| All Forums |
Register |
Login |
Search |
Subscriptions |
My Profile |
Inbox |
| Tool Warehouse |
FAQs |
Resources |
Help |
Member List |
Address Book |
Logout |
|
|
Microsoft setuid binaries won't run in SUA 5.2
|
Logged in as: Guest |
| Users viewing this topic: none |
|
Login  |
|
|
 Microsoft setuid binaries won't run in SUA 5.2 - Mar. 9, '06, 3:53:18 AM
|
|
|
breiter
Posts: 343
Joined: Jun. 14, '04,
From: Washington, DC
Status: offline
|
First, yes I did select enable suid when installing the Utilities and SDK. Furthermore, I checked the registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SUA EnableSetuidBinaries = REG_DWORD 0x00000001.
I noticed this because I couln't run crontab(1). Then I realized that cron wasn't running.
From /var/adm/log/init.log
Running /bin/sh /etc/rc2.d/S38cron start >> /var/adm/log/init.log 2>&1
/etc/rc2.d/S38cron[26]: /usr/sbin/cron: Operation not permitted
Exitstatus = 0 (Success)
% whoami
Administrator
% crontab -p
/bin/crontab: Operation not permitted.
All of these binaries refuse to run.
-rwsrwxr-x 1 root +Administrators 162816 Jan 6 12:01 at
-rwsrwxr-x 1 root +Administrators 162816 Jan 6 12:01 atq
-rwsrwxr-x 1 root +Administrators 162816 Jan 6 12:01 atrm
-rwsrwxr-x 1 root +Administrators 162816 Jan 6 12:01 batch
-rwsrwxr-x 1 root +Administrators 181760 Jan 6 12:01 crontab
-rwsrwxr-x 1 root +Administrators 91648 Jan 6 12:01 newgrp
-rwsrwxr-x 1 root +Administrators 99328 Jan 6 12:01 regpwd
If EnableSetuidBinaries is set to 0, then I get a specific message that setuid binaries are not enabled. But that isn't the issue and my error message is just a generic access denied.
It appears to systematically be setuid binaries from Microsoft that don't run. Interopsystems setuid binaries are fine.
|
|
|
|
|
RE: Microsoft setuid binaries won't run in SUA 5.2 - Mar. 9, '06, 10:39:57 AM
|
|
|
breiter
Posts: 343
Joined: Jun. 14, '04,
From: Washington, DC
Status: offline
|
FYI. I have opened a support case with Microsoft for this issue and will report back what I learn.
|
|
|
|
|
RE: Microsoft setuid binaries won't run in SUA 5.2 - Mar. 9, '06, 4:27:57 PM
|
|
|
breiter
Posts: 343
Joined: Jun. 14, '04,
From: Washington, DC
Status: offline
|
Here's an update. The product support engineer was able to reproduce the issue with setuid binaries not running. He had a fix that worked in his environment but not for me. The fix to try is to remove and re-add the setuid bit.
% chmod u-s /bin/at
% chmod u+s /bin/at
You have to do this for each affected binary. In the test environment at Microsoft, this fixed the issue. It doesn't do anything for me, unfortunately.
One interesting tidbit is that the binaries will run if the setuid bit is removed, so it is clearly something to do with setuid.
|
|
|
|
|
RE: Microsoft setuid binaries won't run in SUA 5.2 - Mar. 22, '06, 7:39:58 PM
|
|
|
breiter
Posts: 343
Joined: Jun. 14, '04,
From: Washington, DC
Status: offline
|
Progress. The problem is in a new function psxss!MakeSignatureofFile. It looks like what this does is sign/encrypt the setuid binary, copies the binary to a temp location, impersonates and executies the signed/encrypted binary. I'm guessing the point of this is to mitigate some kind of code injection risk.
Inside of the psxss!MakeSignatureOfFile function there is a call to ntdll!ZWCreateFile which is failing with a return code of 0x56. Eventually, when the crypto API context is closed, this any error is converted to 0x61 "Acess is denied".
|
|
|
|
|
RE: Microsoft setuid binaries won't run in SUA 5.2 - Apr. 10, '06, 3:31:45 PM
|
|
|
breiter
Posts: 343
Joined: Jun. 14, '04,
From: Washington, DC
Status: offline
|
I think we have the problem figured out. It is fairly interesting. First, setuid does work when used in code which is why OpenSSH is working fine. The issue is only with the setuid bit on a file.
The problem appears to be overzealous (or wrong-headed--take your pick) error handling inside of the psxss!MakeSignatureOfFile function. This function was added increase the security of setuid by making it impossible to inject a changed binary into the setuid operation.
Something roughly along these lines happens in psxss!MakeSignatureOfFile
* Create a temporary copy (probably actually a hard link) in C:\WINDOWS with very strong permissions on it and lock the file.
* Use ADVAPI to make a hash of the orignial file and compare that to the version accessed through the link.
* Check to see if any *known set* of return codes came out of any of that stuff.
If you know the resturn codes and they are OK return 0;
otherwise return STATUS_PRIVILEGE_NOT_HELD
Returning STATUS_PRIVILEGE_NOT_HELD from MakeSignatureOfFile masks the original error (non-)condition by converting every NTSTATUS that the function doesn't know into STUS_PRIVILEGE_NOT_HELD.
The issue is that some hardware doesn't immediately delete files. A request to delete a file can return STATUS_SUCCESS or it could return STATUS_DELETE_PENDING and perform the delete asyncrnously to prevent the call to the filesystem from blocking in the kernel.
If you happen to have a driver that returns STATUS_DELETE_PENDING, then you are out of luck because MakeSignatureOfFile doesn't know that is OK and converts it to STATUS_PRIVILEGE_NOT_HELD in its error handling block before exiting.
So there are two thing that can cause a setuid problem.
1) Corrupted extended attribute data on the file, which can easily be fixed with chmod u-s; chmod u+s.
2) The driver for your hardware could return STATUS_DELETE_PENDING when files are deleted which causes your setuid binaries to *never execute*.
#1 seems to happen sometimes and is maybe some kind of installer issue? I'm going to request a hotfix for issue #2.
|
|
|
|
|
RE: Microsoft setuid binaries won't run in SUA 5.2 - Apr. 11, '06, 10:20:23 PM
|
|
|
breiter
Posts: 343
Joined: Jun. 14, '04,
From: Washington, DC
Status: offline
|
I figured out a solution to my issue. I'll share.
I have Win2k3 R2 installed on my laptop--which will inform some of what follows.
I was wracking my brain trying to figure out what could be causing delayed I/O on my system because I am using the default Microsoft IDE mass storage drivers. It seems like that should have worked. I do not have an antivirus engine that uses a filesystem filter driver--I use clamav because those sorts of antivirus engines cause these sorts of problems.
It finally hit me... I have System Restore which isn't included with Win2k3. I used sr.inf to install the version from XP SP2 over a year ago. System Restore includes a filesystem filter sr.sys. Aha!
I tried removing System Restore and bingo! That's da fix. All the binaries with setuid on them started working.
There is still a bug in the psxss!MakeSignatureOfFile code that converts STATUS_DELETE_PENDING to STATUS_PRIVILEGE_NOT_HELD, but I'm not excercising it anymore.
In case you have done this System Restore hack to a Win2k3 box used as a desktop, here's how to get rid of it:
cmd> rundll32 advpack.dll,LaunchINFSection sr.inf,Uninstall
cmd> sc delete sr
cmd> sc delete srservice
Regedit (optional):
cmd> rd "System Volume Information" /s
System Volume Information, Are you sure (Y/N)? y
Do this step for each volume that was being monitored by System Restore.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost
edit netsvcs REG_SZ_MULTI and remove SRService
Reboot.
< Message edited by breiter -- Apr. 11, '06, 10:23:22 PM >
|
|
|
|
|
RE: Microsoft setuid binaries won't run in SUA 5.2 - May 17, '06, 10:55:38 AM
|
|
|
rfoletta
Posts: 9
Joined: May 17, '06,
Status: offline
|
Hi breiter, I'm new to this forum and new to Interix. I am porting my unix applications to Interix and have some programs that have to be setuid root. I am running into the same problem you are with this Operation not permitted error. Is MS creating a hot fix for this? I am currently running MS Windows 2003 Server R2 inside VMWare running on XP.
Thanks for any info you can give me.
_____________________________
Richard
|
|
|
|
|
RE: Microsoft setuid binaries won't run in SUA 5.2 - May 17, '06, 11:02:25 AM
|
|
|
breiter
Posts: 343
Joined: Jun. 14, '04,
From: Washington, DC
Status: offline
|
I would run your app that has the setuid bit set and watch it with Filemon from sysinternals. If you see delete pending on some temp file in the C:\WINDOWS directory then you are bitten and there's nothing you can do but figure out what is causing the delayed write. It could be VMWare.
I'm assuming that when you installed the R2 SDK you enabled setuid. Otherwise you have to enable it in the registry and reboot your server.
It is possible for extended attributes to be corrupt as well. One other thing to try is to remove and re-add the setuid bit to see if the problem goes away.
|
|
|
|
|
RE: Microsoft setuid binaries won't run in SUA 5.2 - May 17, '06, 11:29:28 AM
|
|
|
rfoletta
Posts: 9
Joined: May 17, '06,
Status: offline
|
Hi, Thanks for the quick response. I enabled the execute setuid later with regini C:\WINDOWS\SUA\common\setup\enablesetuid.ini
I also tried the chmod u-s. chmod u+s commands too.
Below is a Filemon capture of my program. I don't see the PENDING return status you are talking about but what I do see is the NAME INVALID response when trying to open the reg.LOCAL. Do you know what that might be? I noticed the path is messed up. It starts with "C:\??C:\".
188 3:18:49 PM reg:1988 READ C:\WINDOWS\TEMP\$$s59.tmp\reg SUCCESS Offset: 1024 Length: 32768
189 3:18:49 PM reg:1988 READ C:\WINDOWS\TEMP\$$s59.tmp\reg SUCCESS Offset: 33792 Length: 6144
190 3:18:49 PM reg:1988 READ C:\WINDOWS\TEMP\$$s59.tmp\reg SUCCESS Offset: 39936 Length: 1536
191 3:18:49 PM reg:1988 READ C:\WINDOWS\TEMP\$$s59.tmp\reg SUCCESS Offset: 41472 Length: 5120
192 3:18:49 PM reg:1988 READ C:\WINDOWS\TEMP\$$s59.tmp\reg SUCCESS Offset: 46592 Length: 512
193 3:18:49 PM reg:1988 READ C:\WINDOWS\TEMP\$$s59.tmp\reg SUCCESS Offset: 47104 Length: 10752
194 3:18:49 PM reg:1988 READ C:\WINDOWS\TEMP\$$s59.tmp\reg SUCCESS Offset: 57856 Length: 512
195 3:18:49 PM reg:1988 READ C:\WINDOWS\TEMP\$$s59.tmp\reg SUCCESS Offset: 58368 Length: 512
196 3:18:49 PM reg:1988 READ C:\WINDOWS\TEMP\$$s59.tmp\reg SUCCESS Offset: 58880 Length: 512
197 3:18:49 PM reg:1988 READ C:\WINDOWS\TEMP\$$s59.tmp\reg SUCCESS Offset: 59392 Length: 4096
198 3:18:49 PM reg:1988 READ C:\WINDOWS\TEMP\$$s59.tmp\reg SUCCESS Offset: 63488 Length: 2048
199 3:18:49 PM reg:1988 READ C:\WINDOWS\TEMP\$$s59.tmp\reg SUCCESS Offset: 65536 Length: 7680
200 3:18:49 PM reg:3880 OPEN C:\WINDOWS\system32\ SUCCESS Options: Open Directory Access: Traverse
201 3:18:49 PM reg:3880 QUERY INFORMATION C:\??\C:\WINDOWS\SUA\du0\com\bin\reg.Local NAME INVALID Attributes: Error
202 3:18:49 PM reg:3880 QUERY INFORMATION C:\WINDOWS\system32\PSXDLL.dll SUCCESS Attributes: RA
203 3:18:49 PM reg:3880 OPEN C:\WINDOWS\system32\PSXDLL.dll SUCCESS Options: Open Access: All
204 3:18:49 PM reg:3880 CLOSE C:\WINDOWS\system32\PSXDLL.dll SUCCESS
222 3:18:49 PM reg:3880 QUERY INFORMATION C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS Attributes: A
223 3:18:49 PM reg:3880 OPEN C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS Options: Open Access: Execute
224 3:18:49 PM reg:3880 QUERY INFORMATION C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS Length: 29184
225 3:18:49 PM reg:3880 CLOSE C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS
226 3:18:49 PM reg:3880 QUERY INFORMATION C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS Attributes: A
227 3:18:49 PM reg:3880 OPEN C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS Options: Open Access: All
228 3:18:49 PM reg:3880 CLOSE C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS
243 3:18:49 PM reg:3880 READ C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS Offset: 0 Length: 4096
263 3:18:49 PM reg:3880 QUERY INFORMATION C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS Attributes: A
264 3:18:49 PM reg:3880 OPEN C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS Options: Open Access: Execute
265 3:18:49 PM reg:3880 QUERY INFORMATION C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS Length: 474112
266 3:18:49 PM reg:3880 CLOSE C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS
267 3:18:49 PM reg:3880 QUERY INFORMATION C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS Attributes: A
268 3:18:49 PM reg:3880 OPEN C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS Options: Open Access: All
269 3:18:50 PM reg:3880 CLOSE C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS
275 3:18:50 PM reg:3880 READ C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS Offset: 0 Length: 4096
286 3:18:50 PM reg:3880 QUERY INFORMATION C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS Attributes: A
287 3:18:50 PM reg:3880 OPEN C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS Options: Open Access: Execute
288 3:18:50 PM reg:3880 QUERY INFORMATION C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS Length: 248575
289 3:18:50 PM reg:3880 CLOSE C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS
290 3:18:50 PM reg:3880 QUERY INFORMATION C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS Attributes: A
291 3:18:50 PM reg:3880 OPEN C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS Options: Open Access: All
292 3:18:50 PM reg:3880 CLOSE C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS
298 3:18:50 PM reg:3880 READ C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS Offset: 0 Length: 4096
309 3:18:50 PM reg:3880 QUERY INFORMATION C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS Attributes: A
310 3:18:50 PM reg:3880 OPEN C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS Options: Open Access: Execute
311 3:18:50 PM reg:3880 QUERY INFORMATION C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS Length: 770623
312 3:18:50 PM reg:3880 CLOSE C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS
313 3:18:50 PM reg:3880 QUERY INFORMATION C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS Attributes: A
314 3:18:50 PM reg:3880 OPEN C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS Options: Open Access: All
315 3:18:50 PM reg:3880 CLOSE C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS
352 3:18:50 PM reg:3880 CLOSE C:\WINDOWS\system32\ SUCCESS
_____________________________
Richard
|
|
|
|
|
RE: Microsoft setuid binaries won't run in SUA 5.2 - May 17, '06, 11:42:12 AM
|
|
|
rfoletta
Posts: 9
Joined: May 17, '06,
Status: offline
|
Sorry about the large posts. The last post was filtered to show only the reg process. Below is everything that happened when I ran my reg program.
376 10:33:04 AM VMwareService.e:1860 IRP_MJ_CREATE C:\Program Files\VMware\VMware Tools\ SUCCESS Options: Open Directory Access: All
377 10:33:04 AM VMwareService.e:1860 IRP_MJ_DIRECTORY_CONTROL C:\Program Files\VMware\VMware Tools\ SUCCESS FileBothDirectoryInformation: tools.conf
378 10:33:04 AM VMwareService.e:1860 IRP_MJ_CLEANUP C:\Program Files\VMware\VMware Tools\ SUCCESS
379 10:33:04 AM VMwareService.e:1860 IRP_MJ_CLOSE C:\Program Files\VMware\VMware Tools\ SUCCESS
380 10:33:04 AM VMwareUser.exe:684 IRP_MJ_CREATE C:\Program Files\VMware\VMware Tools\ SUCCESS Options: Open Directory Access: All
381 10:33:04 AM VMwareUser.exe:684 IRP_MJ_DIRECTORY_CONTROL C:\Program Files\VMware\VMware Tools\ SUCCESS FileBothDirectoryInformation: tools.conf
382 10:33:04 AM VMwareUser.exe:684 IRP_MJ_CLEANUP C:\Program Files\VMware\VMware Tools\ SUCCESS
383 10:33:04 AM VMwareUser.exe:684 IRP_MJ_CLOSE C:\Program Files\VMware\VMware Tools\ SUCCESS
384 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\com\bin SUCCESS Options: Open Access: All
385 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\du0\com\bin SUCCESS FileFsAttributeInformation
386 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_BASIC_INFO C:\WINDOWS\SUA\du0\com\bin SUCCESS Attributes: DA
387 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\du0\com\bin SUCCESS
388 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\du0\com\bin SUCCESS
389 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS Options: Open Access: All
390 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS FileFsAttributeInformation
391 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_BASIC_INFO C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS Attributes: A
392 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_INFORMATION C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS FileInternalInformation
393 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_SECURITY C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS
394 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_EA C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS
395 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_STANDARD_INFO C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS Length: 73216
396 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS FileFsSizeInformation
397 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS
398 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS
399 10:33:04 AM ksh:536 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\com\bin SUCCESS Options: Open Access: All
400 10:33:04 AM ksh:536 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\du0\com\bin SUCCESS FileFsAttributeInformation
401 10:33:04 AM ksh:536 FASTIO_QUERY_BASIC_INFO C:\WINDOWS\SUA\du0\com\bin SUCCESS Attributes: DA
402 10:33:04 AM ksh:536 IRP_MJ_CLEANUP C:\WINDOWS\SUA\du0\com\bin SUCCESS
403 10:33:04 AM ksh:536 IRP_MJ_CLOSE C:\WINDOWS\SUA\du0\com\bin SUCCESS
404 10:33:04 AM ksh:536 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS Options: Open Access: All
405 10:33:04 AM ksh:536 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS FileFsAttributeInformation
406 10:33:04 AM ksh:536 IRP_MJ_QUERY_INFORMATION C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS FileBasicInformation
407 10:33:04 AM ksh:536 IRP_MJ_CLEANUP C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS
408 10:33:04 AM ksh:536 IRP_MJ_CLOSE C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS
409 10:33:04 AM ksh:2688 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\com\bin SUCCESS Options: Open Access: All
410 10:33:04 AM ksh:2688 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\du0\com\bin SUCCESS FileFsAttributeInformation
411 10:33:04 AM ksh:2688 FASTIO_QUERY_BASIC_INFO C:\WINDOWS\SUA\du0\com\bin SUCCESS Attributes: DA
412 10:33:04 AM ksh:2688 IRP_MJ_CLEANUP C:\WINDOWS\SUA\du0\com\bin SUCCESS
413 10:33:04 AM ksh:2688 IRP_MJ_CLOSE C:\WINDOWS\SUA\du0\com\bin SUCCESS
414 10:33:04 AM ksh:2688 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS Options: Open Access: All
415 10:33:04 AM ksh:2688 IRP_MJ_QUERY_EA C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS
416 10:33:04 AM ksh:2688 IRP_MJ_CLEANUP C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS
417 10:33:04 AM ksh:2688 IRP_MJ_CLOSE C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS
418 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\com\bin SUCCESS Options: Open Access: All
419 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\du0\com\bin SUCCESS FileFsAttributeInformation
420 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_BASIC_INFO C:\WINDOWS\SUA\du0\com\bin SUCCESS Attributes: DA
421 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\du0\com\bin SUCCESS
422 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\du0\com\bin SUCCESS
423 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS Options: Open Access: All
424 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_EA C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS
425 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_SECURITY C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS
426 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS Options: Open Sequential Access: All
427 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\Documents and Settings\All Users\Application Data\Microsoft NAME COLLISION Options: Create Directory Access: All
428 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto NAME COLLISION Options: Create Directory Access: All
429 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA NAME COLLISION Options: Create Directory Access: All
430 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18 NAME COLLISION Options: Create Directory Access: All
431 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_2a49e93b-8c66-4a0f-83fa-e410b3e0ac57 SUCCESS Options: Open Sequential Access: All
432 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_STANDARD_INFO C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_2a49e93b-8c66-4a0f-83fa-e410b3e0ac57 SUCCESS Length: 1275
433 10:33:04 AM psxss.exe:1988 IRP_MJ_READ C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_2a49e93b-8c66-4a0f-83fa-e410b3e0ac57 SUCCESS Offset: 0 Length: 1275
434 10:33:04 AM System:4 IRP_MJ_CLOSE C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_2a49e93b-8c66-4a0f-83fa-e410b3e0ac57 SUCCESS
435 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_2a49e93b-8c66-4a0f-83fa-e410b3e0ac57 SUCCESS
436 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS FileFsVolumeInformation
437 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_INFORMATION C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS FileInternalInformation
438 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_OPEN C:\WINDOWS\TEMP SUCCESS Attributes: D
439 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\TEMP\$$s61.tmp SUCCESS Options: Create Access: All
440 10:33:04 AM psxss.exe:1988 IRP_MJ_READ* C:\$Mft SUCCESS Offset: 17326080 Length: 4096
441 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\TEMP\$$s61.tmp SUCCESS
442 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\TEMP\$$s61.tmp SUCCESS
443 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\TEMP\$$s61.tmp SUCCESS Options: Open Access: All
444 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_INFORMATION C:\WINDOWS\TEMP\$$s61.tmp SUCCESS FileAttributeTagInformation
445 10:33:04 AM psxss.exe:1988 IRP_MJ_SET_INFORMATION C:\WINDOWS\TEMP\$$s61.tmp SUCCESS Delete
446 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\TEMP\$$s61.tmp SUCCESS
447 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\TEMP\$$s61.tmp SUCCESS
448 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\TEMP\$$s61.tmp SUCCESS Options: Create Directory Access: All
449 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS Options: Create Sequential Access: All
450 10:33:04 AM psxss.exe:1988 IRP_MJ_READ C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS Offset: 0 Length: 65536
451 10:33:04 AM psxss.exe:1988 IRP_MJ_WRITE C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS Offset: 0 Length: 65536
452 10:33:04 AM psxss.exe:1988 FASTIO_READ C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS Offset: 65536 Length: 65536
453 10:33:04 AM psxss.exe:1988 FASTIO_WRITE C:\WINDOWS\TEMP\$$s61.tmp\reg FAILURE Offset: 65536 Length: 7680
454 10:33:04 AM psxss.exe:1988 IRP_MJ_WRITE C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS Offset: 65536 Length: 7680
455 10:33:04 AM psxss.exe:1988 FASTIO_READ C:\WINDOWS\SUA\du0\com\bin\reg END OF FILE Offset: 73216 Length: 65536
456 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_STANDARD_INFO C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS Length: 73216
457 10:33:04 AM psxss.exe:1988 IRP_MJ_WRITE* C:\$ConvertToNonresident SUCCESS Offset: 0 Length: 65536
458 10:33:04 AM System:4 IRP_MJ_CLOSE C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS
459 10:33:04 AM psxss.exe:1988 IRP_MJ_WRITE* C:\$ConvertToNonresident SUCCESS Offset: 65536 Length: 8192
460 10:33:04 AM psxss.exe:1988 IRP_MJ_WRITE* C:\$ConvertToNonresident SUCCESS Offset: 0 Length: 65536
461 10:33:04 AM psxss.exe:1988 IRP_MJ_WRITE* C:\$ConvertToNonresident SUCCESS Offset: 65536 Length: 8192
462 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS
463 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\TEMP\$$s61.tmp SUCCESS
464 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\TEMP\$$s61.tmp SUCCESS
465 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS
466 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_EA C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS
467 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS
468 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\du0\com\bin\reg SUCCESS
469 10:33:04 AM reg:1988 IRP_MJ_READ* C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS Offset: 1024 Length: 32768
470 10:33:04 AM reg:1988 IRP_MJ_READ* C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS Offset: 33792 Length: 6144
471 10:33:04 AM reg:1988 IRP_MJ_READ* C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS Offset: 39936 Length: 1536
472 10:33:04 AM reg:1988 IRP_MJ_READ* C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS Offset: 41472 Length: 5120
473 10:33:04 AM reg:1988 IRP_MJ_READ* C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS Offset: 46592 Length: 512
474 10:33:04 AM reg:1988 IRP_MJ_READ* C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS Offset: 47104 Length: 10752
475 10:33:04 AM reg:1988 IRP_MJ_READ* C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS Offset: 57856 Length: 512
476 10:33:04 AM reg:1988 IRP_MJ_READ* C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS Offset: 58368 Length: 512
477 10:33:04 AM reg:1988 IRP_MJ_READ* C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS Offset: 58880 Length: 512
478 10:33:04 AM reg:1988 IRP_MJ_READ* C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS Offset: 59392 Length: 4096
479 10:33:04 AM reg:1988 IRP_MJ_READ* C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS Offset: 63488 Length: 2048
480 10:33:04 AM reg:1988 IRP_MJ_READ* C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS Offset: 65536 Length: 7680
481 10:33:04 AM reg:840 IRP_MJ_CREATE C:\WINDOWS\system32\ SUCCESS Options: Open Directory Access: Traverse
482 10:33:04 AM reg:840 FASTIO_QUERY_OPEN C:\??\C:\WINDOWS\SUA\du0\com\bin\reg.Local NAME INVALID Attributes: Error
483 10:33:04 AM reg:840 FSCTL_IS_VOLUME_MOUNTED C:\WINDOWS\system32\ SUCCESS
484 10:33:04 AM reg:840 FASTIO_QUERY_OPEN C:\WINDOWS\system32\PSXDLL.dll SUCCESS Attributes: RA
485 10:33:04 AM reg:840 IRP_MJ_CREATE C:\WINDOWS\system32\PSXDLL.dll SUCCESS Options: Open Access: All
486 10:33:04 AM reg:840 IRP_MJ_CLEANUP C:\WINDOWS\system32\PSXDLL.dll SUCCESS
487 10:33:04 AM reg:840 IRP_MJ_CLOSE C:\WINDOWS\system32\PSXDLL.dll SUCCESS
488 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\lib\ld.so SUCCESS Options: Open Access: All
489 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\usr\lib\ld.so SUCCESS FileFsAttributeInformation
490 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_INFORMATION C:\WINDOWS\SUA\usr\lib\ld.so SUCCESS FileBasicInformation
491 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_INFORMATION C:\WINDOWS\SUA\usr\lib\ld.so SUCCESS FileStandardInformation
492 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\lib\ld.so SUCCESS Options: Open Access: All
493 10:33:04 AM psxss.exe:1988 IRP_MJ_READ C:\WINDOWS\SUA\usr\lib\ld.so SUCCESS Offset: 0 Length: 8
494 10:33:04 AM psxss.exe:1988 FASTIO_READ C:\WINDOWS\SUA\usr\lib\ld.so SUCCESS Offset: 8 Length: 48
495 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\lib\ld.so SUCCESS
496 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\lib\ld.so SUCCESS
497 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\lib\ld.so SUCCESS
498 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS Options: Open Access: All
499 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS FileFsAttributeInformation
500 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_INFORMATION C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS FileBasicInformation
501 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS
502 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS
503 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS Options: Open Access: All
504 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS FileFsAttributeInformation
505 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_BASIC_INFO C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS Attributes: A
506 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS
507 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS
508 10:33:04 AM System:4 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\lib\ld.so SUCCESS
509 10:33:04 AM reg:840 FASTIO_QUERY_OPEN C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS Attributes: A
510 10:33:04 AM reg:840 IRP_MJ_CREATE C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS Options: Open Access: Execute
511 10:33:04 AM reg:840 FASTIO_QUERY_STANDARD_INFO C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS Length: 29184
512 10:33:04 AM reg:840 IRP_MJ_CLEANUP C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS
513 10:33:04 AM reg:840 IRP_MJ_CLOSE C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS
514 10:33:04 AM reg:840 FASTIO_QUERY_OPEN C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS Attributes: A
515 10:33:04 AM reg:840 IRP_MJ_CREATE C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS Options: Open Access: All
516 10:33:04 AM reg:840 IRP_MJ_CLEANUP C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS
517 10:33:04 AM reg:840 IRP_MJ_CLOSE C:\WINDOWS\SUA\opt\gcc.3.3\lib\ld.so.1 SUCCESS
518 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS Options: Open Access: All
519 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS FileFsAttributeInformation
520 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_BASIC_INFO C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS Attributes: SA
521 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_STANDARD_INFO C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS Length: 74
522 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS Options: Open Access: All
523 10:33:04 AM psxss.exe:1988 IRP_MJ_READ C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS Offset: 0 Length: 8
524 10:33:04 AM psxss.exe:1988 FASTIO_READ C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS Offset: 8 Length: 66
525 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS
526 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS
527 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS
528 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS Options: Open Access: All
529 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS FileFsAttributeInformation
530 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_BASIC_INFO C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS Attributes: A
531 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C: SUCCESS Options: Open Access: All
532 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_INFORMATION C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS FileInternalInformation
533 10:33:04 AM System:4 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS
534 10:33:04 AM reg:840 IRP_MJ_READ C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS Offset: 0 Length: 4096
535 10:33:04 AM System:4 IRP_MJ_CLOSE C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS
536 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS
537 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS
538 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS
539 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS Options: Open Access: All
540 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS FileFsAttributeInformation
541 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_INFORMATION C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS FileBasicInformation
542 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_INFORMATION C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS FileStandardInformation
543 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS Options: Open Access: All
544 10:33:04 AM psxss.exe:1988 IRP_MJ_READ C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS Offset: 0 Length: 8
545 10:33:04 AM psxss.exe:1988 FASTIO_READ C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS Offset: 8 Length: 66
546 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS
547 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS
548 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS
549 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\lib\libstdc++.so.5.2 SUCCESS
550 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS Options: Open Access: All
551 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS FileFsAttributeInformation
552 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_INFORMATION C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS FileBasicInformation
553 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS
554 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS
555 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS Options: Open Access: All
556 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS FileFsAttributeInformation
557 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_BASIC_INFO C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS Attributes: A
558 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS
559 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS
560 10:33:04 AM reg:840 FASTIO_QUERY_OPEN C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS Attributes: A
561 10:33:04 AM reg:840 IRP_MJ_CREATE C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS Options: Open Access: Execute
562 10:33:04 AM reg:840 FASTIO_QUERY_STANDARD_INFO C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS Length: 474112
563 10:33:04 AM reg:840 IRP_MJ_CLEANUP C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS
564 10:33:04 AM reg:840 IRP_MJ_CLOSE C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS
565 10:33:04 AM reg:840 FASTIO_QUERY_OPEN C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS Attributes: A
566 10:33:04 AM reg:840 IRP_MJ_CREATE C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS Options: Open Access: All
567 10:33:04 AM System:4 IRP_MJ_SET_INFORMATION* C:\$ConvertToNonresident SUCCESS Length: 73216
568 10:33:04 AM reg:840 IRP_MJ_CLEANUP C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS
569 10:33:04 AM reg:840 IRP_MJ_CLOSE C:\WINDOWS\SUA\opt\gcc.3.3\lib\libstdc++.so.5.2 SUCCESS
570 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS Options: Open Access: All
571 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS FileFsAttributeInformation
572 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_BASIC_INFO C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS Attributes: A
573 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C: SUCCESS Options: Open Access: All
574 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_INFORMATION C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS FileInternalInformation
575 10:33:04 AM reg:840 IRP_MJ_READ C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS Offset: 0 Length: 4096
576 10:33:04 AM System:4 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS
577 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS
578 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS
579 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS
580 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS Options: Open Access: All
581 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS FileFsAttributeInformation
582 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_INFORMATION C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS FileBasicInformation
583 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS
584 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS
585 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS Options: Open Access: All
586 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS FileFsAttributeInformation
587 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_BASIC_INFO C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS Attributes: A
588 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS
589 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS
590 10:33:04 AM reg:840 FASTIO_QUERY_OPEN C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS Attributes: A
591 10:33:04 AM reg:840 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS Options: Open Access: Execute
592 10:33:04 AM reg:840 FASTIO_QUERY_STANDARD_INFO C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS Length: 248575
593 10:33:04 AM reg:840 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS
594 10:33:04 AM reg:840 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS
595 10:33:04 AM reg:840 FASTIO_QUERY_OPEN C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS Attributes: A
596 10:33:04 AM reg:840 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS Options: Open Access: All
597 10:33:04 AM reg:840 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS
598 10:33:04 AM reg:840 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\lib\libm.so.5.2 SUCCESS
599 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS Options: Open Access: All
600 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS FileFsAttributeInformation
601 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_BASIC_INFO C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS Attributes: A
602 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C: SUCCESS Options: Open Access: All
603 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_INFORMATION C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS FileInternalInformation
604 10:33:04 AM reg:840 IRP_MJ_READ C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS Offset: 0 Length: 4096
605 10:33:04 AM System:4 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS
606 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS
607 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS
608 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS
609 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS Options: Open Access: All
610 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS FileFsAttributeInformation
611 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_INFORMATION C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS FileBasicInformation
612 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS
613 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS
614 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS Options: Open Access: All
615 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS FileFsAttributeInformation
616 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_BASIC_INFO C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS Attributes: A
617 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS
618 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS
619 10:33:04 AM reg:840 FASTIO_QUERY_OPEN C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS Attributes: A
620 10:33:04 AM reg:840 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS Options: Open Access: Execute
621 10:33:04 AM reg:840 FASTIO_QUERY_STANDARD_INFO C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS Length: 770623
622 10:33:04 AM reg:840 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS
623 10:33:04 AM reg:840 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS
624 10:33:04 AM reg:840 FASTIO_QUERY_OPEN C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS Attributes: A
625 10:33:04 AM reg:840 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS Options: Open Access: All
626 10:33:04 AM reg:840 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS
627 10:33:04 AM reg:840 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\lib\libc.so.5.2 SUCCESS
628 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\local\lib\.ccicom.path NOT FOUND Options: Open Access: All
629 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\local\lib\.ccicom.path NOT FOUND Options: Open Access: All
630 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\local\lib\.ccicom.path NOT FOUND Options: Open Access: All
631 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\local\lib\.ccicom.path NOT FOUND Options: Open Access: All
632 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\usr\local\lib SUCCESS Options: Open Access: All
633 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\usr\local\lib SUCCESS FileFsAttributeInformation
634 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_BASIC_INFO C:\WINDOWS\SUA\usr\local\lib SUCCESS Attributes: D
635 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\usr\local\lib SUCCESS
636 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\usr\local\lib SUCCESS
637 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\trace\reg NOT FOUND Options: Open Access: All
638 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\trace SUCCESS Options: Open Access: All
639 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\du0\trace SUCCESS FileFsAttributeInformation
640 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_BASIC_INFO C:\WINDOWS\SUA\du0\trace SUCCESS Attributes: D
641 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\du0\trace SUCCESS
642 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\du0\trace SUCCESS
643 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\trace\.reg NOT FOUND Options: Open Access: All
644 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\trace\.reg NOT FOUND Options: Open Access: All
645 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\trace\.reg NOT FOUND Options: Open Access: All
646 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\trace\.reg NOT FOUND Options: Open Access: All
647 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\trace SUCCESS Options: Open Access: All
648 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\du0\trace SUCCESS FileFsAttributeInformation
649 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_BASIC_INFO C:\WINDOWS\SUA\du0\trace SUCCESS Attributes: D
650 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\du0\trace SUCCESS
651 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\du0\trace SUCCESS
652 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\trace\reg NOT FOUND Options: Open Access: All
653 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\trace\reg NOT FOUND Options: Open Access: All
654 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\trace\reg NOT FOUND Options: Open Access: All
655 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\trace\reg NOT FOUND Options: Open Access: All
656 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\SUA\du0\trace SUCCESS Options: Open Access: All
657 10:33:04 AM psxss.exe:1988 IRP_MJ_QUERY_VOLUME_INFORMATION C:\WINDOWS\SUA\du0\trace SUCCESS FileFsAttributeInformation
658 10:33:04 AM psxss.exe:1988 FASTIO_QUERY_BASIC_INFO C:\WINDOWS\SUA\du0\trace SUCCESS Attributes: D
659 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\SUA\du0\trace SUCCESS
660 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\SUA\du0\trace SUCCESS
661 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\TEMP\$$s61.tmp\reg SHARING VIOLATION Options: Open Access: All
662 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS Options: Open Access: Delete
663 10:33:04 AM psxss.exe:1988 IRP_MJ_SET_INFORMATION C:\WINDOWS\TEMP\$$s61.tmp\reg CANNOT DELETE Delete
664 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS
665 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\TEMP\$$s61.tmp\reg SUCCESS
666 10:33:04 AM psxss.exe:1988 IRP_MJ_CREATE C:\WINDOWS\TEMP\$$s61.tmp SUCCESS Options: Open Directory Access: All
667 10:33:04 AM psxss.exe:1988 IRP_MJ_SET_INFORMATION C:\WINDOWS\TEMP\$$s61.tmp NOT EMPTY Delete
668 10:33:04 AM psxss.exe:1988 IRP_MJ_CLEANUP C:\WINDOWS\TEMP\$$s61.tmp SUCCESS
669 10:33:04 AM psxss.exe:1988 IRP_MJ_CLOSE C:\WINDOWS\TEMP\$$s61.tmp SUCCESS
670 10:33:04 AM reg:840 IRP_MJ_CLEANUP C:\WINDOWS\system32\ SUCCESS
671 10:33:04 AM reg:840 IRP_MJ_CLOSE C:\WINDOWS\system32\ SUCCESS
672 10:33:08 AM VMwareService.e:1860 IRP_MJ_CREATE C:\ SUCCESS Options: Open Directory Access: 00000000
673 10:33:08 AM VMwareService.e:1860 IRP_MJ_QUERY_INFORMATION C:\ SUCCESS FileNameInformation
674 10:33:08 AM VMwareService.e:1860 IRP_MJ_QUERY_VOLUME_INFORMATION C:\ SUCCESS FileFsAttributeInformation
675 10:33:08 AM VMwareService.e:1860 IRP_MJ_CLEANUP C:\ SUCCESS
676 10:33:08 AM VMwareService.e:1860 IRP_MJ_CLOSE C:\ SUCCESS
677 10:33:08 AM VMwareService.e:1860 IRP_MJ_CREATE C:\ SUCCESS Options: Open Directory Access: 00000000
678 10:33:08 AM VMwareService.e:1860 IRP_MJ_QUERY_VOLUME_INFORMATION C:\ SUCCESS FileFsSizeInformation
679 10:33:08 AM VMwareService.e:1860 IRP_MJ_CLEANUP C:\ SUCCESS
680 10:33:08 AM VMwareService.e:1860 IRP_MJ_CLOSE C:\ SUCCESS
681 10:33:09 AM VMwareService.e:1860 IRP_MJ_CREATE C:\Program Files\VMware\VMware Tools\ SUCCESS Options: Open Directory Access: All
682 10:33:09 AM VMwareService.e:1860 IRP_MJ_DIRECTORY_CONTROL C:\Program Files\VMware\VMware Tools\ SUCCESS FileBothDirectoryInformation: tools.conf
683 10:33:09 AM VMwareService.e:1860 IRP_MJ_CLEANUP C:\Program Files\VMware\VMware Tools\ SUCCESS
684 10:33:09 AM VMwareService.e:1860 IRP_MJ_CLOSE C:\Program Files\VMware\VMware Tools\ SUCCESS
_____________________________
Richard
|
|
|
|
|
RE: Microsoft setuid binaries won't run in SUA 5.2 - May 25, '06, 3:29:19 PM
|
|
|
rfoletta
Posts: 9
Joined: May 17, '06,
Status: offline
|
Ok my problem was that I was calling setuid(0) (with a zero for the root user). Instead I should have been calling it with 197108 which is the Administrator user id.
|
|
|
|
 New Messages |
 No New Messages |
 Hot Topic w/ New Messages |
 Hot Topic w/o New Messages |
|
 Locked w/ New Messages |
 Locked w/o New Messages |
|
 Post New Thread
Reply to Message
Post New Poll
Submit Vote
Delete My Own Post
Delete My Own Thread
Rate Posts |
|
|
|
Printable Version
