Files automatically recreated

[SelbyGlenn]

Hi there,

For security reasons I am trying to rename some files within the system32 directory. The problem is every time I rename the file it is re-created by Windows. I know there is a service running that controls this (can't remember what it's called though) but I don't really want to stop it anyway. Does anyone know if there is a file somewhere in windows that contains the list of files that are being re-created so I can remove any reference to the files I'm trying to rename?

Thanks in advance,
Glenn
BEng A+ MCSE CCA

 

[brontosaurus]

Hey Glenn, are you talking about Windows File Protection? I guess you're renaming DLL's?

 

[SelbyGlenn]

Hi Brontosaurus,

I'm actually trying to rename the net.exe command. Tek-tip user vfear posted a question a few days ago asking how to prevent users from abusing the NET SEND command. I have a similar problem on my network but disabling the messenger service is not an option for me as it has been used before by administrators in states of emergency. Glenn
BEng A+ MCSE CCA

 

[Antony13]

How about using a Group Policy which prevents users from running net.exe - guess it only works if all clients are running Windows 2000 or above but...

 

[brontosaurus]

Unfortunately, as of SP2, the old easy way to disable WFP was destroyed. I copied this from a website some time ago...shows how to disable it post SP2 if you're interested:

Copy %SystemRoot%\System32\SFC.DLL to %SystemRoot%\System32\SFC_Patch.DLL.

Open %SystemRoot%\System32\SFC_Patch.DLL in a hex editor.

At offset 0x6211 and 0x6212, change 8BC6 to 9090 and save the changes.

Open a CMD prompt and type: Copy %SystemRoot%\System32\SFC_Patch.DLL %SystemRoot%\System32\dllcache\SFC.DLL /Y
Copy %SystemRoot%\System32\SFC_Patch.DLL %SystemRoot%\System32\SFC.DLL /Y

If prompted to insert the Windows CD-ROM, press Cancel.

Shutdown and restart Windows 2000.

Set HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable to 0xffffff9d.

Shutdown and restart Windows 2000.