PDA

View Full Version : Test on Vista for entries that need to be whitelisted


PepiMK
2008-04-29, 10:19
Situation: RootAlyzer lists everything that's hidden in some known ways.

Experienced: some entries are intentionally "hidden" by the system, like the SummaryInformation alternate data streams or the System Volume Information folders.

Expected: these entries should be whitelisted, so we need to test on Vista to see if this has more of these than the XP systems RootAlyzer was developed and tested on.

PepiMK
2008-04-29, 10:28
A link back: problem was mentioned in this thread

First results: Vista indeed has no administrator account listed in permissions for these registry keys:
HKLM\SYSTEM\CurrentControlSet\Services\DcomLaunch
HKLM\SYSTEM\CurrentControlSet\Services\RpcSs
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\HotStart
HKLM\SOFTWARE\Microsoft\Security Center\Svc
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\SysTray\BatMeter\Flyout

As well as many files, where we probably need to also check whether "Users" has "READ" access as an indicator that the file is fine.