Link to home
Start Free TrialLog in
Avatar of ghost123

asked on

IPC$, Admin$, C$ shares deleted and cannot print


I have a Windows 2000 Server SP4 that is giving me grief.

All the default shares are being deleted. I can type for example net share admin$ and the share comes back for about 5 seconds or so but then goes again.

A net share command does not list any of the default shares.

Typing net share c$ produces the error this shared resourcse does not exist

The server is running norton corp 7.5 and although old is bang up to date with the definitions. I have run an online scan from and a scan with but all come back clean. I have also run spybot search and destroy and trojan remover.

Nothing seems to be loading in the run key of current_user or local_user

printing works from the server but no-one can print from a client (printers shared from server)

computer management from an xp machine to the server is not allowed - cannot be managed. the server is not configured for transactions

i have found this other article that sounds exactly like our problem but no viruses have been found :(

any ideas??

pretty desperate on this one
Avatar of Lee W, MVP
Lee W, MVP
Flag of United States of America image

Have you checked the event logs?  Are there any unrecognized Services?  

and have it do a startup list you can check.

Avatar of CharliePete00

Check the event log for services that have failed to start (System log).  Also check for freespace on the OS partition (normally C:).  Lack of freespace can prevent a number of services from starting.
Lack of freespace can also prevent a server from building sessions with client machines.
Avatar of ghost123



Nothing obvious in the logs and plenty of disk space.

Forgot to mention that the firewall is showing 7500+ connections so definitely a virus of some sort.

I have temporarily (permanently??) resolved the issue now. I ran sysclean from NAI and although it found no viruses, within seconds of it running the internet connections on the firewall tumbled down to 5 connections. I recreated the shares and they all stayed :)

I can only assume a process was running that sysclean terminated. Weird though that 5+ other antivirus scanners did not detect it!

Thanks for your help and apologies to sysexpert as I never got around to trying that link
Glad you resolved it.

Use the link and save the list of startups so you know what SHOULD be there as a base line.

Also do a WINMSD and save the entire results to a file as another reference baseline.

Avatar of CetusMOD
Flag of Netherlands image

Link to home
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial