JMFCAMPOS
asked on
Mapped Drive Access Denied
Hi.
I have a File Server (Win2000 server), and XP pro Workstations (clients). The Clients access information on the server using drive map. I never had problems with the maps, but suddenly the following becames to happen:
Some times, not allways, when I map a drive on the client (map to a drive on the Fileserver) if I doubleclick the mapped drive i receive the message "Access is Denied". But if I rightclick and choose "explore" or "Open" from the context menu everything works fine.
Can someone help me with this please?
I have a File Server (Win2000 server), and XP pro Workstations (clients). The Clients access information on the server using drive map. I never had problems with the maps, but suddenly the following becames to happen:
Some times, not allways, when I map a drive on the client (map to a drive on the Fileserver) if I doubleclick the mapped drive i receive the message "Access is Denied". But if I rightclick and choose "explore" or "Open" from the context menu everything works fine.
Can someone help me with this please?
On the affected client open regedit:
Browse to: HKEY_CURRENT_USER\Software
Expand that key and under that you get a list of all your mapped drives. (ie ##servername#share)
Ensure that there are no subkeys called "shell" under your mapped drives...if so delete them and try and open again.
Browse to: HKEY_CURRENT_USER\Software
Expand that key and under that you get a list of all your mapped drives. (ie ##servername#share)
Ensure that there are no subkeys called "shell" under your mapped drives...if so delete them and try and open again.
ASKER
Hi frostburn.
That works. After delete the subkey "shell" I can open the map drive with a mouse "double click".
But still, I get the same error after I disconnect the mapped drive and then map again.
There is some way to prevent this ?
That works. After delete the subkey "shell" I can open the map drive with a mouse "double click".
But still, I get the same error after I disconnect the mapped drive and then map again.
There is some way to prevent this ?
It is caused by a trojan...normally the antivirus will pick it up and remove it leaving only the registry entry we deleted earlier...I would scan the affected machines with latest virus definitions and then delete the registry keys if needed.
Also keep an eye open for autorun.ini files in the root of your mapped drives.
If you open your taskmanager and see a process called RavMon.exe then it is also a sign you are still infected.
Note: This happens to flash drives a lot too.
Also keep an eye open for autorun.ini files in the root of your mapped drives.
If you open your taskmanager and see a process called RavMon.exe then it is also a sign you are still infected.
Note: This happens to flash drives a lot too.
ASKER
Hi frostburn,
In fact I've found a file named autorun.inf in the root of the mapped drives.
Is this caused by the trojan? Can you tell me what's the name of that trojan?
In fact I've found a file named autorun.inf in the root of the mapped drives.
Is this caused by the trojan? Can you tell me what's the name of that trojan?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
This solution works perfectly.....just suffered the same issue.
Cleared Autorun files off the shares and, in this case a folder called ms.config
Remove Registry Keys from all client PC's and now working, McAfee had cleared up the virus, but not properly!
Cleared Autorun files off the shares and, in this case a folder called ms.config
Remove Registry Keys from all client PC's and now working, McAfee had cleared up the virus, but not properly!
Check the share and folder permisions on the folder on the server.
eb