Harlan,
thanks for the feedback.
Perhaps if you could provide some context to this issue, there might be some way to provide a more direct answer.
No context in particular. I was just discussing with a few colleagues the very possibility of malware directly tampering with the LastWrite timestamps.
Cheers,
Stefan.
How about changing the clock, then updating the key and then correcting the clock … in code it would take a second or so, you might not spot it in log files or similar …. )
Regards,
James
How about changing the clock, then updating the key and then correcting the clock … in code it would take a second or so, you might not spot it in log files or similar …. )
Regards,
James
Like mentioned earlier in the thread It works, it just requires Administrator privileges to change the system time.
Most parts of the registry are wide open and the HKCU hive can be used to set values locally for one user so they may not even have to go into the HKLM hive (unless a value is set there, in which case the whole thing is moot since HKLM takes precedence).
Updating something, even if it takes a second would be written to a log file. The actual speed in which something is performed is irrelevant since all calls to the API trigger logging. However, specifically the changing of system time does not generate one single event in any .log, .txt or Eventlog entry, at least on Win XP systems.
It is safe to assume that the lack of logging of such API calls are backwards compatible.
the changing of system time does not generate one single event in any .log, .txt or Eventlog entry, at least on Win XP systems.
It does in Vista/Win7.
…and it can also generate an Event Log entry in XP, as well.
Depending on how the system time is changed, there may also be other traces, as well. Perhaps not explicitly generated to a log file, but recorded via artifacts nonetheless.
Changing the system time as administrator in XP (SP2) with default settings does not generate an eventlog entry, i tried it earlier before my previous post.
Like I said…"can"…depends on what auditing is enabled
http//
I just verified this…