New domains / workgroups aopearing in our MS Network

We had something odd happen in the last day or two. Some unusual
domain/workgroup names appeared in our Microsoft Network family in the
network places area. They had some interesting names that indicated a german
origin, like MSHeimNetz, and a german looking surname. My question is what
happens that causes items in that folder? We tried clicking on them, but they
dont respond. They also just disappeared. I feel like we've been hacked.

Does any of this scenario sound familiar?

Joseph
Wed Sep 13 16:26:39 CDT 2006

Sept. 13, 2006

Definitely sounds like a hack to me... if you are using a wifi network,
check and make sure unauthorized computers haven't connected to your
router... and perhaps change your router password.

If you are using a wired network, then check and make sure nobody's
connected another computer to it.

Lastly, to see if this is a hack... I'd take some of those names and input
them into google or msn search... "MSHeimNetz" pulls up some very
interesting search results, but unfortunately I don't speak German.

A friend pointed me to a language tranlsation web site...
http://babelfish.altavista.com - try sticking some search results into there
from those weird names.

Good luck!

--

Joseph Bittman
Microsoft Certified Solution Developer
Microsoft Most Valuable Professional -- DPM

Blog/Web Site: http://CactiDevelopers.ResDev.Net/
"Scott Berger" <Scott Berger@discussions.microsoft.com> wrote in message
news:05822261-B625-4DE7-8C42-27C87E6A64CC@microsoft.com...
> We had something odd happen in the last day or two. Some unusual
> domain/workgroup names appeared in our Microsoft Network family in the
> network places area. They had some interesting names that indicated a
> german
> origin, like MSHeimNetz, and a german looking surname. My question is what
> happens that causes items in that folder? We tried clicking on them, but
> they
> dont respond. They also just disappeared. I feel like we've been hacked.
>
> Does any of this scenario sound familiar?
>

Steven
Wed Sep 13 19:28:29 CDT 2006

One possibility is that someone put a computer like a laptop on your network
with those workgroup names or VPN into your network with the same. Entries
in My Network Places require port 137 access and use mostly broadcasts to
maintain the browse list. You might want to check your wins database, DHCP
leases, and DNS records to see if you find any unusual computer names that
may provide a clue. Though what happened is curious it does not necessarily
mean that your network has been compromised.

Steve


"Scott Berger" <Scott Berger@discussions.microsoft.com> wrote in message
news:05822261-B625-4DE7-8C42-27C87E6A64CC@microsoft.com...
> We had something odd happen in the last day or two. Some unusual
> domain/workgroup names appeared in our Microsoft Network family in the
> network places area. They had some interesting names that indicated a
> german
> origin, like MSHeimNetz, and a german looking surname. My question is what
> happens that causes items in that folder? We tried clicking on them, but
> they
> dont respond. They also just disappeared. I feel like we've been hacked.
>
> Does any of this scenario sound familiar?
>