Re: NT/IIS Decoy

From: Qazi M.M. Ahmed (qaziahmed@pakcert.org)
Date: 12/12/01 

Date: Wed, 12 Dec 2001 08:03:43 -0800
From: "Qazi M.M. Ahmed" <qaziahmed@pakcert.org>
To: pen-test@securityfocus.com

You can disable Windows File Protection (and enable it again) in Windows
2000 by editing registry keys. A hex editor will do the rest for w3svc.dll

You can find details about Windows File Protection (how to
enable/disable etc) here:

http://www.microsoft.com/hwdev/driver/sfp/wfp.asp

For XP Windows File Protection, you have to edit the file:

%systemroot%\system32\restore\filelist.xml

Add the filename in the exclude section to disable protection for the
specific file.

Qazi M.M. Ahmed

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/

Relevant Pages

  • Re: Problem installing wadminpak.msi on Win2k3 R2 SP2
    ... This posting is provided "AS IS" with no warranties, and confers no rights. ... already tried to disable Windows File Protection but to no avail. ...
    (microsoft.public.windows.server.setup)
  • Re: FTP Reveals Operating System Details
    ... I think you also have to disable Windows File Protection ... Tibor Biro ... Please respond only to the Newsgroup and not directly to ...
    (microsoft.public.win2000.security)
  • Re: system file protection
    ... It's called Windows File Protection. ... Disable Windows File Protection ... MS-MVP Windows Shell/User ... Bill Cunningham hunted and pecked: ...
    (microsoft.public.windowsxp.general)
  • Re: Windows File Protection
    ... Disable Windows File Protection ... > I always get this pop-up I insert the disk and he does not ... > disk Thanks Oscar ...
    (microsoft.public.windowsxp.general)