foreign computers in network view

[Bikebeard]

Dear All

I have stumbled on a strange issue on my home pc. The short story is I can see other computers in my network view, which is not suppose to be there.
ImageShack® - Online Photo and Video Hosting
It looks like this (on imageshack)

Only one of these pc's is mine.

Before you jump to conclusions, i want to share what I did so far (i'm an IT professional/coder and has been so for 15 years)
System: Windows 7 Ultimate 64 bit

1. MS security essentials is running - nothing comes up.
2. I cant ping these other pc's
3. nslookup cant resolve them
4. Clicking them produces an error (The network path was not found)
5. Windows Firewall is on
6. I tried Sysinternals tcpview - nothing suspicious going on - no connections to the names.
7. Only mac adresses i know is connected to my router, I cant see any of these "pc-ghosts" in attached devices.
8. Wireless security is "on"
9. I have as far as I know never been connected to these computers.
10. Tried purging arp cahce
11. Tried nbtstat -R
12. Tried changing home network name.

Any ideas how to find out what is going on?
Where does explorer get this information from to display a network icon?

Googling this "phenomenon" show many people have had/are having this experience, but in no forums I have seen a solution.


All the best

Bike/Skeeto

 

[Shootist]

Could you post a screen shot of the window you are seeing these ghost PCs.

 

[WebMattR]

Is this on a laptop, and if so, do you take it places other than home? Sounds to me like they're machines your computer saw at another point in time, and are still showing up as "relics," but I'm merely tossing around conjecture at this point.

 

[Bikebeard]

Thanks for your replies.
@Shootist: there's a link to imageshack further up. It's a screenshot of explorer, left pane. If I expand network they always show up. Also in the right "big" pane.

@WebMattR: It's not a laptop. However my wife has a laptop, where I can see these also. I tried arp cache flush and nbtstat on both simultaneously. Other cases I have Googled about this had "old ghosts" disappear after some time.
An interesting thing is it's always JEFF-PC, STILL-PC and <NONE>, but the other day it was also HEIDI-PC and so a new entry (which has later disappeared.

As far as this mystery goes, I'm puzzled. One of the questions is: Why can I see "something" in Explorer network view that is not there if you go a layer deeper? (like trace, ping, netstat etc.)
What process or service "tells" Explorer to show these?

I suspected Skype (because of their p2p part as far as I'm told), but uninstalling had no effect.

/Bike

 

[biggles1000]

yeah, I have the same problem. With my BTHomeHub, it shows a computer called 'Thomson' in network view but I can't connect to it or anything.

 

[severedsolo]

yeah, I have the same problem. With my BTHomeHub, it shows a computer called 'Thomson' in network view but I can't connect to it or anything.

That's your router. A BT Homehub is a modified Thompson Speedtouch

 

[Shootist]

Read something someplace about Win 7 doing some type of Ad-Hoc networking at the same time it is doing infrastructure (Access point) WiFi.
So those other PCs you are seeing are other notebooks that are close to you.

 

[biggles1000]

yeah, I have the same problem. With my BTHomeHub, it shows a computer called 'Thomson' in network view but I can't connect to it or anything.

That's your router. A BT Homehub is a modified Thompson Speedtouch

Oh! Thankyou, that's a great weight off my mind then

 

[AmbrosialPariah]

First of all when looking at devices and printers window if you enable the viewing of UPNP devices you will get things like your router [Thompson is a default name for thompson routers] listed. Way to see if it is a router is right click see if it offers you the option to connect and when you click it should bring up the browser. If you see still more icons than your routers, switches, etc. you may want to be sure you have enabled your Wireless security on the router and that it IS NOT WEP [I CAN CRACK WEP KEYS INSIDE OF 5 MIN NO PROBLEM]. MAKE SURE YOU ARE USING EITHER WPA2 [IF you can at all help it though there are still some devices that support ONLY WPA 1 and if that is the case USE WPA 1.] Another good strategy is to disbale SSID broadcast [your network is still there and you can still connect but it does not sho up in any lists [except if you have hacker skills you will see the SSID raw ID but not the actual Network Name [again you can find this but thats saying you live next to a skilled comp tech]. Finally you can usually enable MAC filtering. What this is is EVERY network device ever made has a LONG hex string that is UNIQUE TO IT. You can usually set your router to only allow wireless connections from listed MAC addresses. If you do this again some devices may not connect [not many and usually older] as they are to stupid and B you have to add the MAC for any new computers that need to connect [and you may not want to do this if your wireless network is very dynamic and you have many new never seen comps that need access. Of course beyond this the simple things like rotating your wireless networks password on a regular basis is always good, also is trying to always use letters and numbers [m0use1 is a lot harder to guess than mouse I think] that way you dont have to do anything else and change the way anyone uses your router you just be sure to use WPA 2 [or WPA if some device refuses to connect after AES should always be the algorhytm [look the US government held a HUGE competiton to find an encryption scheme that could be standardized and in the end at the time for a 128-bit AES key [this is in like 2005] would have taken 30 to the power of 30 SUPER computers running in tandem to brute force the key so trust me it is good and very widely universal.

 

[WebMattR]

Read something someplace about Win 7 doing some type of Ad-Hoc networking at the same time it is doing infrastructure (Access point) WiFi.
So those other PCs you are seeing are other notebooks that are close to you.

In this case, I would simply try and turn off ad hoc network usage, and see if the machines disappear. If so, then I would consider this problem solved.

 

[AmbrosialPariah]

Read something someplace about Win 7 doing some type of Ad-Hoc networking at the same time it is doing infrastructure (Access point) WiFi.
So those other PCs you are seeing are other notebooks that are close to you.

It can, but will not do so by default those are machines listed in either the same domain or workgroup [or if you marked a share as a favorite] they will show up in the devs and printers panel as well as net neighborhood. Homegroup I believe causes this as well so if you have a homegroup setup those should be the one's joined to it. In wireless your adapter can either do Infrastructure OR ad-hoc, but not both at the same time [unless you have a really nice dual antenna with dual adapters listed in your network adapters folder [for one adapter not for things like VM Ware or other virtual devices]]. Like I said I would log-in to your router and CHANGE YOUR WIRELESS network password. After that you can bring each of your devices online one and a time and watch your router's wireless connections and see if you all of a sudden get a machine you did not connect listed there. There are also software solutions that can monitor your network. Basically one type is install the software and it polls your network setup. If it changes it can alert you to the change. Keep in mind common sense as well if you live on a farm in the middle of nowhere you prolly dont have many people trying to steal your wifi. On the other hand if you live in an apartment building MAKE SURE you use WPA or WPA2, hide your SSID Broadcasts, and change your password on a regular basis.

 

[Lloydday]

Have you turned off BT-FON - that allows any other bt user to use your routers wi-fi and BB bandwidth. You have to go to their site and diable it.
There's a link (IIRC) in the routers cp.