|
Posted by Massimo on April 22, 2008, 4:01 pm
If you were Registered and logged in, you could reply and use other advanced thread options
>Massimo wrote:
>
>> Finally I did a rootkit scan with Avira's Anti Rootkit Tool and it
>> found this:
>>
>> Results:
>> Hidden key :
>> HKEY_USERS\<yourSID>\Software\Microsoft\Protected Storage System
>> Provider\<yourSID>\data
>
>Probably means there are data items defined that you cannot see under
>the default set of permissions assigned to the container key.
>
I doubt that? 'the container key'... if you mean by that:
HKEY_USERS\<yourSID>\Software\Microsoft\Protected Storage System
Provider\<yourSID>
so the same but without 'data', then I can tell you that only SYSTEM
has permissions. What does that mean? That even me as admin I have no
rights to see the whole key?
Does the 'data'of the key mean the data that I can see in regedit as:
(standard) REG_SZ (no value set) ?
>> Hidden value :
>> <samekey>
>> -> migrate
>
>So was the registry key really hidden? Well, not if you were logged on
>as an administrator. When you used regedit.exe, did you find that key
>or not? Select the key:
>
>HKUSR\<yourSID>\Software\Microsoft\Protected Storage System\<yourSID>
>
That is what I did. :-)
>Right-click on it and change permissions to add the Administrators group
>(presumably you are logged in under an admin-level account which you
>would need to be changing permissions). Give full control to the
>Administrators group.
Goddamn... this does not work. Ik tried to add the Administrators
group but after clicking on o.k. it does not add it to SYSTEM that
already has the permissions. I tried it also with my more personal
usersname under which I do have the necessary permissions for the 'one
step higher' key, but it is refused ('Name not found', The object with
the name (etc.) does not come from a domain that belongs to the
dialogue window Choose location, and thus is invalid.)
>Voila, now the data item named "migrate" shows
>up.
Alas...
>Just because you are an administrator doesn't mean you are
>automatically given permission to everything. The reason is that you
>could shoot yourself in your own foot and make the OS unbootable by
>deleting some critical keys that even admins need to be very careful in
>deleting or editing. Hiding because of permissions should not be
>considered rootkit behavior. Also, that data item has a value, not a
>path to an executable.
>
I see
>Hiding by permission is considered normal behavior, especially regarding
>security mechanisms. When you, er, Avira said it was hidden, I thought
>it might be the old trick of using null characters in the key's name
>which makes it impossible to delete that key or get into the subkeys
>(because of a quirk in the Win32API on parsing the key's name).
>SysInternals has their RegDelNull utility for that old trick
>(http://technet.microsoft.com/en-us/sysinternals/bb897448.aspx). This
>one deletes those types of deliberately malformed named registry keys.
>I don't remember its name but another utility simply strips out the null
>characters to leave the registry key so you could then drill down inside
>of it.
>
Eh, this goes a little bit to far for me I'm afraid.
>That Avira products generate false positives is not rare or unknown.
>While their anti-virus program has a nice high coverage rate for
>detecting pests, they also generate too many false positives.
>
Indeed, I am aware of Avira's reputation as to false positives.
>This registry key is part of Microsoft Pstore (Protected Data Storage);
>dropped in Windows Vista. The keys are still there but set to
>read-only. In Windows Vista, they moved to DPAPI (see
>http://msdn2.microsoft.com/en-us/library/ms995355.aspx) which has been
>around since 2001 starting in Windows 2000. Dropping Pstore is why some
>applications won't work correctly under Vista, like Outlook 2002 which
>will always prompt for the account logins the first time Outlook
>connects to those servers (it caches up the login credentials during
>that Outlook session).
Interesting, though I do not work with Vista myself yet.
Thanks for reacting!
Massimo
| 
XML site map