<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2800.1400" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=315095901-09052004>Call
me crazy, but what about the built-in auditting function?</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=315095901-09052004></SPAN></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=315095901-09052004><U><FONT color=#800080><A
href="http://www.cert.org/security-improvement/implementations/i028.04.html">http://www.cert.org/security-improvement/implementations/i028.04.html</FONT></U></A></SPAN></FONT></DIV>
<DIV><FONT><SPAN class=315095901-09052004><A
href="http://www.winnetmag.com/Article/ArticleID/14742/14742.html"><FONT
face=Arial color=#0000ff
size=2>http://www.winnetmag.com/Article/ArticleID/14742/14742.html</FONT></A></DIV>
<DIV><BR><FONT face=Arial color=#0000ff size=2>Still, as Manu points out, you
don't *need* to touch the registry for any reason. It's really just
designed as an organized set of INI files. Good place to put configuration
information, but never needed just to run an executable.</FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2></FONT> </DIV>
<DIV></SPAN></FONT><SPAN class=315095901-09052004><FONT face=Arial color=#0000ff
size=2>Now, if you want to proactive and monitor the registry and prevent
things from modifying key areas, Greyware Automation makes a good tool called
"GRR!" (Greyware Registry Rearguard). It watches all the key startup
entries that most viruses try to put themselves in so that they can't restart
when your system does:</FONT></SPAN></DIV>
<DIV><SPAN class=315095901-09052004><FONT face=Arial color=#0000ff size=2><A
href="http://www.greyware.com/software/grr/">http://www.greyware.com/software/grr/</A></FONT></SPAN></DIV>
<DIV><SPAN class=315095901-09052004><FONT face=Arial color=#0000ff size=2>They
have a free trial version so you can look it over.</FONT></SPAN></DIV>
<DIV><SPAN class=315095901-09052004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=315095901-09052004><FONT face=Arial color=#0000ff
size=2>-Kit</FONT></SPAN></DIV>
<DIV><SPAN class=315095901-09052004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<BLOCKQUOTE>
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma
size=2>-----Original Message-----<BR><B>From:</B>
full-disclosure-admin@lists.netsys.com
[mailto:full-disclosure-admin@lists.netsys.com]<B>On Behalf Of
</B>m.garg@tcs.com<BR><B>Sent:</B> Saturday, May 08, 2004 7:08
PM<BR><B>To:</B> full-disclosure@lists.netsys.com<BR><B>Subject:</B> Re:
[Full-Disclosure] Registry Watcher<BR><BR></FONT></DIV><BR><FONT
size=2><TT>full-disclosure-admin@lists.netsys.com wrote on 05/09/2004 04:30:57
AM:<BR><BR>> Hi,<BR>> <BR>> Any programs out there that "watches"
changes to registry and can give an<BR>> alert? <BR>> <BR>>
<BR>> <BR>> My intention for this is only because of my limited
knowledge of the windows<BR>> registry. As I understand, no processes,
applications, programs run with out<BR>> entries in to the
registry.</TT></FONT> <BR><BR><FONT size=2><TT>this is not true. You need not
touch registry to run any program. Programs</TT></FONT> <BR><FONT
size=2><TT>generally keep their config info in the registry.
</TT></FONT><BR><FONT size=2><TT><BR>> This it seems includes virus and
Trojan installations. There are the common </TT></FONT><BR><FONT
size=2><TT>> entries that belong in the registry that<BR>> the common
installation inserts and all programs have values that must be<BR>>
inserted. If a "watcher" would have a data base to follow and any odd
or<BR>> uncommon entries could be flagged. As far as I know all newly found
viruses<BR>> insert registry entries and these could be placed in a data
base that would<BR>> cause registry to deny and flag.
</TT></FONT><BR><BR><FONT size=2><TT>viruses generally attack registry first
because most of the application including</TT></FONT> <BR><FONT size=2><TT>os
use registry for running properly.. so registry is the favorite target. but
</TT></FONT><BR><FONT size=2><TT>a virus can do much harm without changing
registry also.</TT></FONT> <BR><BR><FONT size=2><TT>> Wouldn't this in a
sense be a firewall and<BR>> virus protection method or am I really off
base in my understanding. I know<BR>> that such use is used by AdWatch and
other types of tools but I have never<BR>> seen anything mention for
protection against backdoors, Trojans and viruses.<BR>> If such a program
does not exist I'd appreciate any input on building one.<BR>> <BR>>
<BR>> <BR>> thank you<BR>> <BR>> Randall M<BR>>
<BR></TT></FONT><BR><FONT size=2><TT>cheers,</TT></FONT> <BR><FONT
size=2><TT>Manu Garg</TT></FONT> <BR><FONT
size=2><TT>http://manugarg.freezope.org</TT></FONT> <BR><FONT face=sans-serif
color=white size=2>ForwardSourceID:NT0000CDAE
</FONT></BLOCKQUOTE></BODY></HTML>