kill bit ??

Peuj · Sep 3, 2003

Hi,

I read that SpywareBlaster blocks spyware ActiveX controls by setting a "kill bit"

I would like to know how it works (simply) ?
I read something about a microsoft patch for the killbit problem ? or a hole protection problem with the killbit ? can somebody can tell me ?

thanx in advance

Pieter_Arntz · Sep 3, 2003

Hi Peuj,

A killbit is a registry change that prevents a certian CLSID from installing and even running (if it was installed before the killbit was set)

Quote from Javacool:

Certainly.
For every Active X control, there is a unique CLSID. That CLSID number identifies only that Active X control - no others.
In the registry, there is a section under:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility
Under this section, you will find keys whose names are various Active X CLSIDs.
In each key is a DWORD value named "Compatibility Flags" - when set to a decimal equivalent of "1024", it prevents the Active X control with that CLSID from installing or even running (no Yes/No box, no worries).
SpywareBlaster creates a registry key corresponding to each spyware Active X control's CLSID, creates the DWORD value, and sets it to 1024 (decimal), thus providing the protection. New spyware Active X control CLSIDs will be added to the database as soon as they come out so you can also disable the possibility of those installing.
Hope this helps.

Regards,

-Javacool

Click to expand...

I can only guess what you read, but in this article you can see how a killbit was used as a patch. (Relevant part quoted below)

This patch also sets the Kill Bit on the Plugin.ocx ActiveX control which has
a security vulnerability. This killbit has been set in order to ensure that
the vulnerable control cannot be reintroduced onto users’ systems and to
ensure that users who already have the vulnerable control on their system are
protected. This issue is discussed further in Microsoft Knowledge Base Article
813489
Click to expand...

Regards,

Pieter

spy1 · Sep 3, 2003

javacool - Is the killbit from MS that Pieter listed above also set in SWB?

Just wondering, since M$ has such a penchant for turning things "back on" whenever they do an update. Pete

Pieter_Arntz · Sep 3, 2003

Hi Pete,

The CLSID in question is 06DD38D3-D187-11CF-A80D-00C04FD74AD8
and unless javacool hid it, it's not in there.

Regards,

Pieter

Peuj · Sep 3, 2003

thanx a lot for the informations

javacool · Sep 3, 2003

quoting: spy1 link=board=34;threadid=13270;start=0#msg84868 date=1062590745]
javacool - Is the killbit from MS that Pieter listed above also set in SWB?

Just wondering, since M$ has such a penchant for turning things "back on" whenever they do an update. Pete
Click to expand...

Nope - not currently in the SpywareBlaster database.

Although you are right - it would probably make a good addition.

Best regards,

-Javacool

LowWaterMark · Sep 3, 2003

quoting: javacool link=board=34;threadid=13270;start=0#msg84936 date=1062617306]

quoting: spy1 link=board=34;threadid=13270;start=0#msg84868 date=1062590745]
javacool - Is the killbit from MS that Pieter listed above also set in SWB?

Just wondering, since M$ has such a penchant for turning things "back on" whenever they do an update. Pete
Click to expand...

Nope - not currently in the SpywareBlaster database.

Although you are right - it would probably make a good addition.

Best regards,

-Javacool
Click to expand...

You'd probably want to at the least notate it differently than the spyware items if you do add it since people would need to know to leave it killed if they decide for some reason to unset all items, remove protection and deinstall SpywareBlaster. Or, under idle circumstances, have it in a separate tab like the flash killer. It'd be bad to have people remove this kill-bit since Microsoft has set it as an extra security protection.

javacool · Sep 3, 2003

quoting: LowWaterMark link=board=34;threadid=13270;start=0#msg84958 date=1062624079]

You'd probably want to at the least notate it differently than the spyware items if you do add it since people would need to know to leave it killed if they decide for some reason to unset all items, remove protection and deinstall SpywareBlaster. Or, under idle circumstances, have it in a separate tab like the flash killer. It'd be bad to have people remove this kill-bit since Microsoft has set it as an extra security protection.
Click to expand...

Not to worry - it won't be added in the current version of SpywareBlaster as you are quite right - the classifications "spyware" or "cookie" don't do it justice.

Best regards,

-Javacool

Peuj · Sep 4, 2003

another question does somebody know about the other Compatibility Flags like for :

{025B1052-CB0B-11CF-A071-00A0C9A06E05} = 384
{02466323-75ed-11cf-a267-0020af2546ea} = 8
{03405265-b4e2-11d0-8a77-00aa00a4fbc5} = 32
{05589fa1-c356-11ce-bf01-00aa0055595a} = 65536
{0713E8D2-850A-101B-AFC0-4210102A8DA7} = 2080
{105C7D20-FE19-11D2-ACB6-0080C877D9B9} = 2097152
......

juste curious

thanx

Log in or Sign up

kill bit ??

Peuj Guest

Pieter_Arntz Spyware Veteran

spy1 Registered Member

Pieter_Arntz Spyware Veteran

Peuj Guest

javacool BrightFort Moderator

LowWaterMark Administrator

javacool BrightFort Moderator

Peuj Guest

Log in or Sign up

kill bit ??

Peuj Guest

Pieter_Arntz Spyware Veteran

spy1 Registered Member

Pieter_Arntz Spyware Veteran

Peuj Guest

javacool BrightFort Moderator

LowWaterMark Administrator

javacool BrightFort Moderator

Peuj Guest

Useful Searches