Re: [Full-disclosure] Window's O/S

["Greg" <full-disclosure1@xxxxxxxxxxxxxxxxx>]

----- Original Message ----- 
From: "Cassidy Macfarlane" <cmacfarlane@xxxxxxxxxxxxxxxxxxxxx>
To: "pagvac" <unknown.pentester@xxxxxxxxx>; 
<full-disclosure@xxxxxxxxxxxxxxxxx>
Sent: Thursday, November 24, 2005 10:45 PM
Subject: RE: [Full-disclosure] Window's O/S


> This seems to be a 'nearest path' issue - iexplore would use notepad.exe 
> to 'view source' by default, so when you choose to 'view
> source', Windows looks to the PATH variable to find notepad.

I thought of similar so went on a hunt for all occurrences of "notepad.exe" 
and renamed them all to "nnotepad.exe" and then added the "notepad" folder 
to desktop.

In C:\windows\ the file "nnotepad.exe" remained as I had changed it and a 
brand new (from the same date as the renamed exe) "notepad.exe" appeared and 
same under c:\windows\system32 and c:\windows\dllcache as well.

So my question next is "If I have renamed the whole lot that I could find, 
where did this replacement notepad.exe come from?" and I cant really answer 
that one excepting to say that because notepad is the default html editor in 
IE6, perhaps IE6 has notepad somehow protected? BTW, my changed default is 
Word for the HTML editor in the options and yet Notepad kept coming up and 
all those changed exes kept reappearing.

I suppose this is a "class for idiots" type of question that I am failing. I 
admit it!

Greg. 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/