Re: Printer Sharing and M1CR0S0FT Windows98

[ryanr () SYBASE COM (Ryan Russell)]

> This share does not share everything per se.  Rather it appears to be
> somehow selective.  For example, the password lists (username.pwl) are not
> shared, neither are many of the directories under there.  The
> sub-directories that were shared on my system were:

That doesn't match my experience.  On my Win95A, Win95B, and Win98
machines, the entire \windows\system directory is shared out
(read-only) hidden files, subdirectories and all.  You don't see .pwl
files because they live in c:\windows, not c:\windows\system.

> Simply placing a file in that directory named x.dll isn't sufficient to
> enable it's appearance in the list.  The entry must be elsewhere, perhaps
> the registry.

Every one of my files is there.

> Easy way to make a difficult-to-detect trojan, add more files to the share
> list under PRINTER$ then quitely take the files when nobody is looking.

This would be a great place to drop your collected information, if
printer sharing was already on.


BTW, on a this thread, I had a couple of notes back and forth with Paul
      Leach,

and he says MS does not consider this a problem, and they won't be changing
      it.

They were CC'd to the list.. I don't know why Aleph1 didn't forward them.
      I certainly

thought them pertinant.



                              Ryan