Registry value from Group Policy or malware?

[Andrew Aronoff]

Some malware critters are adding Group Policy settings to the
registry. Some current favorites are enabling Active Desktop and
specifying the wallpaper. The user unaware of Group Policy is hapless
to reset the display.

It's easy enough to scan the registry to determine if the settings
exist, but is there any way to differentiate on a given PC between
settings applied by Group Policy (which would not be alarming) from
values that were simply added to appropriate sub-keys under
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies?

If the values were unauthorized, the user would be warned. If the
values were added under the auspices of Group Policy, no warning would
be needed.

regards, Andy
--
**********

Please send e-mail to: usenet (dot) post (at) aaronoff (dot) com

To identify everything that starts up with Windows, download
"Silent Runners.vbs" at www.silentrunners.org

**********

 

[Simon Geary]

If you run gpresult /v on a suspect PC this should tell you exactly what was
being applied by Group Policy. (Assuming you use Windows XP)

 

[Andrew Aronoff]

Hi, Simon.

If you run gpresult /v on a suspect PC this should tell you exactly what was
being applied by Group Policy. (Assuming you use Windows XP)

GPRESULT /V doesn't appear to provide the info I'm looking for. For
instance, I enabled two policies to an XP Pro workstation that added
values to
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
I added a third value to this key manually, simulating the actions of
malware. I ran GPRESULT /V and saw the following:

Administrative Templates
------------------------
GPO: Local Group Policy
Setting: Software\Microsoft\Windows\CurrentVersion\Policies\Syst
em
State: Enabled

This report doesn't tell me _which_ values are the legitimate result
of policies. Is there any way to tell?

regards, Andy
--
**********

Please send e-mail to: usenet (dot) post (at) aaronoff (dot) com

To identify everything that starts up with Windows, download
"Silent Runners.vbs" at www.silentrunners.org

**********