kill bit ??

Discussion in 'SpywareBlaster & Other Forum' started by Peuj, Sep 3, 2003.

Thread Status:
Not open for further replies.
  1. Peuj

    Peuj Guest

    Hi,

    I read that SpywareBlaster blocks spyware ActiveX controls by setting a "kill bit"

    I would like to know how it works (simply) ?
    I read something about a microsoft patch for the killbit problem ? or a hole protection problem with the killbit ? can somebody can tell me ?

    thanx in advance
     
  2. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,332
    Location:
    Netherlands
    Hi Peuj,

    A killbit is a registry change that prevents a certian CLSID from installing and even running (if it was installed before the killbit was set)

    Quote from Javacool:
    I can only guess what you read, but in this article you can see how a killbit was used as a patch. (Relevant part quoted below)

    Regards,

    Pieter
     
  3. spy1

    spy1 Registered Member

    Joined:
    Dec 29, 2002
    Posts:
    3,139
    Location:
    Clover, SC
    javacool - Is the killbit from MS that Pieter listed above also set in SWB?

    Just wondering, since M$ has such a penchant for turning things "back on" whenever they do an update. Pete
     
  4. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,332
    Location:
    Netherlands
    Hi Pete,

    The CLSID in question is 06DD38D3-D187-11CF-A80D-00C04FD74AD8
    and unless javacool hid it, it's not in there.

    Regards,

    Pieter
     
  5. Peuj

    Peuj Guest

    thanx a lot for the informations
     
  6. javacool

    javacool BrightFort Moderator

    Joined:
    Feb 10, 2002
    Posts:
    3,997
    Nope - not currently in the SpywareBlaster database.

    Although you are right - it would probably make a good addition.

    Best regards,

    -Javacool
     
  7. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    17,877
    Location:
    New England
    You'd probably want to at the least notate it differently than the spyware items if you do add it since people would need to know to leave it killed if they decide for some reason to unset all items, remove protection and deinstall SpywareBlaster. Or, under idle circumstances, have it in a separate tab like the flash killer. It'd be bad to have people remove this kill-bit since Microsoft has set it as an extra security protection.
     
  8. javacool

    javacool BrightFort Moderator

    Joined:
    Feb 10, 2002
    Posts:
    3,997
    Not to worry - it won't be added in the current version of SpywareBlaster as you are quite right - the classifications "spyware" or "cookie" don't do it justice. ;)

    Best regards,

    -Javacool
     
  9. Peuj

    Peuj Guest

    another question does somebody know about the other Compatibility Flags like for :

    {025B1052-CB0B-11CF-A071-00A0C9A06E05} = 384
    {02466323-75ed-11cf-a267-0020af2546ea} = 8
    {03405265-b4e2-11d0-8a77-00aa00a4fbc5} = 32
    {05589fa1-c356-11ce-bf01-00aa0055595a} = 65536
    {0713E8D2-850A-101B-AFC0-4210102A8DA7} = 2080
    {105C7D20-FE19-11D2-ACB6-0080C877D9B9} = 2097152
    ......

    juste curious ;)

    thanx
     
Thread Status:
Not open for further replies.