified target with the password “” and the user name “”. Now we have just asked to make a null session on the target share. Chances are slim that you will obtain it like this so its always handy when the admin password has not been set . When you want to log in as an administrator to the share you would type in the following:
C:\>NET USE \\123.213.123.123\IPC$ “” /USER:Administrator
This is stating that you want to connect under the local account “Administrator” with no password.
After starting a null connection you could try to access the hidden shares. The default hidden shares are: C$, PRINT$, ADMIN$, IPC$. These folders will be invisible to the average user due to the $ sign being placed at the end. Sometimes shares don’t have passwords so you can use them without the admins password. Null sessions raerely get you onto shared folders as its not all that dissimilar from a homeless man asking for the keys to the playboy mansion. Null sessions have very little rights on the system.. Next you could try using net view. To do this open the DOS window and type:
C:\>net view \\123.123.123.123 <— This will display all shares on this machine (WILL NOT DISPLAY THE IPC$ OR ANY OTHER SILENT SHARES)
C:\>net view /workgroup:MSHome <— Same as above but for workgroups Replace “MSHome” with the name of the workgroup
C:\>net view /domain:Domain <— Same as above but with domains Replace “Domain” with the domain name.
source : whiskeycola
Quick .msc Shortcuts
Start > Run >
Certificates – certmgr.msc
Indexing Service – ciadv.msc
Computer Management – compmgmt.msc
Device Manager – devmgmt.msc
Disk Defragmenter – dfrg.msc
Disk Management – diskmgmt.msc
Event Viewer – eventvwr.msc
Shared Folders – fsmgmt.msc
Local Users and Groups – lusrmgr.msc
Removable Storage – ntmsmgr.msc
Removable Store Operator Requests – ntmsoprq.msc
Performance – perfmon.msc
Services – services.msc
Windows Management Infrastructure (WMI) – wmimgmt.msc
source : My Tech World
Certificates – certmgr.msc
Indexing Service – ciadv.msc
Computer Management – compmgmt.msc
Device Manager – devmgmt.msc
Disk Defragmenter – dfrg.msc
Disk Management – diskmgmt.msc
Event Viewer – eventvwr.msc
Shared Folders – fsmgmt.msc
Local Users and Groups – lusrmgr.msc
Removable Storage – ntmsmgr.msc
Removable Store Operator Requests – ntmsoprq.msc
Performance – perfmon.msc
Services – services.msc
Windows Management Infrastructure (WMI) – wmimgmt.msc
source : My Tech World
Remove RVHOST.EXE
This malware is known as Nuqel.A
How to remove RVHOST.EXE?
Delete these files if they exist:
C:\WINDOWS\SYSTEM32\RVHOST.exe
c:\windows\rvhost.exe
%all drives%\new folder.exe
C:\Windows\Tasks\At1.job
Go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run in the registry, and you need delete the entries which contain RVHOST.exe in them, or better yet, change them back to their appropriate paths.
Go to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
“DisableTaskManager” = 1 (CHANGE IT TO 0 )
“DisableRegistryTools” = 1 (CHANGE IT TO 0 )
Go to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
“nofolderoptions” = 1 (CHANGE IT TO 0)
Go to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule
“attaskmaxhours” = 0 (CHANGE IT TO 24)
You shouldn’t continue to get this threat once it’s deleted, unless you come into contact with it again. May I suggest using caution with flash drives, and dont open things that you are unsure about.
Delete these files if they exist:
C:\WINDOWS\SYSTEM32\RVHOST.exe
c:\windows\rvhost.exe
%all drives%\new folder.exe
C:\Windows\Tasks\At1.job
Go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run in the registry, and you need delete the entries which contain RVHOST.exe in them, or better yet, change them back to their appropriate paths.
Go to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
“DisableTaskManager” = 1 (CHANGE IT TO 0 )
“DisableRegistryTools” = 1 (CHANGE IT TO 0 )
Go to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
“nofolderoptions” = 1 (CHANGE IT TO 0)
Go to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule
“attaskmaxhours” = 0 (CHANGE IT TO 24)
Go to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"Shell" = Explorer.exe RVHOST.exe (CHANGE IT TO Explorer.exe)
source : My Tech World
How to remove RVHOST.EXE?
Delete these files if they exist:
C:\WINDOWS\SYSTEM32\RVHOST.exe
c:\windows\rvhost.exe
%all drives%\new folder.exe
C:\Windows\Tasks\At1.job
Go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run in the registry, and you need delete the entries which contain RVHOST.exe in them, or better yet, change them back to their appropriate paths.
Go to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
“DisableTaskManager” = 1 (CHANGE IT TO 0 )
“DisableRegistryTools” = 1 (CHANGE IT TO 0 )
Go to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
“nofolderoptions” = 1 (CHANGE IT TO 0)
Go to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule
“attaskmaxhours” = 0 (CHANGE IT TO 24)
You shouldn’t continue to get this threat once it’s deleted, unless you come into contact with it again. May I suggest using caution with flash drives, and dont open things that you are unsure about.
Delete these files if they exist:
C:\WINDOWS\SYSTEM32\RVHOST.exe
c:\windows\rvhost.exe
%all drives%\new folder.exe
C:\Windows\Tasks\At1.job
Go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run in the registry, and you need delete the entries which contain RVHOST.exe in them, or better yet, change them back to their appropriate paths.
Go to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
“DisableTaskManager” = 1 (CHANGE IT TO 0 )
“DisableRegistryTools” = 1 (CHANGE IT TO 0 )
Go to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
“nofolderoptions” = 1 (CHANGE IT TO 0)
Go to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule
“attaskmaxhours” = 0 (CHANGE IT TO 24)
Go to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"Shell" = Explorer.exe RVHOST.exe (CHANGE IT TO Explorer.exe)
source : My Tech World
What comes after the Terabyte?
8 bits = 1 Byte
What comes after the Byte ?
1024 Bytes = 1 Kilobyte
What comes after the kilobyte ?
1024 Kilobytes = 1 Megabyte
What comes after the Megabyte ?
1024 Megabytes = 1 Gigabyte
What comes after the Gigabytes ?
1024 Gigabytes = 1 Terabyte
What comes after the Terabytes?
1024 Terabytes = 1 Petabyte
What comes after the Petabytes ?
1024 Petabytes = 1 Exabyte
What comes after the Exabyte ?
1024 Exabyte = 1 zettabyte
What comes after the zettabyte ?
1024 zettabyte = 1 Yottabyte
source :
chaaban
wikipedia
Mediafire
For Example, to search all music files hosted on MediaFire type this in Google:
site:mediafire.com mp3|wma|ogg
Or for a specific artist, album or song include the artist, album or song name:
site:mediafire.com mp3|wma|ogg "type your artist, album or song name here"
For video files, use this:
site:mediafire.com asf|rm|avi|mp4|wmv|flv "type your artist, album or video name here"
For Comics, use this:
site:mediafire.com cbr|cbz "Comic name here"
For compressed file-archives and software:
site:mediafire.com rar|zip|exe "Search Query Here"
site:mediafire.com mp3|wma|ogg
Or for a specific artist, album or song include the artist, album or song name:
site:mediafire.com mp3|wma|ogg "type your artist, album or song name here"
For video files, use this:
site:mediafire.com asf|rm|avi|mp4|wmv|flv "type your artist, album or video name here"
For Comics, use this:
site:mediafire.com cbr|cbz "Comic name here"
For compressed file-archives and software:
site:mediafire.com rar|zip|exe "Search Query Here"
Subscribe to:
Posts (Atom)