Update on Long registry entries bug



Incidents.org has an update on yesterdays story of very long registry entries not being visible in most registry tools (regedit among others.) They have an updated list of what does and does not read these long keys. They’ve alluded to nasties in the wild that are already taking advantage of this and have confirmed that the length is greater than 254 characters. On handler has written a program to scan the registry for these stealth entries


The list of programs that detect the abnormally long invisible registry entries…

AppSense Environment Manager
HiJackThis v1.99.1 (SCAN function)
HiJackThis v1.99.2
Stillsecure SafeAccess
Sysinternals Autoruns (mixed reports)
Regedt32 (Win2k)

the programs that are not able to see them, or behave unexpectedly when these sort of entries are present in the registry…

AdAware
Autoruns 8.13
MS AntiSpyware Beta
HijackThis v1.97.0.7
HiJackThis v1.99.0
HiJackThis v1.99.1* (Generate StartupListLog)
Msconfig (WinXP)
Norton SystemWorks 2003 Pro
RegAlyzer 1.1
RegEdit
reg.exe (under some circumstances)
Registry Explorer 3.0.0.276
Spybot S&D
WinDoctor v. 7.00.22

There is a further list of programs which cannot see the entry once set, but might detect or prevent the setting of an abnormally long registry key (or one of any size)…

Spybot S&D TeaTimer

They also have a list of tools or tips….

Cygwin regtool
(example: regtool list /HKLM/Software/Microsoft/Windows/CurrentVersion/Run)
Cygwin ls
(example: ls -l /proc/registry/HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run)
Perl’s Win32::TieRegistry
regdel
System Information tool (winmsd.exe)
export registry, make your edits and then re-import

Near the bottom of their writeup is a link to Tom Liston’s registry scanning utility which will search for keys longer than 254 characters.

Related Posts

Blog Traffic Exchange Related Posts
  • Remove Proof Defender | Proof Defender Removal Proof Defender is another rogue security application that acts and claims to be antispyware/antivirus, but in reality is nothing more than a scam to get your dollars for a program that raises red flags over imaginary viruses and claims to clean them. It's related to the Perfect Defender 2009 family......
  • The latest and greatest in Malware Removals I have started referring to malware more and more lately because the term virus doesn't exactly describe the pests I see on peoples machines and the terms spyware or adware aren't doing justice to some of these pests either. (There are many pieces of what I would consider malware that......
  • VMWare's free VMPlayer One of the other things I had hoped to do this weekend was play around with the new VMWare player. VMware is a company that makes virtual machine software, the entry level pricing usually starting at $199 and going up from there. They've recently released a "Player" that can run......
Blog Traffic Exchange Related Websites
  • Find Out How to Level Up in Warcraft With Zygor Guide Every game enthusiast certainly knows and plays the World of Warcraft. This game series is surprisingly trickier to navigate. There's a way to do it, if you want to level up faster in the game. Guidelines on WoW leveling is available on the web, and next are basic tips to......
  • Before You Build A List - Research This First (function() {var s = document.createElement('SCRIPT'), s1 = document.getElementsByTagName('SCRIPT')[0];s.type = 'text/javascript';s.async = true;s.src = 'http://widgets.digg.com/buttons.js';s1.parentNode.insertBefore(s, s1);})(); 4Digg Digg Before you build a list Image by Getty Images via @daylife There are so many different ways that you can build a list it really can make you dizzy.  Today I am going......
  • How To Detect Windows Registry Errors And Fix Them? There are two ways to repair Windows registry errors in Windows XP and Vista. The PC registry is unique to Windows operating systems. It is also where we can find the bulk of the errors in Windows. The Windows registry exists to help your computer work efficiently and to maximize......
en.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site