Full Disclosure mailing list archives
Re: Window's O/S
From: Peter Ferrie <pferrie () symantec com>
Date: Fri, 25 Nov 2005 15:12:06 -0800
In C:\windows\ the file "nnotepad.exe" remained as I had changed it and a brand new (from the same date as the renamed exe) "notepad.exe" appeared
and
same under c:\windows\system32 and c:\windows\dllcache as well.
...
So my question next is "If I have renamed the whole lot that I could
find,
where did this replacement notepad.exe come from?" and I cant really
answer The dllcache version existed already. It's a local backup of files deemed "important" to system functionality. WFP noticed as soon as the original c:\windows\system32\notepad.exe was renamed, and restored it from the dllcache directory before you renamed that copy, too. Rename the dllcache copy first, then rename the system32 copy, and you'll see that the file does not reappear (unless you have the Windows CD in your drive at the time, in which case Windows will fetch it from there). 8^) p. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Window's O/S, (continued)
- Re: Window's O/S Andres Tarasco (Nov 24)
- RE: Window's O/S Haaland, Vegar Linge (Nov 24)
- RE: Window's O/S Fielder, Kevin (GE Consumer Finance) (Nov 24)
- Re: Window's O/S Stuart Dunkeld (Nov 24)
- Re: Window's O/S Marek Isalski (Nov 24)
- Re: Window's O/S Dave Korn (Nov 24)
- Re: Re: Window's O/S Gilles DEMARTY (Nov 24)
- RE: Window's O/S Aditya Deshmukh (Nov 24)
- Re: Window's O/S Dave Korn (Nov 24)
- Window's O/S houser (Nov 24)
- RE: Window's O/S Cassidy Macfarlane (Nov 25)
- Re: Window's O/S Peter Ferrie (Nov 25)