How does RD protect against Ruin/Ru1n etc?

Some malware appears to create Registry keys such as:-

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ru1n

or variants like ...CurrentVersion\Ruin, where it places executable files in order to auto start at bootup.

I'm just wondering how RD protects in these situations. Obviously the 'Run' key will be protected, but it does not seem to cover 'CurrentVersion\Ru1n'. Does the malware have to knock out the 'Run' key in order to use Ruin/Ru1n etc?

How does this work in practice?

 

You would have to add the following rules:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\* | | CREATE KEY, MODIFY KEY, SET VALUE, DELETE VALUE | Ask User, Log to Disk | test | 1

HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run\* | | CREATE KEY, MODIFY KEY, SET VALUE, DELETE VALUE | Ask User, Log to Disk | test | 2

 

Correction for the second rule:

HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\* | | CREATE KEY, MODIFY KEY, SET VALUE, DELETE VALUE | Ask User, Log to Disk | test | 2

 

So that means the default settings will not protect against this sort of threat:-

http://securityresponse.symantec.com/avcenter/venc/data/w32.beagle.cg@mm.html

Which would appear to be a problem, because I have noted quite a few of these types of malware recently.

(BTW I'm still running on RD 1.3, so I've not had a look at the new default settings).

 

Wouldn't you be better off using only the CREATE KEY, MODIFY KEY options as a trigger?

It seems you would be prompted to death using those rules with SET VALUE, DELETE VALUE also (wildcards still throw me off).

Looking quickly it looks like it installs a new DLL that creates and looks to ru1n instead of run or does it alter the existing run key into ru1n? Not clear on that.

How often are new keys like unwanted "ru1n" or real legit one created/modified in those sections?

If the answer is very rarely, then wouldn't create/modify key suffice and create less prompting while still providing protection?

 

That's what I was thinking - how to protect against this type of threat without seriously affecting normal computer use.

Well I don't think its a .dll, since it has an .exe extension. If it was a .dll it would not be autostarted by that key, it would be incorporated into another process that was already autostarting.

I'm not clear on that either!

As I said I've seen several of these malwares recently (another one used 'Ruin' as the key) and it does seem to be a way of completely negating RD's protection against autostarting from the Registry.

Unless I am misunderstanding this!