SSM Free - how to protect deletion of services?

Title says it all, I think.

Recently I ran across a piece of malware that deleted the SharedAccess (Windows Firewall) service when I executed it, which got me thinking of how to stop this kind of malicious behavior with SSM Free.

Here's a brief recap of what I've tried so far:

1. Monitor HKLM\System\CurrentControlSet\Services\SharedAccess
Didn't work.

2. Monitor HKLM\System\ControlSet001\Services\SharedAccess
This works ONLY if the service is not running. If the service is stopped first and then deleted, it is effectively removed from the system even if its registry keys are left intact.

I tested my system by setting up registry protection rules, then repeatedly using sc.exe and registry editing to try to delete the service in a manner of ways. Any further suggestions?

Thanks.

 

Solcroft

Add Winpooch for proper registry and file protection. Outbound net connect is a bonus with WinPooch

Reg K

 

Hi Kees,

Do you know which reg keys/values I need to monitor to prevent service deletion?

Thanks.

 

ssm free ......


Other options:
1. PG full ver.
2. Tiny Desktop Firewall pro .

 

mitchelson,

Thank you for your help, but that wasn't what I asked.

 

Reg keys -- Service Protection? Not enough.

 

Solcroft

Use EQSecure of Winpooch to protect the file path of services in the Registry

entry: HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Services\*
key: ImagePath

Protect the start status also
entry: HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Services\*
key : Start


Protect the services or better in general critical files from modification (in WinPooch or EQSecure), see pic 2


Reduce the rights/authorization to start/stop services in the registry with the registry editor, see pic 1 (in Dutch), be carefull though first google and learn how to do this according your wishes (do not just try it and hope it will work).

 

Thanks for the reply.

Will try it when I get home and let you know how it goes.

 

https://www.syssafety.com/forum/viewtopic.php?t=876&highlight=&sid=mou2m0tbokhloda5n9eab72p51

https://www.wilderssecurity.com/showthread.php?t=167008&highlight=Xp killer