Update on Long registry entries bug



Incidents.org has an update on yesterdays story of very long registry entries not being visible in most registry tools (regedit among others.) They have an updated list of what does and does not read these long keys. They’ve alluded to nasties in the wild that are already taking advantage of this and have confirmed that the length is greater than 254 characters. On handler has written a program to scan the registry for these stealth entries


The list of programs that detect the abnormally long invisible registry entries…

AppSense Environment Manager
HiJackThis v1.99.1 (SCAN function)
HiJackThis v1.99.2
Stillsecure SafeAccess
Sysinternals Autoruns (mixed reports)
Regedt32 (Win2k)

the programs that are not able to see them, or behave unexpectedly when these sort of entries are present in the registry…

AdAware
Autoruns 8.13
MS AntiSpyware Beta
HijackThis v1.97.0.7
HiJackThis v1.99.0
HiJackThis v1.99.1* (Generate StartupListLog)
Msconfig (WinXP)
Norton SystemWorks 2003 Pro
RegAlyzer 1.1
RegEdit
reg.exe (under some circumstances)
Registry Explorer 3.0.0.276
Spybot S&D
WinDoctor v. 7.00.22

There is a further list of programs which cannot see the entry once set, but might detect or prevent the setting of an abnormally long registry key (or one of any size)…

Spybot S&D TeaTimer

They also have a list of tools or tips….

Cygwin regtool
(example: regtool list /HKLM/Software/Microsoft/Windows/CurrentVersion/Run)
Cygwin ls
(example: ls -l /proc/registry/HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run)
Perl’s Win32::TieRegistry
regdel
System Information tool (winmsd.exe)
export registry, make your edits and then re-import

Near the bottom of their writeup is a link to Tom Liston’s registry scanning utility which will search for keys longer than 254 characters.

Related Posts

Blog Traffic Exchange Related Posts
  • Microsoft April Updates coming Tuesday To change the Google theme of the afternoon.... Microsoft is due to release their April updates this coming Tuesday (April 11th.) Advance bulletin is here. Four updates affecting Windows, one affecting Office AND Windows. Highest severity is Critical (Explorer flaw probably) Reboot will be required... The Office/Windows update MAY require......
  • How to Remove TRE Antivirus | TRE Antivirus Removal Guide TRE Antivirus is a new entry in the Wini Family of rogue antivirus software. This family includes SoftCop (SoftCop Removal), Softsoldier (How to remove SoftSoldier), ( TrustFighter TrustFighter Removal Guide, TrustSoldier removal guide and the following others... SafeFighter (Safefighter Removal), TrustCop (TrustCop Removal Guide), SecureWarrior (SecureWarrior Removal), SecurityFighter (SecurityFighter Removal),......
  • Nasty regedit bug This is unusual, but it sounds like there is a bug in regedit (and regedit32) which prevents the displaying of unusually long registry keys. Now, that sounds innocent enough, it also prevents the viewing of keys entered under them. Again, ok not a crisis. Imagine if you had an extremely......
Blog Traffic Exchange Related Websites
  • Shipping bulk water Dams, reservoirs and desalination plants are expensive things to build on the off-chance that there is a drought. Gordon Cope explores a low, fixed-cost alternative to infrastructure investment. There is a mismatch between water scarcity and water infrastructure. For most countries (except permanently arid regions such as Saudi Arabia) water......
  • My Journey’s Financial Update 5/29/2009 One of the main reasons I started this site was to keep myself accountable to anyone that was reading. Ironic part, is that when I started I probably had no one reading so it was an exercise in futility! After searching my archives I could only find one update this......
  • Travel Computer Acquired Last week I wrote that I was looking for a travel computer. Most people would call it a PDA, but I think they are much more than today. PDAs have gotten so powerful that they can replace a laptop in some instances. I kept an eye on Craigslist last week......
en.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site