Full Disclosure mailing list archives
Re: found suspicious desktop.ini in startup folders
From: Nick FitzGerald <nick () virus-l demon co uk>
Date: Tue, 24 Aug 2004 20:35:18 +1200
BillyBobKnob wrote:
Does anyone know if this file is used in an exploit since it was found in startup folders ?
Does it "come back" following a restart, or a logout/login cycle, after you delete it??
The contents of the file are: [.ShellClassInfo] LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787
This KnowledgeBase article mentions precisely these file contents: http://support.microsoft.com/?id=330132 but gives no indication of what may cause its appearance on your system. The suggested "fix" is simply deletion... Regards, Nick FitzGerald _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- found suspicious desktop.ini in startup folders BillyBobKnob (Aug 23)
- Re: found suspicious desktop.ini in startup folders Nick FitzGerald (Aug 24)
- Re: found suspicious desktop.ini in startup folders Andrew (Aug 24)
- Re: found suspicious desktop.ini in startup folders Micheal Espinola Jr (Aug 24)
- Re: found suspicious desktop.ini in startup folders Benjamin Piorczig (Aug 24)
- Re: found suspicious desktop.ini in startup folders Über GuidoZ (Aug 24)
- Re: found suspicious desktop.ini in startup folders Andrew (Aug 24)
- Re: found suspicious desktop.ini in startup folders Nick FitzGerald (Aug 24)