Looks like you found the registry! You can not get a file lock on the
registry at all while Windows is running. This is not the only one that you
will run into (depending on the Windows Server, there can dozens). It's
also why you can't defrag the registry while Windows is live as well. Take
it offline to get your signatures but do be aware that you will be
completely unable to validate your md5 signatures on these files while
Server is live as well.
-Bri
-----Original Message-----
From: forensics-return-2808-76701.250=compuserve.com@securityfocus.com
[mailto:forensics-return-2808-76701.250=compuserve.com@securityfocus.com] On
Behalf Of Jeff Bryner
Sent: Wednesday, April 06, 2005 4:42 PM
To: forensics@securityfocus.com
Subject: fingerprinting servers--md5deep problem
I'm attempting to get a fingerprint of servers prior to putting them
into production (ports and file hashes) for use later if the servers
are compromised.
For file hashes I'm using md5deep on linux over an smbmount to a
windows server and keep running into this message on several files:
md5deep: WINNT/system32/config/default: error at offset 2138112: Text
file busy
My command line is (from the mount point of the smb share):
smbmount# md5deep -r -l -of WINNT/* >> output.md5deep.txt
Seems like it's hitting files that the server is changing or has
locked. How do I work around this?
Thanks,
Jeff.
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
