Avatar of ghost123
 asked on

IPC$, Admin$, C$ shares deleted and cannot print


I have a Windows 2000 Server SP4 that is giving me grief.

All the default shares are being deleted. I can type for example net share admin$ and the share comes back for about 5 seconds or so but then goes again.

A net share command does not list any of the default shares.

Typing net share c$ produces the error this shared resourcse does not exist

The server is running norton corp 7.5 and although old is bang up to date with the definitions. I have run an online scan from www.antivirus.com and a scan with free.grisoft.com but all come back clean. I have also run spybot search and destroy and trojan remover.

Nothing seems to be loading in the run key of current_user or local_user

printing works from the server but no-one can print from a client (printers shared from server)

computer management from an xp machine to the server is not allowed - cannot be managed. the server is not configured for transactions

i have found this other article https://www.experts-exchange.com/Networking/WinNT_Networking/Q_21610013.html that sounds exactly like our problem but no viruses have been found :(

any ideas??

pretty desperate on this one
Windows Networking

Avatar of undefined
Last Comment

8/22/2022 - Mon
Lee W, MVP

Have you checked the event logs?  Are there any unrecognized Services?  


and have it do a startup list you can check.


Check the event log for services that have failed to start (System log).  Also check for freespace on the OS partition (normally C:).  Lack of freespace can prevent a number of services from starting.
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck

Lack of freespace can also prevent a server from building sessions with client machines.


Nothing obvious in the logs and plenty of disk space.

Forgot to mention that the firewall is showing 7500+ connections so definitely a virus of some sort.

I have temporarily (permanently??) resolved the issue now. I ran sysclean from NAI and although it found no viruses, within seconds of it running the internet connections on the firewall tumbled down to 5 connections. I recreated the shares and they all stayed :)

I can only assume a process was running that sysclean terminated. Weird though that 5+ other antivirus scanners did not detect it!

Thanks for your help and apologies to sysexpert as I never got around to trying that link

Glad you resolved it.

Use the link and save the list of startups so you know what SHOULD be there as a base line.

Also do a WINMSD and save the entire results to a file as another reference baseline.

Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question