Does it replaced already existing word documents with your executable and then switches the icon?
Also if that's it make sure there is someway to turn the "Hide full name for known extensions" or whatever on from the system, because some people (Like me) has the full name of the file displayed.
(Oct 15, 2012 07:21 PM)BaussHacker Wrote: Does it replaced already existing word documents with your executable and then switches the icon?
Also if that's it make sure there is someway to turn the "Hide full name for known extensions" or whatever on from the system, because some people (Like me) has the full name of the file displayed.
What are you talking about "it already existing word documents"??/ noo
it will infect any created docx files on that system no Matter of the Name Size or time ,
(Oct 15, 2012 07:32 PM)ZeroByte Wrote: What are you talking about "it already existing word documents"??/ noo
it will infect any created docx files on that system no Matter of the Name Size or time ,
Which is what I asked about lol.
So what is your method of it? I can think of two.
What I said (Replacing them with your executable and changing extension.)
Or
Using a shell to make those files open your program.
(Oct 15, 2012 07:32 PM)ZeroByte Wrote: What are you talking about "it already existing word documents"??/ noo
it will infect any created docx files on that system no Matter of the Name Size or time ,
hes asking if your using an exploit or if you are just changing the file and trying to spoof it on a system.
Spoofing is not very effective because people like me and baus have full file names and paths displayed showing us the spoof...
If i saw well he makes an executable change icon, and the executable open the original word document too. Great job anyway, but if sb watch the .exe at the end of the file, thats bad.
(Oct 16, 2012 09:33 AM)KingCobraXD Wrote: Let me guess, using the FileSystemWatcher to watch for *.docx files being saved onto the hard drive and then replacing them with your server?
Yeah something like that. When I saw it I just face palmed and deleted it.