[MikesWhatsNews] MWN #516A
- From: "Mike" <mikebike@xxxxxxxxx>
- To: mikeswhatsnews@xxxxxxxxxxxxx
- Date: Sun, 16 Jun 2002 16:53:47 -0700
I left a link out, sorry about that.
Mike
WNetEnumCachedPasswords Lock Patch
http://www.diamondcs.com.au/web/patches/enhancer.php3?patch=passloc
k
For Windows95, Windows98 & WindowsME
Microsoft Windows installs with a file called MPR.DLL (MPR
standing for Multiple Provider Route). While the functions of this
DLL are generally very useful, there is one exported function that
is not required and is of particular concern to the
security-conscious. Existing only in Windows95/98/ME versions of
mpr.dll (it was removed from Windows NT/2K for good reason), the
name of this exported function is WNetEnumCachedPasswords. It is
officially undocumented, but enough unofficial documentation has
been created so that trojan authors can easily call this DLL from
their own trojan - indeed, many popular trojans such as Sub7 have
taken advantage of this API for a long time, and even the safe
passdump.exe demo program that accompanies this patch uses this
unofficial documentation to call the function.
++
~*~*~*~*~
Was this forwarded to you? Want to subscribe? Send an email
to mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe.
For a complete list of email commands for our list send an email
to ecartis@xxxxxxxxxxxxx with a subject line of "info mikeswhatsnews" without
the quotes.
If you wish to unsubscribe from our list send an email to
mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=unsubscribe
To contact the list moderators send an email to
mikeswhatsnews-moderators@xxxxxxxxxxxxx
~*~*~*~*~
Other related posts:
- » [MikesWhatsNews] MWN #516A
