Regdefend and long registry entries

http://isc.sans.org/diary.php?date=2005-08-25

I wonder where on the list Regdefend should lie?

 

RegDefend alerts on any size value names being created, so you will see the entry being created. What you won't see is the "full value name" as there is a limit to how much RegDefend stores of it, but that doesn't affect whether or not you can block or allow the entry into the registry.

 

I have created a test program which creates a long value name in an autostart area of the registry. You can download it from here :-

http://www.ghostsecurity.com/downloads/regvaluetest.exe

I have tested it with RegDefend , and it worked ok, but be warned there may be some kernel mode software out there which cannot handle long values in the registry and might blue screen your computer.

 

Just ran it here Jason several times, PG alerted for the .exe and RD alerted twice on adding the value and delete. Nice work

 

Process Guard asked if I wanted it to run then ZoneAlarm done the same. After once I said yes, RegDefend took over. Good work Jason.