RE: [Full-Disclosure] Registry Watcher

From: Alan Melia (Melmac) (alanme_at_melmac.co.uk)
Date: 05/09/04

  • Next message: ned: "[Full-Disclosure] Icecast 2.0.0 preauth overflow" 
    To: "'Steve Menard'" <smenard@nbnet.nb.ca>, "'Full Disclosure List'" <full-disclosure@lists.netsys.com>
Date: Sun, 9 May 2004 13:14:11 +0100

    Greetings,

    Personally if you are running with least privilege then simply make the
    registry read-only ACL's can be applied to the registry too you know. I've
    worked with a couple of companies where we have made everything but the
    necessary HKCU keys read-only. This stops rogue installs and even ActiveX
    controls as well as general fiddling that some users try to do.

    I'd recommend the following reading.
    http://support.microsoft.com/default.aspx?scid=kb;en-us;246261
    http://www.microsoft.com/technet/prodtechnol/winntas/tips/winntmag/inreg.msp
    x
    http://www.microsoft.com/security/guidance/topics/DesktopSecurity.mspx

    Then there are the tools mentioned but I prefer to plan first and stick with
    stuff that Microsoft has a responsibility to fix.

    Alan Melia

    Melmac Solutions Ltd.

    http://www.melmac.co.uk

     

    -----Original Message-----
    From: full-disclosure-admin@lists.netsys.com
    [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Steve Menard
    Sent: 09 May 2004 12:48
    To: Full Disclosure List
    Subject: Re: [Full-Disclosure] Registry Watcher

    Aditya, ALD [Aditya Lalit Deshmukh] wrote:
    >>>the common installation inserts and all programs have values that
    >>>must be inserted. If a "watcher" would have a data base to follow and
    >>>any odd or uncommon entries could be flagged. As far as I know all
    >>>newly found viruses insert registry entries and these could be placed
    >>>in a data base that would cause registry to deny and flag.
    >
    >
    >>viruses generally attack registry first because most of the
    >>application including os use registry for running properly.. so
    >>registry is the favorite target. but a virus can do much harm without
    changing registry also.
    >
    >
    >
    >
    > hey for this sort of thing i use a program called as proport, it
    > watches all the autostart up registry entries and alerts u when any
    > new program is added to it. this program sits in the system tray so it
    > is not obstrusive download it from www.tudpage.com u dont want regmon
    > but proport for this sort of thing
    >
    > -aditya
    >
    >

    I think it's supposed to be

    www.tdupage.com

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: ned: "[Full-Disclosure] Icecast 2.0.0 preauth overflow"

    Relevant Pages

    • Re: Slow Internet through ISA 2004
      ... running SBS 2003. ... Same sort of hardware though. ... registry and EnablePMTUDiscovery is set to 1. ...
      (microsoft.public.windows.server.sbs)
    • Re: Norton 2002 and XP?
      ... Rainy wrote: ... I personally wouldn't use Windoctor or any of the so-called ... my feeling about any sort of registry "fixers" in XP is that if you ... sort of regular basis, and defrag whenever I think about it. ...
      (microsoft.public.windowsxp.basics)
    • Re: Info please
      ... >>> apply all those sort of Policy Restrictions, ... > If you look up & find out about all that sort of "Group Policy ... > just put Entries into the Registry, so you can (even if you don't have any ... though no (proper) Firm would ever try to rely purely ...
      (uk.people.silversurfers)
    • Re: Local ads
      ... registry the breeder is using) puts on some sort of shows for the ... The ConKC has some sort of obedience competitions. ...
      (rec.pets.dogs.breeds)
    • Re: Windows Vista - Innovation or *another* /expensive/ Knock-Off?
      ... the registry growing so big it threatened to become unmanageable. ... storing big lumps of data in the registry, only the sort of things applications ... had previously put in WIN.INI or local application initialisation files. ... file formats (with custom readers for platforms where this wasn't directly ...
      (borland.public.delphi.non-technical)
    • Quantcast