[vox-tech] Disturbing XP Error Message

[Jeff Newmiller]

On Wed, 13 Jul 2005, Robert G. Scofield wrote:

> My son runs Windows XP.   He is home for the summer.  During the school year 
> his laptop has been connected to the U.C. Santa Cruz dorm "Resnet" system.  
> At home his laptop is in his room where he has a wireless connection to the 
> Internet by way of a router.
> 
> Recently he has been getting this very disturbing error message when he shuts 
> off his computer:
> 
> "Other people are logged on this computer.  Shutting down Windows might cause 
> them to lose data.  Do you wish to continue?"
> 
> He says that he is not connected to any file sharing programs or computers.  
> I've heard that XP itself spies on its users.  Does anybody have an idea of 
> what's going on here?

This message usually arises from other computers browsing his computer
through CIFS.  It sounds like he has anonymous filesharing enabled or he
has a guest account.  I have also seen Norton Antivirus use a separate
login to run antivirus tests.

It is not normally feasible to use CIFS (windows networking) through a
firewall (your router), but he might have a backdoor installed from being
in such a hostile environment at school.  Or, your use of samba (CIFS) may
be triggering this. Or NAV might be running a test.

I can't figure out how to reliably check who is logged on in XP.  CIFS
users can be identified through netbios (nbtstat -s -a yourcomputername
... the users are <03> entries, but beware that the computer itself uses
an 03 entry) but fast switching users like the Norton login seem to use
terminal services which I don't know how to monitor other than "log out
fast switch" and look at the list.  Linux users and processes are so much
easier to understand. :-P

---------------------------------------------------------------------------
Jeff Newmiller                        The     .....       .....  Go Live...
DCN:<jdnewmil at dcn.davis.ca.us>        Basics: ##.#.       ##.#.  Live Go...
                                      Live:   OO#.. Dead: OO#..  Playing
Research Engineer (Solar/Batteries            O.O#.       #.O#.  with
/Software/Embedded Controllers)               .OO#.       .OO#.  rocks...1k
---------------------------------------------------------------------------