[Full-disclosure] Re: WehnTrust - When you have to trust Wehntrust
- From: "Dave Korn" <davek_throwaway@xxxxxxxxxxx>
- Date: Tue, 17 Jan 2006 19:19:55 -0000
Dave Korn wrote in news:dqiv0c$2rt$1@xxxxxxxxxxxxx
> Thierry Zoller wrote in news:1192877198.20060116214705@xxxxxxxxx
>> Dear List,
>>
>> Small blurp I came around; when Wehntrust creates the autostart key
>> it forgets to correctly quote the string in the key and thus may
>> trigger an autostart of c:\program.bat|exe|com up-on reboot... [2]
>
> Heh. I _always_ leave copies of calc.exe lying in my root dir, renamed
> to "Program.exe" and "Documents.exe".
>
> Starting and stopping RealPlayer leaves you with four instances of calc
> running!
>
> Users of Sysinternals' Process Explorer will be amused to see what
> happens if they enable Options/Replace Task Manager and then try invoking
> task manager from the SAS menu.
>
Oh, and OE6 launches it by mistake when it's trying to start up messenger!
cheers,
DaveK
--
Can't think of a witty .sigline today....
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- References:
- [Full-disclosure] WehnTrust - When you have to trust Wehntrust
- From: Thierry Zoller
- [Full-disclosure] Re: WehnTrust - When you have to trust Wehntrust
- From: Dave Korn
- [Full-disclosure] WehnTrust - When you have to trust Wehntrust
- Prev by Date: [Full-disclosure] Reverse Engineering WMF Exploit Code
- Next by Date: Re: [Full-disclosure] Secure Delete for Windows
- Previous by thread: [Full-disclosure] Re: WehnTrust - When you have to trust Wehntrust
- Next by thread: [Full-disclosure] ACT P202S VoIP wireless phone multiple undocumented ports/services
- Index(es):
Relevant Pages
|
