Re: [Full-Disclosure] found suspicious desktop.ini in startup folders

[Nick FitzGerald <nick@xxxxxxxxxxxxxxxxxxx>]

BillyBobKnob wrote:

> Does anyone know if this file is used in an exploit since it was found in
> startup folders ?

Does it "come back" following a restart, or a logout/login cycle, after 
you delete it??

> The contents of the file are:
> 
> [.ShellClassInfo]
> LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

This KnowledgeBase article mentions precisely these file contents:

   http://support.microsoft.com/?id=330132

but gives no indication of what may cause its appearance on your 
system.  The suggested "fix" is simply deletion...


Regards,

Nick FitzGerald

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html