Solved

File share pop up for Windows media player

Posted on 2011-09-17
10
687 Views
Last Modified: 2013-11-16
Hello Experts,

I was working on my pc suddenly I got a file share pop up for Windows media player.

Attached is the screen shot...

I dont want to share , I am not sure why this happen ......... this is a kind of hack ???? POPUP
0
Comment
Question by:Swadhin Ray
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
10 Comments
 
LVL 38

Expert Comment

by:BillDL
ID: 36555959
OK, so I immediately recognised this as an Indian name "Vaibhav Baweja".
Do you know anybody by this name?
Do you have any "Peer To Peer" File Sharing applications installed?

If you have other computers in your home, check the Computer Name of each and make sure none of them are "VAIBHAVBAWEJA", because this looks to be the Computer Name of somebody who appears to be "on your network".  You have either shared something with this computer in the past, you are allowing your playlists to be shared, or you are possibly being hacked from outside or by malware running on your computer.

If you still have that dialog opened, then click the "Sharing Settings" button and UNTICK "Share My Media".  Leave the "Display future notifications" box TICKED for now so you are alerted if this doesn't stop the requests.

If the dialog is closed, then open Windows Media Player, go to the Tools > Options > Library tab (or equivalent if your media Player version is different), and click the "Configure Sharing" button.

You might also want to tighten up the settings under the "Security" tab, such as disabling "Script Commands".  WMV and other multimedia files can have scripted data embedded, and it can sometimes be malicious.

Right-Click My Computer > Properties > Remote tab.  Disable Remote Desktop Connection both ways.

Right-Click My Computer > Manage > Shared Folders.
Any unusual folders being shared other than those for "administrative purposes?
What about "Sessions" and "Open Files"?

Check your Firewall and tighten up what programs, functions, and ports are enabled.

I suggest that you run a FULL scan for viruses using your current Anti-Virus application after updating it, and follow that up with a scan using MalwareBytes, which seems to catch a lot more than others:
http://www.malwarebytes.org/mbam-download.php

I see that you are conversant with SQL.  Amongst my quick searches I found someone named Vaibhav Baweja who posted a MySQL tutorial in scribd.com:
http://www.scribd.com/vaibhav_baweja

India is a huge place with a massive population, and a lot of IT people, so therefore it is not a surprise to find a number of IT people with that same name in Facebook, LinkedIn, and Google Plus. It is also not inconceivable that someone with that Computer Name has driven past your houes with a laptop and connected to your Wireless Router, if you have one.

Here's some of the people named Vaibhav Baweja that I found (Short URLs used to stop google indexing).  Perhaps you have communicated, shared Facebook Applications or music, or allowed Remote Desktop Connection in the past and been compromised intentionally or unintentionally:  

Vaibhav Baweja
Vaibhav Baweja
Vaibhav Baweja and Vaibhav Baweja
Vaibhav Baweja and Vaibhav Baweja and Vaibhav Baweja
Vaibhav Baweja and Vaibhav Baweja and Vaibhav Baweja
Vaibhav Baweja
Vaibhav Baweja
Vaibhav Baweja
0
 
LVL 16

Author Comment

by:Swadhin Ray
ID: 36556008
>> OK, so I immediately recognised this as an Indian name "Vaibhav Baweja".
Yes true


>>Do you know anybody by this name?

No

>>Do you have any "Peer To Peer" File Sharing applications installed?
NO

>> If you have other computers in your home, check the Computer Name of each and make sure none of them are "VAIBHAVBAWEJA", because this looks to be the Computer Name of somebody who appears to be "on your network".  You have either shared something with this computer in the past, you are allowing your playlists to be shared, or you are possibly being hacked from outside or by malware running on your computer.

Dont have this name for other computers.And never shared anything on network.

>>If the dialog is closed, then open Windows Media Player, go to the Tools > Options > Library tab (or equivalent if your media Player version is different), and click the "Configure Sharing" button.

Done this

>> You might also want to tighten up the settings under the "Security" tab, such as disabling "Script Commands".  WMV and other multimedia files can have scripted data embedded, and it can sometimes be malicious.

Done this attached screen shot
 setting
>>Right-Click My Computer > Properties > Remote tab.  Disable Remote Desktop Connection both ways.

Done this attached screen shot as below:
Setting 2

Right-Click My Computer > Manage > Shared Folders.
Any unusual folders being shared other than those for "administrative purposes?
What about "Sessions" and "Open Files"?

In this only session and open files dont have anything under that  but what I see under Shared folder is in the attached file is as below:
 shared folder
0
Instantly Create Instructional Tutorials

Contextual Guidance at the moment of need helps your employees adopt to new software or processes instantly. Boost knowledge retention and employee engagement step-by-step with one easy solution.

 
LVL 16

Author Comment

by:Swadhin Ray
ID: 36556010
Sorry the other screen shot as below media share
0
 
LVL 16

Author Comment

by:Swadhin Ray
ID: 36556011
Just wanted to know anything I need to do on shared folders?
And I did a full scan but didn't found anything on my system.
0
 
LVL 38

Expert Comment

by:BillDL
ID: 36556025
The shares in the last screenshot are very standard ones.  The media player dialog in your original question is being very specific about this being a request to share your Windows Media Player Library, so I think you have done about as much as you can as far as that particular aspect.

If you use the built-in Windows Firewall, then open it and have a look at what is enabled.  Consider restricting as much as you can meantime and leave the "notify me" box ticked so that you can assess each attempted access and allow or deny as it occurs.  You will soon enough know what you need to leave open after using the computer for a while.  There are plenty of online articles describing what each of the firewall settings are for, so no need to describe them all here.

If you use another firewall like ZoneAlarm, then look at the logs and see what traffic or programs were allowed or blocked at the time you saw the dialog.

I would now do a complete system scan with your current Anti-Virus application and then use malwareBytes, just to be sure you don't have some rogue application running.  If anything is detected, then we can take it from there.
0
 
LVL 38

Accepted Solution

by:
BillDL earned 400 total points
ID: 36556046
I see from your last screenshot that the Firewall is OFF.  I suggest that you turn it on and configure it, or leave it off and install an alternative.  I can't recommend any other than the free ZoneAlarm, because I haven't really considered that I need anything else on my own computers.  

Using a Firewall does require, to some extent, a knowledge of what is a legitimate program or process if and when an attempt is made to access your computer from outside or send data from your computer to the outside and such activity has been blocked with the setting to notify you enabled.

ZoneAlarm, for example, will scan through as many of your installed programs and Windows programs during setup, and will add them to a list and (as far as I recall) set them all to a question mark so that you are prompted about it on first use so that you can allow once or always, or deny once or always.  It's a learning process until it settles down, but the next time you update Acrobat Reader, Flash Player, etc, it will prompt you because the program is now a new version.  I am content to liev with this because I have an intimate knowledge of my computers, the operating systems I run, and my installed programs, but I would call myself a very advanced user and this will not apply to the vast majority of home users who would be overwhelmed and flummoxed by the pop-ups.

The Windows Firewall is less of a "learn and set as you go" affair than ZoneAlarm.  You either set everything as tight as a duck's ass and leave it to prompt you so you can accept or deny next time something asks to come in or go out, or you set it to default settings and it creates a general configuration that suits most peoples' use.

There is also a Firewall in most DSL modems and you can access the internal settings in your web browser using the internal IP address which is often http://192.168.1.1
This usually requires a password, and the firewall settings don't always have full descriptions, so you usually have to consult the modem user manual for the details.
0
 
LVL 44

Assisted Solution

by:Darr247
Darr247 earned 100 total points
ID: 36556317
I think you should turn off File and Printer Sharing and Public folder sharing for the Public network profile in
Control Panel -> Network and Internet -> Network and Sharing Center -> Advanced sharing settings (that's in the menu on the left)... then Media Center will stop advertising that you have shares available.

It's fine to leave those turned on when connected in your Home or Work profile. If it says Home or Work is the (current) profile, then "VaibhavBaweja" is connected to your homegroup or your work LAN. Or, possibly you have identified a network as a Home or Work location by mistake when it should have been set as Public.
0
 
LVL 16

Author Closing Comment

by:Swadhin Ray
ID: 36556965
Thanks a lot.. of all your help..
0
 
LVL 38

Expert Comment

by:BillDL
ID: 36557096
Thank you slobaray
0

Featured Post

Enroll in July's Course of the Month

July's Course of the Month is now available! Enroll to learn HTML5 and prepare for certification. It's free for Premium Members, Team Accounts, and Qualified Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Configuring Remote Assistance for use with SCCM
Sometimes clients can lose connectivity with the Lotus Notes Domino Server, but there's not always an obvious answer as to why it happens.   Read this article to follow one of the first experiences I had with Lotus Notes on a client's machine, my…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question