Nasty regedit bug



This is unusual, but it sounds like there is a bug in regedit (and regedit32) which prevents the displaying of unusually long registry keys. Now, that sounds innocent enough, it also prevents the viewing of keys entered under them. Again, ok not a crisis. Imagine if you had an extremely long registry key entered in the ….software/microsoft/windows/currentversion/run area? Annoying maybe? Ok, what if it were put there by malware? Oooooooh… that would be bad….



The handlers diary at Incidents.org is detailing this bug which has been reported by Secunia. Essentially the extremely long key can be added, just not viewed with regedit/regedit32. It sounds as though the command line, reg program can display it…

(BTW as of this writing the Secunia site seems down. 8/24 9:17PM EDT)

C:>reg query HKLMSoftwareMicrosoftWindowsCurrentVersionRun

the above for instance would display it, but a browse in regedit wouldn’t. Also note that items in the extremely long entry would run just as well. The Sans Institute also mentions another program that will find the “invisible” entries Sysinternals Autoruns.

They further point out how much fun removing one of these entries might be…

Once you’ve found them, getting rid of the offending registry entries isn’t too easy, either. What worked for us during the tests was again “Autoruns” from Sysinternals, presumed you use the current (8.13) version. Older versions seem to occasionally choke on the long keys. Another approach one of the handlers used successfully was to do a “reg export” on the command line of the entire “Run” key. Then he manually deleted the entire “Run” key from the registry, edited the exported file to remove the offending keys, and re-imported the reg file, thus recreating the “Run” key.

Of course, the usual disclaimer applies when you are monkey-wrenching the registry. You have been warned.

They are also soliciting information on any other registry editors/programs that can see these extremely long entries and or remove them. Most of the more familiar tools don’t see them there….

Update 20:21 UTC: Spybot S&D, AdAware and MS AntiSpyware Beta don’t seem to find anything offending with the long key. “Show Autostarts” of MS AntiSpyware Beta does not list the hidden keys. Spybot S&D TeaTimer will intercept the registry key from being added.

That would be REAL bad….

Related Posts

Blog Traffic Exchange Related Posts
  • Clever Smitfraud.... Sometimes you see a malware implementation that you have to have respect for the cleverness/ingenuity of the design. These pests can be dastardly to get rid of, but essentially this pest was occasionally popping up a "windows integrity scanner" installer. It wasn't frequent, but it was persistent and the user......
  • Sharing contacts between Outlook and Outlook Express Not too long ago I was installing a fax machine for someone that supported Outlook Express' addressbook, but not Outlook's default addressbook. My first thought was to get Outlook (2002)/Outlook Express using the same contact format and then we'd be in business... But..., they had an exchange server so, Outlook......
  • Windows cleanmgr takes too long at compress old files Here's a quick fix for Windows 2000 and XP when using cleanmgr to clean out temporary files. I've run across many systems that it just freezes (or takes way too long) calculating space saved by compressing old files, or hangs just saying "compress old files". Well, here's one way to......
Blog Traffic Exchange Related Websites
  • Windows Computer Registry Computer maintenance? Personal Computers are more and more vulnerable these days. It's not only viruses or spyware that you need to protect your computer from, but also from your operating system clutter up. Some people de-fragment their hard drive(s) on a regular basis but that is not enough today. windows-computer-registry......
  • how to get the maximum speed of your pc or laptop A pc or a laptop may take ages to respond to any command you feed into it. This is called performance. Your pc or laptop may take too long to load the information you need urgently. Sometimes it will crush when performing light tasks. You might have realized that the......
  • How to Install a Window Air Conditioner the Right Way As summer approaches, those of us without central air are getting ready to go through the annual ritual of installing our window air conditioners. However, were you aware that a bad installation can actually raise your electricity costs and make it harder to say cool? Here are some tips to......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site