Phantom connections causing problems

Apology for a longish post. Is there a way to force supposedly open
files to be closed so they can be backed up?

This involves Win98 on peer-to-peer network. One computer is
"designated" server and has the main application and data accessed by
the other computers in the workgroup, whose OSes includes 98, 98SE and
XP Home. It has worked fine like this for several years.

Recently users started showing up (using Netwatch.exe --not the worm--a
Win98 program) as connecting to the "server" at times when nobody is
there, i.e., at 3am-5am, and their computers are not even on. More
recently, the application (a compiled Foxbase program) which requires a
separate login, shows one or more users as already logged in when they
try to login. Netwatch shows database files that are open. The timed
backup doesn't work right when this happens.

These erroneous logins are now happening several times a day. I want to
change the "server" to Win2000 or XP, but need to get a full copy of the
data (no "open" files).

Any suggestions?
TIA!

Larry Anderson

"Larry" <(E-Mail Removed)> wrote in message
news:_%%Mf.52360$(E-Mail Removed).. .
> Apology for a longish post. Is there a way to force supposedly open files
> to be closed so they can be backed up?
>
> This involves Win98 on peer-to-peer network. One computer is "designated"
> server and has the main application and data accessed by the other
> computers in the workgroup, whose OSes includes 98, 98SE and XP Home. It
> has worked fine like this for several years.
>
> Recently users started showing up (using Netwatch.exe --not the worm--a
> Win98 program) as connecting to the "server" at times when nobody is
> there, i.e., at 3am-5am, and their computers are not even on. More
> recently, the application (a compiled Foxbase program) which requires a
> separate login, shows one or more users as already logged in when they try
> to login. Netwatch shows database files that are open. The timed backup
> doesn't work right when this happens.
>
> These erroneous logins are now happening several times a day. I want to
> change the "server" to Win2000 or XP, but need to get a full copy of the
> data (no "open" files).
>
> Any suggestions?
> TIA!
>
> Larry Anderson

if you have users logging on when their computer is not on...you have
problems...

do a serious check for virus/malware , your server security is in
question...

Haggis wrote:

>
> if you have users logging on when their computer is not on...you have
> problems...
>
> do a serious check for virus/malware , your server security is in
> question...
>
>
Thanks. I have done several scans; we run AVG Network Edition Antivirus
(realtime scanner) and Spybot S&D and AdAware SE. One of the
workstations uses Norton AV. Nothing showed up but a couple of tracking
cookies, rated insignificant threats. I also ran the latest Stinger
download with negative results.

FWIW, we are also behind a hardware firewall. Checks by Shields Up
(GRC.com) shows complete stealth. AFAIK, we have only had one infection,
Netsky got in via e-mail. Stinger found and eliminated it.

Can you recommend something else to use?

Regards,
Larry

"Larry" <(E-Mail Removed)> wrote in message
news:yZbNf.42238$(E-Mail Removed)...
> Haggis wrote:
>
>>
>> if you have users logging on when their computer is not on...you have
>> problems...
>>
>> do a serious check for virus/malware , your server security is in
>> question...
> Thanks. I have done several scans; we run AVG Network Edition Antivirus
> (realtime scanner) and Spybot S&D and AdAware SE. One of the workstations
> uses Norton AV. Nothing showed up but a couple of tracking cookies, rated
> insignificant threats. I also ran the latest Stinger download with
> negative results.
>
> FWIW, we are also behind a hardware firewall. Checks by Shields Up
> (GRC.com) shows complete stealth. AFAIK, we have only had one infection,
> Netsky got in via e-mail. Stinger found and eliminated it.
>
> Can you recommend something else to use?
>
> Regards,
> Larry

here are a few places to look at ...I would be very interested to see how a
workstation is logging in when not on :> (btw logging onto which machine?)


netuse /d disconnects any network connections (if you wanted to copy
everything)
--
THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Richard Harper's Guide to Cleaning Pests
http://rgharper.mvps.org/cleanit.htm

PC Hell Spyware and Adware Removal Help
http://www.pchell.com/support/spyware.shtml

Haggis wrote:
>
>
> here are a few places to look at ...I would be very interested to see how a
> workstation is logging in when not on :> (btw logging onto which machine?)
>
>
> netuse /d disconnects any network connections (if you wanted to copy
> everything)

Thanks Haggis, I'll check out these links. The logons are reported by
Netwatch, on the Win98 machine "designated server", the one with the
application everyone uses. The "server" is used for little else but
administrative purposes. I can disconnect users from within Netwatch,
have not tried netuse /d.

Secretary reported this morning that a database function reported it
could not run because some files were open. That's with nobody else
using the program and no other connections reported via Netwatch.

I'm currently working (on a completely different machine) with Win2000,
installing the database program, and restoring data from backups. If the
new installation works as it should, the Win98 installation will soon be
history.

Thanks again,
Larry

"Larry" <(E-Mail Removed)> wrote in message
news:VOjNf.65013$(E-Mail Removed). ..
> Haggis wrote:
>>
>>
>> here are a few places to look at ...I would be very interested to see how
>> a workstation is logging in when not on :> (btw logging onto which
>> machine?)
>>
>>
>> netuse /d disconnects any network connections (if you wanted to copy
>> everything)
>
> Thanks Haggis, I'll check out these links. The logons are reported by
> Netwatch, on the Win98 machine "designated server", the one with the
> application everyone uses. The "server" is used for little else but
> administrative purposes. I can disconnect users from within Netwatch, have
> not tried netuse /d.
>
> Secretary reported this morning that a database function reported it could
> not run because some files were open. That's with nobody else using the
> program and no other connections reported via Netwatch.
>
> I'm currently working (on a completely different machine) with Win2000,
> installing the database program, and restoring data from backups. If the
> new installation works as it should, the Win98 installation will soon be
> history.
>
> Thanks again,
> Larry

and I think you'll be much better off for it ...win98 is not a great
"server" and never was...

2000 or NT4 even are much better choices..

post back and let us know how it works out for you..
Cheers!

Haggis wrote:
> "Larry" <(E-Mail Removed)> wrote in message
> news:VOjNf.65013$(E-Mail Removed). ..
<snip>
>>I'm currently working (on a completely different machine) with Win2000,
>>installing the database program, and restoring data from backups. If the
>>new installation works as it should, the Win98 installation will soon be
>>history.
>>
>>Thanks again,
>>Larry
>
>
> and I think you'll be much better off for it ...win98 is not a great
> "server" and never was...
>
> 2000 or NT4 even are much better choices..
>
> post back and let us know how it works out for you..
> Cheers!
>
>
Haggis,
The database problem turned out to be internal, a user was erroneously
logged in even though we couldn't see it. The support desk for this
program came in remotely, found the erroneous login and deleted it. Now
it works like it should.

Meanwhile, I have set up a test server with Win 2K and it seems to work
well. Have some tweaking to do before I actually implement it.

Thanks for your suggestions.
Larry

"Larry" <(E-Mail Removed)> wrote in message
news:Zc7Pf.4672$(E-Mail Removed)...
> Haggis wrote:
>> "Larry" <(E-Mail Removed)> wrote in message
>> news:VOjNf.65013$(E-Mail Removed). ..
> <snip>
>>>I'm currently working (on a completely different machine) with Win2000,
>>>installing the database program, and restoring data from backups. If the
>>>new installation works as it should, the Win98 installation will soon be
>>>history.
>>>
>>>Thanks again,
>>>Larry
>>
>>
>> and I think you'll be much better off for it ...win98 is not a great
>> "server" and never was...
>>
>> 2000 or NT4 even are much better choices..
>>
>> post back and let us know how it works out for you..
>> Cheers!
> Haggis,
> The database problem turned out to be internal, a user was erroneously
> logged in even though we couldn't see it. The support desk for this
> program came in remotely, found the erroneous login and deleted it. Now it
> works like it should.
>
> Meanwhile, I have set up a test server with Win 2K and it seems to work
> well. Have some tweaking to do before I actually implement it.
>
> Thanks for your suggestions.
> Larry

gald you got it sorted out ...unknown logins are a scary business!