ghst file updates

Discussion in 'Ghost Security Suite (GSS)' started by tonyjl, Jun 15, 2005.

Thread Status:
Not open for further replies.
  1. tonyjl

    tonyjl Registered Member

    Joined:
    May 25, 2004
    Posts:
    287
    Hi guys,just to let you know that i have added the following keys to my list as they have been known to be used by malware,i can't remember where i read this so hopefully someone elses memory will be jogged by this.

    hkey_users\*\software\microsoft\windows\currentversion\explorer\fileexts\*\application

    hkey_users\*\software\microsoft\windows\currentversion\explorer\fileexts\*\openwithlist

    As i said,can't remember where i read this :doubt: so hopefully someone can back me up about this.

    Tonyjl
     
  2. tonyjl

    tonyjl Registered Member

    Joined:
    May 25, 2004
    Posts:
    287
    OOOps nearly forgot,also added the following keys to the file extension list in both locations
    hkey_classes_root\.
    and
    hkey__local_machine\software\classes\_file\shell\open...

    comfile
    ftp
    htafile
    jsefile
    jsfile
    regfile
    scrfile
    vbefile
    vbsfile
    wsffile
    wshfile

    Tonyjl
     
  3. tonyjl

    tonyjl Registered Member

    Joined:
    May 25, 2004
    Posts:
    287
    This one might be usefull to add to Auto Starts aswell:

    HKLM\System\*\Control\SystemStartOptions

    Look here:
    http://www.sysinternals.com/Information/bootini.html

    Tonyjl
     
Thread Status:
Not open for further replies.