Your browser is obsolete!

The page may not load correctly.

Unexpected guests

Незваные гости

Other issues in this category (70)
  • add to favourites
    Add to Bookmarks

Dangerous Liaisons

Read: 9868 Comments: 2 Rating: 10

Thursday, October 5, 2017

A virus infection created symbolic links in the Microsoft Security Client directory. So now we have to delete both symbolic links and invalid directory trees. But how can we delete symbolic links? Whenever we try to delete them, an error message appears.

https://www.bleepingcomputer.com/forums/t/507588/virus-infection-created-symbolic-links-in-microsoft-security-client-directory

What are those symbolic links mentioned in the quotation? And why are virus makers so interested in them?

Under Linux, links are used routinely, but in Windows that’s not the case. Links can be very handy, however they merit a thorough explanation.

Let's take the file notepad.exe as an example. If you search for this file, you’ll discover it is present in at least two folders, Windows and System32.

#drweb

Windows is certainly known for all kinds of bizarre solutions, but keeping multiple copies of a file in one system is overkill. Who put them there? And why?

As a matter of fact, in Windows 3.0 the notepad was stored in the Windows folder, while under Windows NT 3.х it resided in System32. Despite the fact that both Windows versions are ancient history, the notepad can still be found in both folders. Interestingly, in some Microsoft operating systems, that’s not the case.

For example, in Windows XP and Windows Vista, notepad.exe is present in both folders. Yet, the developers behind Windows Server 2008 decided to remove the application from the Windows folder, leaving it only in System32. They probably assumed that fewer applications would be run under a server edition of Windows, and, thus, compatibility issues with third-party applications would be less likely to occur.

http://www.outsidethebox.ms/12735

Times change and so do the preferred locations for certain files, but keeping several copies of the same file on a hard drive seems odd at least as far as free disk space is concerned. So what can we do?

Asymbolic (soft) link (also known as a symlink or soft link) is a special file system entry that doesn't contain any data except for a path to a file or directory. Thus, when you go to open a link, the file it refers to is what actually opens, not the link. The number of symbolic links to a file or directory is unlimited.

That means the same file can be accessed from various locations. The operating system recognises symbolic links and opens the corresponding files automatically.

Under Windows, links were replaced by shortcuts. Shortcuts are similar to symlinks. This can be very handy when instead of a lengthy filename, you can create a shortcut to it and assign it any name you like.

Creating a symbolic link under Windows 10, 8.1, 8 and 7 is very easy. To open the command prompt, press Win+R; enter cmd and press ОК. If you're going to work with system files, you may need to open the command prompt with administrator privileges.

#drweb

The command used to create a symbolic link looks like this:

mklink /j "symlink location" "the location of the target file or folder"

Here the key /j indicates that the link is to be created for a directory. If you want to create a link to a file, this option doesn’t need to be indicated.

For example, if I want to create a symbolic link to the folder mklink on the local С drive as the folder mk on С, I need to enter the following command (the symbolic link's name and the respective file's name don't need to be the same):
mklink /j "C:\mk" "С:\mklink"

#drweb

The result will be as follows.

#drweb

https://geekteam.pro/kak-sozdat-simvolnuyu-ssyilku-v-windows-10-8-1-8-7

Under Windows, an alternative method exists for folders:

1) copy the folder for which a symbolic link needs to be created;

2) open the folder:

C:\Users\*username*\AppData\Roaming\Microsoft\Windows\Network Shortcuts

The AppData folder is hidden.;

3) Right-click on the directory window, and select Paste shortcut. A symbolic link will be created to the source directory, and you’ll be able to move to the desired location and rename it.

http://skesov.ru/sozdanie-simvolnoy-ssyilki-dlya-papki/

https://geektimes.ru/post/50878/

However, symbolic links and shortcuts have one drawback: they aren’t connected with the target file or directory. As a result:

  • If we delete the file a link (or shortcut) points to and replace it with a different file bearing the same name, opening the link will also open the new file. A golden opportunity for an attacker!
  • If we delete a file for which a symbolic link (or shortcut) exists, the link will be pointing to nowhere.

To avoid the second problem, hardlinks are used. A hardlink can be regarded as another filename. Simply put, a file will have several names, including its original name and all those created using hardlinks. So if we want to delete a file by clicking on its name, we will only remove one of the filenames. The file will still be available under the other names and will only be removed when all the hardlinks are deleted.

Symbolic links are easy to identify—in a file manager they are displayed using a specific icon. If you enter dir, you will see SYMLINK next to them. With hardlinks the situation is not so obvious.

To check whether any hardlinks exist for notepad in your system, you’ll need to launch the command prompt with administrator privileges. Use fsutil to view any existing hardlinks to a file:

fsutil hardlink list %windir%\notepad.exe

#drweb

Surprise! There aren't just two instances of notepad under Windows. There are an additional two in the winsxs folder. Under 64-bit Windows editions, there exist six of them.

#drweb

This happens because the folder System32 contains 64-bit versions of files that include notepad (here is another bizarre Windows feature from the past). Meanwhile, the folder SysWOW64 stores the 32-bit notepad.exe which has a hardlink in winsxs. You can check this out on your own.

http://www.outsidethebox.ms/12735

#Windows #terminology

The Anti-virus Times recommends

Symbolic links and hardlinks make users' lives easier, but attackers can also take advantage of them.

So if you discover a Trojan in your system, be proactive and launch your anti-virus scanner. All the links to the malicious file must be found and eliminated.

[Twitter]

Tell us what you think

To leave a comment, you need to log in under your Doctor Web site account. If you don't have an account yet, you can create one.

Comments