It was just a file XP put into the users' profile, and as the knowledge base said, just delete it from the profile on your server should fix the problem. If I recall correctly the reason it shows up is the differences in how the desktop is handled in roaming profiles between WinXP and Win2k. The company I work for is very small, and so I'm not positive on the differences for win2k3
Andrew
On Aug 24, 2004, at 3:35 AM, Nick FitzGerald wrote:
BillyBobKnob wrote:
Does anyone know if this file is used in an exploit since it was found in
startup folders ?
Does it "come back" following a restart, or a logout/login cycle, after you delete it??
The contents of the file are:
[.ShellClassInfo] [EMAIL PROTECTED],-21787
This KnowledgeBase article mentions precisely these file contents:
http://support.microsoft.com/?id=330132
but gives no indication of what may cause its appearance on your system. The suggested "fix" is simply deletion...
Regards,
Nick FitzGerald
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
