Bad Llama! Bad!

Hezekiah <[email protected]> Wed, 26 Feb 2003 00:22:50 -0500
Newsgroups gmane.comp.security.invisiblenet.iip.devel
Message-ID <[email protected]>
Hi, all! :)
	Sorry about missing the meeting on Tuesday. I was busy helping someone with 
their computer. I was so puzzled by the problem, that I completely forgot 
about the meeting. (From the logs of it, it didn't look like much important 
happened though.)

	Anyway, if anyone knows much about Windows Me out there, you might be able to 
help! ;-) The problem was that TONS of files were being accumulated in 
c:\_restore\temp . (TONS as in 52,000+ files to the tune of 13GB!) Anyway, I 
deleted all the files (I had to boot of a Gentoo Linux CD to do it) rebooted 
the machine into Windows Me, and within about no more than 2 minute about 
2.3GB of files had been regenerated in c:\_restore\temp ! Files were getting 
added to the directory at the rate of about 13 per SECOND!
	Anyway, the lady said she had gotten a worm a while back. I hunted around and 
finally found a suspicious item in the registry. It was a call to a 
c:\windows\system\winklk.exe (I'm not entirely sure about the name. I know it 
started with "wink". I think I might have omitted a letter.) Anyway, it 
didn't have any of the information that most M$ created executables have, so 
I figured it would be safe to delete as long as I saved a copy. It didn't 
delete nicely either! I had to boot of the Gentoo CD again to do it! (Note: 
before I deleted it, I had tried removing the registry item that ran it. 
However, it would just resurrect itself on the next boot.)
	After I deleted it, I did some other matinence tasks for about 1 1/2 hours. 
In the period of 1 1/2 hours only 500 files were added to c:\_restore\temp . 
So, the tide of files has now ebbed, but it is still growing.
	Anyway, that's why I missed the #iip-dev meeting. I hope you can all forgive 
me. :) ... and if there are any Windows Me gurus out there that know what 
c:\_restore\temp is for (does it take the place of c:\windows\temp that was 
used in Win95/95?) or knows any other piece of potentially useful information 
about this, I would be much obliged if you'd email it to me! :)

	-- Hezekiah

P.S. Mids: the title of this message was just for you. You had said in the 
#iip-dev message logs to tell me I was a bad boy. The title is a quote from 
"The Emporer's New Grove" in which the emporer (who is currently a llama) is 
accused of being heartless, cruel, etc. He responds (loaded with sarcasm), 
"Oh! Now you're making me feal bad. Bad llama! Bad!" Just wanted you to know 
I care you about your chastisement. ;-)
signature.asc (application/pgp-signature, 189 B)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQA+XE81eHiZTMH32ioRAsptAJ9zEF5ohzy6beS24Jd/qkSPEBNYlwCfRDjE
81R0AsJFBN0tgvBrqBj449Y=
=zAet
-----END PGP SIGNATURE-----