RE: Unknown workgroup in Microsoft Windows Network

if you're running a WINS server i'd have a look at that database.

-d

-----Original Message-----

From: gary_palmer@attbi.com [mailto:gary_palmer@attbi.com] Sent: Tuesday, November 12, 2002 1:13 PM To: focus-ms@securityfocus.com
Subject: Unknown workgroup in Microsoft Windows Network

Recently a new workgroup name appeared in our organizations "Network Neighborhood > Microsoft Windows Network" The workgroup or domain is called "Gotcha." Not a particularly pleasing name for a workgroup.

Having verified that no staff members have plugged in new hardware recently,

and verifying that there are no unauthorized logins to our wireless network,

I'm somewhat at a loss to explain this. I found information on an SMB hack that, as a side-effect causes a rogue workgroup to show up in Network Neighborhood in order to sniff cleartext passwords from Windows 95 machines,

but our firewall blocks ports 137 and 139, and there's nothing unusual in the
firewall logs.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

My question is this--what's the best way to track down an IP address associated with a domain or workgroup listing in Network Neighborhood. Is this
possible? This would at least give me an idea of where on the physical network
this is coming from. Does anyone have recommendations on tracing this problem?

Thank you,

Gary

--

gpalmer@attbi.com Received on Wed Nov 13 11:24:50 2002