Solved Remove Unknown User From Network

[boweasel]

I just noticed that when I use Windows Explorer, there is an unfamiliar name on my network. When I click on that name I'm presented with a Windows Security screen prompting me for a User Name and Password.

I have no idea what that screen wants, who the user is, or how to remove it.

Anybody have ideas?

 

[torchwood]

Hi Scott,
As you dont recognise the user dowload and run Malwarebytes free, uncheck 30 day trial.
Then in the settings option tick scan for rootkits.

If you Right click on Tom, it should give you the option to delete it.
If not Rght click on your signal bars select Network/sharing then on next screen manage my networks,
right click on Tom and the dropdown will give you the remove option


Roy

 

[boweasel]

Hi Scott,
As you dont recognise the user dowload and run Malwarebytes free, uncheck 30 day trial.
Then in the settings option tick scan for rootkits.

If you Right click on Tom, it should give you the option to delete it.
If not Rght click on your signal bars select Network/sharing then on next screen manage my networks,
right click on Tom and the dropdown will give you the remove option

Roy

Already run Malwarebytes and scan for rootkits was checked. Right-clicking on Tom only gives the options to Expand (which brings up the Enter Network Password box again), Connect with Remote Desktop Connection (see below) or Open in New Window (ENP box again). No delete option.

Clicking on Manage Wireless Networks from the Network and Sharing Center fails to display any network called Tom. But then again it doesn't show EMACHINES-7AF6B9, Scott-HP or Karen-PC either. Those computers are all part of my Homegroup.

 

[torchwood]

What do you get when you expand Homegroup Karen.

Roy

 

[boweasel]

What do you get when you expand Homegroup Karen.

Roy

I see the 2 folders that are part of the Homegroup on the Karen-PC. The Emachines computer is a desktop that is directly connected to my router. I set up the Homegroup on the Karen-PC and added the Scott-HP to it. The Emachines desktop was never added to the Homegroup. When I click on the Emachines I get the exact same message box that I do when clicking Tom.

 

[UsernameIssues]

You might learn more about the device from your router's interface.

If you can find a MAC address for the device named TOM, then you might be able to tie it to a particular vendor via this list:

http://standards-oui.ieee.org/oui.txt
It takes a while to render that page.

 

[torchwood]

>>>Homegroup Karen<<<
Not network, was hoping might be able to delete it from there.

Roy

 

[GokAy]

If you have an unprotected wireless connection set at your router a neighbor may have "accidentally" connected to it.
Try in cmd:
ping tom

You would also see other PCs in your network if you have network-enabled virtual machines running on one of your PCs.

 

[boweasel]

If you have an unprotected wireless connection set at your router a neighbor may have "accidentally" connected to it.
Try in cmd:
ping tom

Yes, I can ping Tom. However I have only the one wireless network using WPA2-PSK security. I'm running 2 laptops, 1 tablet and 1 desktop off that connection. I also have an old non-wireless HP printer that I set up as a network printer so we could use it on any of our laptops without having to be directly connected.

You would also see other PCs in your network if you have network-enabled virtual machines running on one of your PCs.

Frankly I don't know what that means. Sorry.

 

[boweasel]

You might learn more about the device from your router's interface.

If you can find a MAC address for the device named TOM, then you might be able to tie it to a particular vendor via this list:

http://standards-oui.ieee.org/oui.txt
It takes a while to render that page.

This is a combination modem/router from my ISP. Accessing it gives me this page about MAC filtering

 

[UsernameIssues]

Within the router's web based interface, try clicking on each item in the left pane (and if need be, making selections in the right pane) to see if you can find a list of devices that are connected to the router. It might have wording like DHCP table.

If you find something like that, then hopefully it will list device name, IP address and MAC address. You don't need to post the MAC address, just look it up using the link that I posted. Doing that might let you know the manufacturer of the device... or at least the manufacturer of the network interface adapter.

If we cannot locate this device name TOM, then you might want to use the router's MAC filtering (shown in your screenshot) to allow only your known devices.

 

[GokAy]

Virtual machine wiki - https://en.wikipedia.org/wiki/Virtual_machine, you would know it if you had it, so don't worry about that one.

Having WPA2 security does not necessarily mean it is protected. Do you know if you have to enter a password while connecting to your wireless? Try forgetting the wireless connection with your phone and re-connect, see if it asks a password.

UsernameIssues' recommendation about the DHCP client table can work, some routers are just bad and fail to list every device (don't know why). Also check the DHCP scope (IP range) to see if it is static or dynamic.

Alternative and easier You should be able to get MAC of TOM by, first ping tom, and make sure of IP address, then also in cmd:

[FONT=Courier New]arp -a | find "xxx.xxx.xxx.xxx"[/FONT]

replace xxx.xxx.xxx.xxx with the IP address of TOM

In my network (W7Pro64 is a virtual machine)

C:\Users\Gokhan>ping w7pro64
Pinging W7Pro64 [192.168.0.100] with 32 bytes of data:
Reply from 192.168.0.100: bytes=32 time<1ms TTL=128
Reply from 192.168.0.100: bytes=32 time<1ms TTL=128
Reply from 192.168.0.100: bytes=32 time<1ms TTL=128
Reply from 192.168.0.100: bytes=32 time<1ms TTL=128
Ping statistics for 192.168.0.100:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
 
C:\Users\Gokhan>arp -a | find "192.168.0.100"
  [B]192.168.0.100         08-00-27-3d-7c-f1     dynamic[/B]

 

[torchwood]

If they are running WPA2, then a password is mandatory.

Try the instruction in screenpost, rogue name change to Tom

Roy

 

[GokAy]

Hmm, alright, thanks for the clarification.

 

[boweasel]

Within the router's web based interface, try clicking on each item in the left pane (and if need be, making selections in the right pane) to see if you can find a list of devices that are connected to the router. It might have wording like DHCP table.

If you find something like that, then hopefully it will list device name, IP address and MAC address. You don't need to post the MAC address, just look it up using the link that I posted. Doing that might let you know the manufacturer of the device... or at least the manufacturer of the network interface adapter.

If we cannot locate this device name TOM, then you might want to use the router's MAC filtering (shown in your screenshot) to allow only your known devices.

I've gotten the MAC address, thanks to GokAy, but tying that address to a vendor using the link you provided is impossible. Not only did the page take FOREVER to load (easily 5 minutes), but once it did load I could only view the first page. Trying to page beyond that always gives me 1eee.org is not responding with a suggestion to recover the webpage.

 

[GokAy]

Your router should have an access control list for the wireless. Enter TOM's MAC address there and deny access. Then check your wireless devices for connectivity in case Restart the router afterwards as well.

 

[boweasel]

Your router should have an access control list for the wireless. Enter TOM's MAC address there and deny access. Then check your wireless devices for connectivity in case Restart the router afterwards as well.

I see nothing beyond what is shown below.

 

[GokAy]

Yeah there is, MAC filter (in your screenshot you are at Basic, 2 lines below)

 

[boweasel]

None of the MAC addresses displayed her are the same as the one listed for TOM.

 

[UsernameIssues]

~~~
I've gotten the MAC address, thanks to GokAy, but tying that address to a vendor using the link you provided is impossible. Not only did the page take FOREVER to load (easily 5 minutes), but once it did load I could only view the first page. Trying to page beyond that always gives me 1eee.org is not responding with a suggestion to recover the webpage.

That website does test one's browser
Please post the first 6 characters of the MAC address for TOM.