File extensions : NeverShowExt

Discussion in 'Ghost Security Suite (GSS)' started by tonyjl, Feb 4, 2006.

Thread Status:
Not open for further replies.
  1. tonyjl

    tonyjl Registered Member

    Joined:
    May 25, 2004
    Posts:
    287
    Hi Peeps.

    Thought i'd let everyone know about a few values i've added to RD. Looking through DCS's website,i found this http://www.diamondcs.com.au/index.php?page=archive&id=nevershowext
    Which points here http://www.pc-help.org/security/scrap.htm I read these ages ago (When purchased TDS & PG) but forgot all about it.

    Anyway,did a search through the registry and have added the following rules.

    HKEY_CLASSES_ROOT\* - NeverShowExt
    HKEY_CLASSES_ROOT\Clsid\* - NeverShowExt
    HKEY_LOCAL_MACHINE\Software\Classes\* - NeverShowExt
    HKEY_LOCAL_MACHINE\Software\Classes\Clsid\* - NeverShowExt

    I've set all four to block 'Set Value' and 'Delete Value'

    If anyone else finds any more,then please share.
     
  2. TonyKlein

    TonyKlein Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    4,350
    Location:
    The Netherlands
    In fact you only need one of those:

    HKEY_CLASSES_ROOT\* | NeverShowExt | SET VALUE, DELETE VALUE | Ask User, Log to Disk

    First, this only needs to be done for file extensions:

    http://www.winguides.com/registry/display.php/627/


    Secondly, if you do it in HKCR, you'll find that the change simultaneously takes place in HKLM, so there's no need to do both.

    Some reading: http://technet2.microsoft.com/WindowsServer/en/Library/dd670c1d-2501-4f32-885b-0c6a1ae662f41033.mspx

     
  3. tonyjl

    tonyjl Registered Member

    Joined:
    May 25, 2004
    Posts:
    287
    Hi Tony.

    Thanks for replying. I know about the interaction between HKCU & HKLM,but didn't know it was same with the HKCR branch aswell,thanks for pointing that out.
     
  4. TonyKlein

    TonyKlein Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    4,350
    Location:
    The Netherlands
    Well, in Win 9x and NT HKCR used to be simply an alias of HKLM\Software\Classes, and it didn't matter which of the two branches you edited, but from that very informative MS article it is apparent that things have changed a little since then.
     
Thread Status:
Not open for further replies.