> In C:\windows\ the file "nnotepad.exe" remained as I had changed it and a > brand new (from the same date as the renamed exe) "notepad.exe" appeared and > same under c:\windows\system32 and c:\windows\dllcache as well. ... > So my question next is "If I have renamed the whole lot that I could find, > where did this replacement notepad.exe come from?" and I cant really answer
The dllcache version existed already. It's a local backup of files deemed "important" to system functionality. WFP noticed as soon as the original c:\windows\system32\notepad.exe was renamed, and restored it from the dllcache directory before you renamed that copy, too. Rename the dllcache copy first, then rename the system32 copy, and you'll see that the file does not reappear (unless you have the Windows CD in your drive at the time, in which case Windows will fetch it from there). 8^) p. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/