Re: [Full-disclosure] Window's O/S

> In C:\windows\ the file "nnotepad.exe" remained as I had changed it and a
> brand new (from the same date as the renamed exe) "notepad.exe" appeared
and
> same under c:\windows\system32 and c:\windows\dllcache as well.
...
> So my question next is "If I have renamed the whole lot that I could
find,
> where did this replacement notepad.exe come from?" and I cant really
answer

The dllcache version existed already.  It's a local backup of files deemed
"important" to system functionality.
WFP noticed as soon as the original c:\windows\system32\notepad.exe was
renamed, and restored it from the dllcache directory before you renamed
that
copy, too.
Rename the dllcache copy first, then rename the system32 copy, and you'll
see that the file does not reappear (unless you have the Windows CD in your
drive at the time, in which case Windows will fetch it from there).

8^) p.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/