How do I Create C$, and ADMIN$ shares remotely 1

[fuunstatic]

A virus is deleting the C$, ADMIN$ shares on our XP machines

it's an old virus and has been cleaned but left some machines without C$ etc

I can remote desktop some and carry this out, but was wondering if there was a script I could use (command line etc) or a registry file i could use to import back into the pc

thanks for any help in advance

"Work to live, don't live to work"

"The problem with troubleshooting is that sometimes it shoots back"

 

[bcastner]

The creation of the Administration shares is automatic if the following registy key is set properly. I will write it in regedit form:

Open notepad and copy/paste the below as a file fix_shares.reg :

***** start copy/paste below this line
REGEDIT4

[HKEY_LOCAL_MACHINE \System \CurrentControlSet \Services \LanmanServer \Parameters]
"AutoShareWks"=dword:00000001

****** end copy/paste above this line

You would then use regedit /s fix_shares.reg to make the change.

One next boot the shares will be re-created.

 

[fuunstatic]

Thanks for that

however I couldn't find the key you described

when I do an export of my reg keys i get

#################################################
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\ etc etc etc

#################################################

from XP pro SP1

is your machine the xp home, media or pro?

"Work to live, don't live to work"

"The problem with troubleshooting is that sometimes it shoots back"

 

[bcastner]

XP Pro SP2, but the registry key I gave you in the .reg scripting file is true from the first release of Windows NT and onwards.

Use notepad to make the .reg file as described in my first post, then use regedit /s to merge the file and create the key.

Reboot. Your administrative shares will be automaticly created by XP. The reason they are not created now is because the key is missing.

 

[fuunstatic]

tried you reg file and also a reg file with my 1st line in it - no joy

found that restarting server service fixed the problem

"Work to live, don't live to work"

"The problem with troubleshooting is that sometimes it shoots back"

 

[bcastner]

If you add the registry key and restart the service it will recreate the shares.

Without the key it will not.

 

[bcastner]

See MSFT KB:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q314984

 

[fuunstatic]

Thanks for that

"Work to live, don't live to work"

"The problem with troubleshooting is that sometimes it shoots back"