RE: [unisog] Re: Port 109 Mystery

["Patrick R. Sweeney" <patsw () attbi com>]

For clarification, third-party GINAs don't normally replace MSGINA.DLL.
They are usually a separate file referenced in the registry, e.g.
NWGINA.DLL for netware's 32-bit client.

-----Original Message-----
From: David Moisan [mailto:dmoisan () davidmoisan org] 
Sent: Thursday, March 13, 2003 11:21 PM
To: incidents () securityfocus com
Subject: Re: [unisog] Re: Port 109 Mystery


At 09:01 AM 3/13/2003 -0500, Buck Buchanan wrote:

> Since fport normally does not display the "\??\" prefix, I am wondering

> if this might be a clue to how winlogon.exe was run.

Winlogon is a native process (as opposed to a Win32 process).  It runs 
early in the boot process.  As someone else noted, the path you saw is
normal.

It *does* have a DLL, MSGINA.DLL;  this gets the logon info from the
user 
for Winlogon.  It's designed so that third-parties can use, say, a 
biometric MSGINA in place of the usual prompt.

Next question is if it's possible for MSGINA to be co-opted?

"Inside Windows 2000" is the best investment any Windows admin can make,

next to the RK.

Take care,

Dave

David Moisan, N1KGH   ARES/SKYWARN             dmoisan () davidmoisan org
Invisible Disability:
http://www1.shore.net/~dmoisan/invisible_disability.html
ATS-909 FAQ:  http://www1.shore.net/~dmoisan/faqs/sangean/ats909faq.html


------------------------------------------------------------------------
----

<Pre>Lose another weekend managing your IDS?
Take back your personal time.
15-day free trial of StillSecure Border Guard.</Pre>
<A href="http://www.securityfocus.com/stillsecure";>
http://www.securityfocus.com/stillsecure </A>



----------------------------------------------------------------------------

<Pre>Lose another weekend managing your IDS?
Take back your personal time.
15-day free trial of StillSecure Border Guard.</Pre>
<A href="http://www.securityfocus.com/stillsecure";> http://www.securityfocus.com/stillsecure </A>