full-disclosure - Window's O/S

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri Nov 25 23:12:20 2005
From: pferrie at symantec.com (Peter Ferrie)
Subject: Window's O/S

> In C:\windows\ the file "nnotepad.exe" remained as I had changed it and a
> brand new (from the same date as the renamed exe) "notepad.exe" appeared
and
> same under c:\windows\system32 and c:\windows\dllcache as well.
...
> So my question next is "If I have renamed the whole lot that I could
find,
> where did this replacement notepad.exe come from?" and I cant really
answer

The dllcache version existed already.  It's a local backup of files deemed
"important" to system functionality.
WFP noticed as soon as the original c:\windows\system32\notepad.exe was
renamed, and restored it from the dllcache directory before you renamed
that
copy, too.
Rename the dllcache copy first, then rename the system32 copy, and you'll
see that the file does not reappear (unless you have the Windows CD in your
drive at the time, in which case Windows will fetch it from there).

8^) p.