Re: [Full-disclosure] Window's O/S
yes, i checked on win2000 pro. On 12/2/05, wac <[EMAIL PROTECTED]> wrote: > Hi: > > I guess that is the remaining of an old IE bug that opened notepad.exe on > the desktop. I remember it quite well, it is archived somewhere for sure. > > On 11/24/05, jacob jango <[EMAIL PROTECTED]> wrote: > > > > > > Not sure if you guys are aware of this issue windows XP...!! > > > > > > create an folder on deskop and name it as "notepad". > > open internet explorer > go to view > source code > this will open the > contents of notepad folder!! > > > > > > > > > Yahoo! Music Unlimited - Access over 1 million songs. Try it free. > > > > > > ___ > > Full-Disclosure - We believe in it. > > Charter: > http://lists.grok.org.uk/full-disclosure-charter.html > > Hosted and sponsored by Secunia - http://secunia.com/ > > > > > > > ___ > Full-Disclosure - We believe in it. > Charter: > http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > > -- ting ding ting ding ting ding ting ding ting ding ding i m crazy frog :) "oh yeah oh yeah... another wannabe, in hackerland!!!" ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Window's O/S
Hi: I guess that is the remaining of an old IE bug that opened notepad.exe on the desktop. I remember it quite well, it is archived somewhere for sure.On 11/24/05, jacob jango <[EMAIL PROTECTED]> wrote: Not sure if you guys are aware of this issue windows XP...!! create an folder on deskop and name it as "notepad". open internet explorer > go to view > source code > this will open the contents of notepad folder!! Yahoo! Music Unlimited - Access over 1 million songs. Try it free. ___Full-Disclosure - We believe in it.Charter: http://lists.grok.org.uk/full-disclosure-charter.htmlHosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Window's O/S
> In C:\windows\ the file "nnotepad.exe" remained as I had changed it and a > brand new (from the same date as the renamed exe) "notepad.exe" appeared and > same under c:\windows\system32 and c:\windows\dllcache as well. ... > So my question next is "If I have renamed the whole lot that I could find, > where did this replacement notepad.exe come from?" and I cant really answer The dllcache version existed already. It's a local backup of files deemed "important" to system functionality. WFP noticed as soon as the original c:\windows\system32\notepad.exe was renamed, and restored it from the dllcache directory before you renamed that copy, too. Rename the dllcache copy first, then rename the system32 copy, and you'll see that the file does not reappear (unless you have the Windows CD in your drive at the time, in which case Windows will fetch it from there). 8^) p. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
RE: [Full-disclosure] Window's O/S
Title: Message yes it does: WIN2K server SP4, IE6P1 what do you mean by 'srp5'? -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Aditya DeshmukhSent: 25 November 2005 03:28To: 'jacob jango'; full-disclosure@lists.grok.org.ukSubject: RE: [Full-disclosure] Window's O/S this does not work on win2k sp4 srp5 Not sure if you guys are aware of this issue windows XP...!! create an folder on deskop and name it as "notepad". open internet explorer > go to view > source code > this will open the contents of notepad folder!! Yahoo! Music Unlimited - Access over 1 million songs. Try it free. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
RE: [Full-disclosure] Window's O/S
this does not work on win2k sp4 srp5 Not sure if you guys are aware of this issue windows XP...!! create an folder on deskop and name it as "notepad". open internet explorer > go to view > source code > this will open the contents of notepad folder!! Yahoo! Music Unlimited - Access over 1 million songs. Try it free. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
RE: [Full-disclosure] Window's O/S
> > > create an folder on deskop and name it as "notepad". > > > open internet explorer > go to view > source code > this > will open the > > > contents of notepad folder!! > > Even better: rename any exe to notepad.exe ;) > > Is this IE being so stupid as to run with a CWD of Desktop > and effectively doing a system("notepad")? > > That'd explain explorer opening up folders called Notepad, > and .exe files being run. Bet it also works on MS Word > documents (without a .doc extension, probably), and any other > magically executable file... > > Certainly cmd.exe as notepad on the desktop suggests the CWD > is your Desktop (so presumably IE's CWD is also Desktop). > > Are there any other external apps IE is stupid enough to run > without a full path prefix? That could be fun too! :-) > Thank god I run firefox ! ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Window's O/S
On 11/24/05, Fielder, Kevin (GE Consumer Finance) <[EMAIL PROTECTED]> wrote: > > http://www.microsoft.com/whdc/winlogo/drvsign/wfp.mspx > > Windows File Protection > If you want to test, this feature can be disabled by turning off system > restore. - right click my computer - properties - system restore tab. That's not the case - system restore and Windows File Protection are completely different animals. > Agree with the previous posts, I think this is just down to a path issue > when windows is trying to work out what to do when you open something. Sure. It's not exactly new, either - http://www.pcmag.com/article2/0,1895,1785717,00.asp Regards stuartd ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Window's O/S
> > create an folder on deskop and name it as "notepad". > > open internet explorer > go to view > source code > this will open the > > contents of notepad folder!! > Even better: rename any exe to notepad.exe ;) Is this IE being so stupid as to run with a CWD of Desktop and effectively doing a system("notepad")? That'd explain explorer opening up folders called Notepad, and .exe files being run. Bet it also works on MS Word documents (without a .doc extension, probably), and any other magically executable file... Certainly cmd.exe as notepad on the desktop suggests the CWD is your Desktop (so presumably IE's CWD is also Desktop). Are there any other external apps IE is stupid enough to run without a full path prefix? That could be fun too! :-) - This message has been scanned for all viruses by Sophos Sweep <<<>>> ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
RE: [Full-disclosure] Window's O/S
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Brian Dessent Sent: 24 November 2005 12:19 To: full-disclosure@lists.grok.org.uk Subject: Re: [Full-disclosure] Window's O/S Greg wrote: > In C:\windows\ the file "nnotepad.exe" remained as I had changed it > and a brand new (from the same date as the renamed exe) "notepad.exe" > appeared and same under c:\windows\system32 and c:\windows\dllcache as well. http://www.microsoft.com/whdc/winlogo/drvsign/wfp.mspx > So my question next is "If I have renamed the whole lot that I could > find, where did this replacement notepad.exe come from?" and I cant > really answer The WFP thread watches for file changes and replaces files deemed "system" files whenever they are modified or replaced. This is not unique to notepad. I don't know how this daemon works but I'd assume it keeps a private cached copy of all files so that it can replace them when changed. I think this is what "dllcache" is. This means there are always two copies of the file at any given time, and since it's impossible to atomically delete two files simultaneously, the WFP thread can always use one copy of the file to replace the other. If not it could probably grab it from the .cab file that's usually tucked away in %WINDIR% somewhere. > that one excepting to say that because notepad is the default html > editor in IE6, perhaps IE6 has notepad somehow protected? BTW, my > changed default No, it has nothing to do with IE or the original subject of this thread. Notepad.exe just happens to be one of a large number of files that WFP has on its list. Brian Hi If you want to test, this feature can be disabled by turning off system restore. - right click my computer - properties - system restore tab. This feature can be a pain in the arse if you are trying to get rid of infected files that it thinks are system files. Agree with the previous posts, I think this is just down to a path issue when windows is trying to work out what to do when you open something. K ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Window's O/S
Hi, You are right Brian ( http://msdn.microsoft.com/workshop/browser/configuration/clientreg/clientregistrylayout.asp ) The following .reg file should fix the problem. Save it as IE_path.reg and double click on it: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\View Source Editor\Editor Name] @="c:\\windows\\system32\\notepad.exe" regards, Andres Tarasco 2005/11/24, Brian Dessent <[EMAIL PROTECTED]>: Cassidy Macfarlane wrote:> This seems to be a 'nearest path' issue - iexplore would use notepad.exe> to 'view source' by default, so when you choose to 'view source',> Windows looks to the PATH variable to find notepad. IE first looks for the keyHKLM\SOFTWARE\Microsoft\Internet Explorer\View Source Editor\Editor NameIf present, it uses its value as the name of the editor to launch. Ifabsent it seems to use a hardcoded default of just "notepad" without any qualifying path.It then searches starting on the desktop (and then presumably on thepath) to find "notepad.*". The first hit that it finds, it uses thestandard shell launch method based on the class. In this case that turns out to be HKCR\Folder\shell\open, which launches explorer.If you change the above "Editor Name" key to something with a qualifiedpath such as "c:\winxp\system32\notepad.exe" you get notepad despite a folder on the desktop named notepad. Similarly, if you set the abovekey to an unqualified "foobar" and have a folder named foobar on thedesktop, it gets opened. There's nothing special about "notepad" other than that's IE's built-in default.Brian___Full-Disclosure - We believe in it.Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/-- Loco de aTar ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Window's O/S
Greg wrote: > In C:\windows\ the file "nnotepad.exe" remained as I had changed it and a > brand new (from the same date as the renamed exe) "notepad.exe" appeared and > same under c:\windows\system32 and c:\windows\dllcache as well. http://www.microsoft.com/whdc/winlogo/drvsign/wfp.mspx > So my question next is "If I have renamed the whole lot that I could find, > where did this replacement notepad.exe come from?" and I cant really answer The WFP thread watches for file changes and replaces files deemed "system" files whenever they are modified or replaced. This is not unique to notepad. I don't know how this daemon works but I'd assume it keeps a private cached copy of all files so that it can replace them when changed. I think this is what "dllcache" is. This means there are always two copies of the file at any given time, and since it's impossible to atomically delete two files simultaneously, the WFP thread can always use one copy of the file to replace the other. If not it could probably grab it from the .cab file that's usually tucked away in %WINDIR% somewhere. > that one excepting to say that because notepad is the default html editor in > IE6, perhaps IE6 has notepad somehow protected? BTW, my changed default No, it has nothing to do with IE or the original subject of this thread. Notepad.exe just happens to be one of a large number of files that WFP has on its list. Brian ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
RE: [Full-disclosure] Window's O/S
Ok, the first one it will open (if you have, let's say: notepad and notepad.exe) is notepad.exe I tried a couple of stuff and here's my notes:) : The folde could be named notepad.exe notepad notepad.cmd or notepad.bat I also successfully got it to start cmd.exe by copying a copy of cmd to the desktop folder, and rename it to notepad.exe :) I'll bet there's tons of stuff we could make this bug do :D (Worked on Windows XP sp2) (btw, sorry about my English.. :S) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: 24. november 2005 12:44 To: pagvac Cc: full-disclosure@lists.grok.org.uk Subject: Re: [Full-disclosure] Window's O/S Importance: High Hi there same effect under german windows xp sp2... i'm not really a windows guru, but i think, this has to do with some pre-defined windows and internet explorer search-paths. when you enter an url in internet explorer, and have a cd-rom in the drive, it will move the cd-rom (searching for something?). weird! GreetZ from IndianZ > OK, so here is where creativity kicks in. > > Anyone has any interesting ideas for exploiting this bug as an attack > vector? > > On 11/24/05, Sibillano Fabio <[EMAIL PROTECTED]> wrote: >> >> > Confirmed on Windows XP SP2 (English Version). >> >> Italian version too... >> >> weird! >> >> >> >> >> The information contained in this e-mail may be privileged, >> confidential, and protected from disclosure. If you are not the >> intended recipient, you are hereby notified that any dissemination, >> distribution or duplication of this communication is strictly >> prohibited. If you have received this communication in error, please >> notify the sender immediately and delete all copies . >> >> >> > > > -- > pagvac (Adrian Pastor) > www.ikwt.com - In Knowledge We Trust > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > GreetZ from IndianZ mailto:[EMAIL PROTECTED] http://www.indianz.ch ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Window's O/S
Cassidy Macfarlane wrote: > This seems to be a 'nearest path' issue - iexplore would use notepad.exe > to 'view source' by default, so when you choose to 'view source', > Windows looks to the PATH variable to find notepad. IE first looks for the key HKLM\SOFTWARE\Microsoft\Internet Explorer\View Source Editor\Editor Name If present, it uses its value as the name of the editor to launch. If absent it seems to use a hardcoded default of just "notepad" without any qualifying path. It then searches starting on the desktop (and then presumably on the path) to find "notepad.*". The first hit that it finds, it uses the standard shell launch method based on the class. In this case that turns out to be HKCR\Folder\shell\open, which launches explorer. If you change the above "Editor Name" key to something with a qualified path such as "c:\winxp\system32\notepad.exe" you get notepad despite a folder on the desktop named notepad. Similarly, if you set the above key to an unqualified "foobar" and have a folder named foobar on the desktop, it gets opened. There's nothing special about "notepad" other than that's IE's built-in default. Brian ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Window's O/S
- Original Message - From: "Cassidy Macfarlane" <[EMAIL PROTECTED]> To: "pagvac" <[EMAIL PROTECTED]>; Sent: Thursday, November 24, 2005 10:45 PM Subject: RE: [Full-disclosure] Window's O/S This seems to be a 'nearest path' issue - iexplore would use notepad.exe to 'view source' by default, so when you choose to 'view source', Windows looks to the PATH variable to find notepad. I thought of similar so went on a hunt for all occurrences of "notepad.exe" and renamed them all to "nnotepad.exe" and then added the "notepad" folder to desktop. In C:\windows\ the file "nnotepad.exe" remained as I had changed it and a brand new (from the same date as the renamed exe) "notepad.exe" appeared and same under c:\windows\system32 and c:\windows\dllcache as well. So my question next is "If I have renamed the whole lot that I could find, where did this replacement notepad.exe come from?" and I cant really answer that one excepting to say that because notepad is the default html editor in IE6, perhaps IE6 has notepad somehow protected? BTW, my changed default is Word for the HTML editor in the options and yet Notepad kept coming up and all those changed exes kept reappearing. I suppose this is a "class for idiots" type of question that I am failing. I admit it! Greg. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Window's O/S
Hi there same effect under german windows xp sp2... i'm not really a windows guru, but i think, this has to do with some pre-defined windows and internet explorer search-paths. when you enter an url in internet explorer, and have a cd-rom in the drive, it will move the cd-rom (searching for something?). weird! GreetZ from IndianZ > OK, so here is where creativity kicks in. > > Anyone has any interesting ideas for exploiting this bug as an attack > vector? > > On 11/24/05, Sibillano Fabio <[EMAIL PROTECTED]> wrote: >> >> > Confirmed on Windows XP SP2 (English Version). >> >> Italian version too... >> >> weird! >> >> >> >> >> The information contained in this e-mail may be privileged, >> confidential, and protected from disclosure. If you are not >> the intended recipient, you are hereby notified that any >> dissemination, distribution or duplication of this communication >> is strictly prohibited. If you have received this communication >> in error, please notify the sender immediately and delete all copies . >> >> >> > > > -- > pagvac (Adrian Pastor) > www.ikwt.com - In Knowledge We Trust > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > GreetZ from IndianZ mailto:[EMAIL PROTECTED] http://www.indianz.ch ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
RE: [Full-disclosure] Window's O/S
This seems to be a 'nearest path' issue - iexplore would use notepad.exe to 'view source' by default, so when you choose to 'view source', Windows looks to the PATH variable to find notepad. Similar to having an executable 'c:\program.exe' when windows is looking for 'C:\program files\path\to\file\' Theres probably a workaround by adjusting the path somehowanyone? I recall a similar issue - it's definitely related to PATH, anyway, not got time atm to dig through the archives or technet -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of pagvac Sent: 24 November 2005 11:25 To: full-disclosure@lists.grok.org.uk Subject: Re: [Full-disclosure] Window's O/S Naming the folder "notepad.exe" (without quotation marks) also does the trick. Any Windows gurus out there willing to explain why this happens? -- pagvac (Adrian Pastor) www.ikwt.com On 11/24/05, Native.Code <[EMAIL PROTECTED]> wrote: > Weird! haha :-) ) > > > > On 11/24/05, Stelian Ene <[EMAIL PROTECTED]> wrote: > > jacob jango wrote: > > > > > create an folder on deskop and name it as "notepad". > > > open internet explorer > go to view > source code > this will open the > > > contents of notepad folder!! > > > > Even better: rename any exe to notepad.exe ;) > > > > ___ > > Full-Disclosure - We believe in it. > > Charter: > http://lists.grok.org.uk/full-disclosure-charter.html > > Hosted and sponsored by Secunia - http://secunia.com/ > > > > > ___ > Full-Disclosure - We believe in it. > Charter: > http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Window's O/S
OK, so here is where creativity kicks in. Anyone has any interesting ideas for exploiting this bug as an attack vector? On 11/24/05, Sibillano Fabio <[EMAIL PROTECTED]> wrote: > > > Confirmed on Windows XP SP2 (English Version). > > Italian version too... > > weird! > > > > > The information contained in this e-mail may be privileged, > confidential, and protected from disclosure. If you are not > the intended recipient, you are hereby notified that any > dissemination, distribution or duplication of this communication > is strictly prohibited. If you have received this communication > in error, please notify the sender immediately and delete all copies . > > > -- pagvac (Adrian Pastor) www.ikwt.com - In Knowledge We Trust ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Window's O/S
Naming the folder "notepad.exe" (without quotation marks) also does the trick. Any Windows gurus out there willing to explain why this happens? -- pagvac (Adrian Pastor) www.ikwt.com On 11/24/05, Native.Code <[EMAIL PROTECTED]> wrote: > Weird! haha :-) ) > > > > On 11/24/05, Stelian Ene <[EMAIL PROTECTED]> wrote: > > jacob jango wrote: > > > > > create an folder on deskop and name it as "notepad". > > > open internet explorer > go to view > source code > this will open the > > > contents of notepad folder!! > > > > Even better: rename any exe to notepad.exe ;) > > > > ___ > > Full-Disclosure - We believe in it. > > Charter: > http://lists.grok.org.uk/full-disclosure-charter.html > > Hosted and sponsored by Secunia - http://secunia.com/ > > > > > ___ > Full-Disclosure - We believe in it. > Charter: > http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Window's O/S
Weird! haha :-) ) On 11/24/05, Stelian Ene <[EMAIL PROTECTED]> wrote: jacob jango wrote:> create an folder on deskop and name it as "notepad".> open internet explorer > go to view > source code > this will open the > contents of notepad folder!!Even better: rename any exe to notepad.exe ;)___Full-Disclosure - We believe in it.Charter: http://lists.grok.org.uk/full-disclosure-charter.htmlHosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Window's O/S
Confirmed on Windows XP SP2 (English Version). I still can't understand why that happens. I tried doing the same thing using different folder names of default Windows application executables (wordpad, iexplore, etc...) but it doesn't work. Also tried creating another folder on the Desktop *after* creating the one named "notepad". The trick still works in this case as well. pagvac (Adrian Pastor) www.ikwt.com On 11/24/05, jacob jango <[EMAIL PROTECTED]> wrote: > Not sure if you guys are aware of this issue windows XP...!! > > > create an folder on deskop and name it as "notepad". > open internet explorer > go to view > source code > this will open the > contents of notepad folder!! > > > > > Yahoo! Music Unlimited - Access over 1 million songs. Try it free. > > > ___ > Full-Disclosure - We believe in it. > Charter: > http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Window's O/S
jacob jango wrote: > create an folder on deskop and name it as "notepad". > open internet explorer > go to view > source code > this will open the > contents of notepad folder!! Even better: rename any exe to notepad.exe ;) ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/