New items to monitor

[Diwik]

I have just donwloaded the autoruns program from
www.sysinternals.com, which allows me to view which
programs are loaded at startup and I noticed that MS-
Antispyware does not monitor the following registry keys
that are used by programs to load itself at windows
startup:

HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify

HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Userinit

HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Shell

Besides I have notices that MS-antispayware it does not
detect when Microsoft GINA is replaced by a other GINA
such as a Cytrix GINA.

GINA: is an acronym for "graphical identification and
authentication." In regular Windows systems, the GINA is a
DLL file called msgina.dll that's responsible for the bit
of code that displays the "Press CTRL+ALT+DEL to log on"
and that accepts your username and password.

In case the default GINA from Microsoft does not provide
all the functionality that a software vendor needs, the
default GINA can be replaced with one from the third-party
vendor. The most obvious example of this is probably from
Novell. When you install Novell's Client32 software,
Microsoft's default GINA is replaced by one from Novell
that adds functionality for authenticating to NDS trees.

Many screensavers and desptop themes replace the MS GINA
dll for others, and this can represent a new open door for
spyware.

I look forward for comments on this.

Diwik
<Microsoft Beta ID=460332 />
(e-mail address removed)

 

[Bill Sanderson]

Another excellent app for determining the content of such locations is:

http://www.silentrunners.org/

This site has a .VBS script which is kept up to date by contributors

The site has published procedures for CoolWebSearch removal, and a $ (or
Euro)25 charge for guided disinfection service via the script.

In the last update they mention that they have "enhanced some of the
real-time protection agents." I like the idea of monitoring all such
integration points. The GINA replacement issue seems on the face of it a
great idea. If you are in the middle of an installation routine which
involve a GINA replacement, however, I'm not at all sure that blocking the
GINA replacement won't leave you with a system badly in need of System
Restore.