Norton Internet Security

[looch]

The command window you see is a DOS batch file that executes at start up. Are you using login scripts?

There are 3 places (that I'm aware of) to check:

The Startup folders (\documents and settings\user1, ..\user2, etc.)

The Windows registry (type regedit from the Run box). HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

And, the Windows login script folder (\winnt\system32\repl\import\scripts)

If you're not running scripts and you don't find anything in the startup folders, I would suggest downloading, installing and running Ad-Aware before playing in the Registry.

 

[Mrwurm]

Paul, I am not running any scripts that I am aware of. I do use adaware and I update it regularly using 'refupdate'. Recently, two trojan horse / backdoor programs slipped past norton. Norton did catch it at the next full-scan event (each friday) and quarantined and then deleted them. Maybe one of these programs left an entry in the start-up sequence to call the command window. (I am really guessing at this point)

This machine starts with administrator logged-in as default. No other user accounts are setup.

 

[kensfarm]

Mrwurm.. one thing to check as of "why Oscar? doesn't share files".. is your harddrive formatting.. I bet two of your PC's are formatted FAT32.. and the other is NTFS. NTFS can read the FAT32.. but the FAT32 can't read the NTFS. I have earthlink.. direct-duo satelite as well. I don't worry about running virus software.. haven't for 22 years.. most users get viruses from "free stuff" they download.. install on demand internet software.. or opening emails & attachments from people they don't know.. a regular backup of your systems would prevent any catastrophic damage a virus could cause. Viruses are the lunch ticket for those selling anti-virus software.. I wonder who keeps creating all those new viruses.. it's not Johnny down the street. A steady stream of new viruses = continued revenue for the anti-virus companies.

 

[looch]

The "FAT32 can't read NTFS" doesn't apply across the network - only within partitions on the same machine.

Jerry, The "startup cmd.exe" thing may actually be a legitimate program - it would just be nice to confirm this.

The best way to test this stuff is to start with bland equipment. Remove any unecessary programs and definitely stop your firewall. I don't have experience with Internet Connection Sharing, but is it necessary to have a software firewall on every machine (as opposed to having it only on the one sharing the connection)?

 

[Mrwurm]

Good question, I am not sure if I really need the firewall on the client computers. I would gladly get rid of it. What bugs me the most is the intermittant nature of these problems. Oscar used to share files, now won't do it. Yesterday, I reconfigured the udp and tcp port permissions and all the internet connections started working. Rebooted all computers and they all still had a connection. Shut them off for the night. Today, according to the wife, only the host has an internet connection. /forums/images/graemlins/frown.gif Seems that whatever I fix does not stay fixed.

 

[looch]

I think you're dealing with more than one problem on more than one machine.

I'd start fresh with just Windows basic networking running on two machines. Get them talking and then add the third. Then ICS, then firewall. Step by step - reversing when something stops working.

 

[kensfarm]

Here's some info for the cmd.exe file..

Process File: cmd or cmd.exe
Process Name: Windows Command PromptMicrosoft Windows Command Prompt. Unlike the old command.com, cmd.exe is a 32bit command prompt used in WinNT/2000/XP

I have seen problems where unless your harddrive is formatted NTFS.. the operating system will not let you turn on the file sharing and security functionality. (Ex. XP)

Jerry.. I would def. say you don't need a firewall at all.. directduo or direct way.. does not allow (users) to have/setup a VPN connection.. it would hog-up too much air time. I don't believe there is any way.. an outside user on the internet could connect through your satelite to get into your PC. Dial up connection - yes. I would get rid of norton.. the firewalls.. and go online to direct way's home page. They should have a online help to show you how to share your high speed connection to the other PC's in your house.

 

[r0GuE]

If you opened up all your ports, you are not too secure anymore. But I take it from your posts that you are desperatly seeking connection not security.
GRC makes a nice free product that asks you what you want blocked as you use it. As for virus software, I use it and you should too. The viruses of today are much more sophisticated and do not need to be downloaded. They can hook you while you surf via Java etc or you can get them from an e-mail. You gotta have it or your a drone waiting to happen (drone being a pc slave to a hacker). Then they launch attacks from your PC.
Go to GRC... Read.... Learn.
If you are really interested in this stuff.. check out www.SANS.ORG
I am a GIAC intrusion analyst through SANS. It's groovy world full of bad guys out there. They knock on our door all day every day. These automated tools really make just about anybody dangerous.

 

[Mrwurm]

Thanks to all. I'm dealing with a ruptured pressure tank for my well today. It's always something /forums/images/graemlins/frown.gif

 

[Mrwurm]

</font><font color="blue" class="small">( Any errors in the Event viewer (start, settings, control panel, administrative tools, event viewer)? If the server service doesn't start (you can see if it's running by checking under services in administrative tools), you won't be sharing anything.
)</font>
Ok, sorry it took me so long to get back to this. I see some errors related to 'server' in the event viewer. Specifically, one at startup each morning.
I went to 'services' in administrative tools and 'server service' is set for automatic but it is not running. I clicked 'start' and it started up. Oscar can now share files. I rebooted and Oscar still shares files. I did'nt change anything other than to force it to start manually one time. The real test is to see if it works tomorrow when all the machines are started in the morning. /forums/images/graemlins/crazy.gif