-
June 27th, 2005, 10:08 PM
#11
Hey Hey,
This thing definately reads a lot of directories and a lot of files... it also does some file creation and that's what I documented.
Extract zip file
single exe - f22-012.exe
Run the EXE
system32\winshost.exe is created
ntuser.dat and ntuser.dat.log in c:\documents and settings\Administrator were changed
HKLM\Software\Microsoft\Windows\CurrentUser\Run\winshost.exe added
system32\config\software.log modified
system32\wiwshost.exe created
At this point explorer crashed and drwatson ran... The logs became so full that I couldn't follow it anymore.
I had my subnet changed (in case it did any scanning/passing by looking at the current subnet range).. but I didn't see any network traffic..
Peace,
HT
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|