>Last week, I thought I had discovered the reason why my wifi profiles weren’t sticking on my windows box. Yeah, that didn’t do squat – the quest continues.
I used SysInternals’ Process Monitor to try and make heads or tails of what’s going on, but found little useful information. As far as I can tell, two executables are of interest to me: ZCfgSvc7.exe (this is the Intel wireless zero config service) and WLANExt.exe (the Windows WLAN config tool). These do two things: they read and write registry entries consistent with this nifty SANS forensics article, and they write to files in C:ProgramDataIntelWirelessWLANProfiles and C:Users[user name]AppDataRoamingIntelWirelessWLANProfiles. The registry is where basic wifi profile information is stored, and the files to which those executables write appear to be where the WEP and WPA keys are stored (playing connect-the-dots here, but the filenames are ITProfil.enc and profiles.enc). There are two sets of files – one in c:ProgramData… and one in c:User… The first set is pretty much empty… But the second set seems to store the SSID and key. Can somebody confirm this?
I figured that if the config had been messed with (I did install a 3G dongle a few weeks ago…), it might be fixed by reinstalling the drivers. So that’s what I’ve done.
Does anybody know whether it’s the O/S’s responsibility to store those keys, or whether it’s the vendor’s responsibility?