Incidents.org has an update on yesterdays story of very long registry entries not being visible in most registry tools (regedit among others.) They have an updated list of what does and does not read these long keys. They’ve alluded to nasties in the wild that are already taking advantage of this and have confirmed that the length is greater than 254 characters. On handler has written a program to scan the registry for these stealth entries
The list of programs that detect the abnormally long invisible registry entries…
AppSense Environment Manager
HiJackThis v1.99.1 (SCAN function)
Sysinternals Autoruns (mixed reports)
the programs that are not able to see them, or behave unexpectedly when these sort of entries are present in the registry…
MS AntiSpyware Beta
HiJackThis v1.99.1* (Generate StartupListLog)
Norton SystemWorks 2003 Pro
reg.exe (under some circumstances)
Registry Explorer 220.127.116.116
WinDoctor v. 7.00.22
There is a further list of programs which cannot see the entry once set, but might detect or prevent the setting of an abnormally long registry key (or one of any size)…
Spybot S&D TeaTimer
They also have a list of tools or tips….
(example: regtool list /HKLM/Software/Microsoft/Windows/CurrentVersion/Run)
(example: ls -l /proc/registry/HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run)
System Information tool (winmsd.exe)
export registry, make your edits and then re-import
Near the bottom of their writeup is a link to Tom Liston’s registry scanning utility which will search for keys longer than 254 characters.
Related PostsRelated Posts
- How to Remove SiteAdware | SiteAdware Removal Guide SiteAdware is a rogue antivirus application that is typically installed without the computer users express permission. It is promoted through trojans and fake video codec or flash player updates. Once established on the sysem it will tend to do a falsified scan of your pc and claim that you have......
- Remove Proof Defender | Proof Defender Removal Proof Defender is another rogue security application that acts and claims to be antispyware/antivirus, but in reality is nothing more than a scam to get your dollars for a program that raises red flags over imaginary viruses and claims to clean them. It's related to the Perfect Defender 2009 family......
- Nasty regedit bug This is unusual, but it sounds like there is a bug in regedit (and regedit32) which prevents the displaying of unusually long registry keys. Now, that sounds innocent enough, it also prevents the viewing of keys entered under them. Again, ok not a crisis. Imagine if you had an extremely......
- Broadway Souvenir Programs Memorabilia -> Theater Memorabilia -> Playbills For fans of Broadway, musicals, specific plays or actors, or entertainment in general, Broadway souvenir programs are a great collectible item. We've all been to a play or concert, maybe a production filled with school kids, where programs are handed out at the door.......
- Shipping bulk water Dams, reservoirs and desalination plants are expensive things to build on the off-chance that there is a drought. Gordon Cope explores a low, fixed-cost alternative to infrastructure investment. There is a mismatch between water scarcity and water infrastructure. For most countries (except permanently arid regions such as Saudi Arabia) water......
- How To Detect Windows Registry Errors And Fix Them? There are two ways to repair Windows registry errors in Windows XP and Vista. The PC registry is unique to Windows operating systems. It is also where we can find the bulk of the errors in Windows. The Windows registry exists to help your computer work efficiently and to maximize......
- Nasty regedit bug
- Windows cleanmgr takes too long at compress old files
- Big block of blank space in Add/Remove Programs
- Disinfecting a PC… part 2
- Windows Police Pro