Printable View
is there any program that can detect alterations to the registry according to date ?
the reason I ask this is because on December 17, 2003 an alteration/addition was made to my registry by a foreign chat service. I tried to locate the registry key, but it is well hidden.
anyone who can help me on this would be much appreciated. thanks in advance...
Well the spware program Spybot Search and destroy detects registry changes by malicious programs though I am not sure if they do all kinds. I am sure a google would find something, try www.webattack.com
nah this is not spyware it's an alteration/addition made to make a certain program act or respond differently when ran. spybot isn't meant to detect those sort of reg changes, but thanks.
Hmmm.... that's kind of interesting. I was always under the impression that the registry didn't keep track of creation and deletion dates? (at least that's what my forensics books tell me)Where did you find that?
I don't think Registry keep track of date.. Third party software may keep track of the change and the time it happen but not Windows himself.
The best luck is a system restore before that date!
If you have XP you may have daily checkpoints that you could try and restore back too. System Mechanic has a kick ass registry management module. But you really need a base line and if you already think you have a problem... I would wipe it. Then going forward make repair disks and use microsoft's built in registry backup system. Assuming you have XP or 2k.
I'm not aware of how to do it according to date but if you'd like to see the changes made by software installation you can use MS's installation monitor which will log everything performed by an install and can then "roll-back" the install if so desired.
http://www.microsoft.com/windows2000...instaler-o.asp
-Maestr0
I use a programme called regrun by Greatis Software. It runs in the back ground and surveys your system for changes to the registry. It scans your system when you log on and informs you of any changes made since the last logon. It also gives a fairly comprehensive list of all programmes that start when you start your computer. It also verifies certain system files for modifications. There are other programmes out there that do the same thing and are probably better. The main inconveniences are it does take system resources (not a lot but some) and to be really efficient it needs to be running permanently. It will not see any changes made before it is installed.
k well I don't have XP i am on 98se still, but yeah I will look into those 2 applications (regrun & instaler-o)
unfortunately its 2 late to do a restore to a prior date because the key was added and a restore won't really erase the additional key.
thanks...
I'm asking again, how do you know when it was added to the registry?Quote:
I ask this is because on December 17, 2003 an alteration/addition
On second thought, never mind...reformat and reinstall.
groovicus I never said my registry kept track of the date, but I knew the date of the registry alteration in my own reference. I said I was looking for a program that did keep track of chronological alterations/additions.
How are you searching your reg? What information do you have to go on about the key?
Ok, I think they call that parallelism.... anyway...this isn't grammar class. Good luck with your problem.Quote:
on December 17, 2003 an alteration/addition was made to my registry
I used basic search methods with regedit search for certain key words that I thought might be applicable, but that proved to be a futile search.
The key basically prompted a certain dll file to act a certain way and feed back information to the program to act a certain way which was unoriginal from the initial install.
I don't have much information on the key except a personal knowledge of the date that it was implemented. the key inhibits or prevents certain or normal behavior of the program itself.
the dll was actually altered by an unknown programmer to bypass the abnormal behavior and allow access to the program by fooling or ignoring the registry key. I have a copy of both dlls, the dll is knowns as dialogs.dll the original one is 54kb and is a normal file, the altered dll is 40 kb and is an altered version which helps bypass the reg key inhibitor.
there's a program called BinaryWork DLL Viewer 1.0.7 which allows you to do a comparisoin view of the dll programming code, but I cannot seem to find a copy of this program any longer. I used to have it and I used to try to run a comparison view of each dll, but that too proved to be futile.
I went to a certain coffee shop and poured a certain type of coffee into this cup and transfered certain ingredients within and modified the mixture of love and sat down and agreed with Groovicus.
Unless its some obsucre CLSID key, you should be able to find it manually, looking in places where the program modified keys, generally hkey/localmachine/software/*app*Quote:
Originally posted here by isle_of_infamy
the dll was actually altered by an unknown programmer to bypass the abnormal behavior and allow access to the program by fooling or ignoring the registry key. I have a copy of both dlls, the dll is knowns as dialogs.dll the original one is 54kb and is a normal file, the altered dll is 40 kb and is an altered version which helps bypass the reg key inhibitor.
there's a program called BinaryWork DLL Viewer 1.0.7 which allows you to do a comparisoin view of the dll programming code, but I cannot seem to find a copy of this program any longer. I used to have it and I used to try to run a comparison view of each dll, but that too proved to be futile.
I'm having trouble following your train of thought here, but perhaps renaming the dll file the key is modifying will give you an error message that will give you more info??
yes I'm led to believe it is an obsucre CLSID key, because deleting the software reg keys didn't seem to help.
well see the program I am speaking about is a chat service that I go to. and the registry key that which is a 3rd party reg key is implemented in order to ban the user from the chat service, but it proved to be more of annoyance than an effective ban of the user. so that's why I wanna find this key so I will know exactly where it is for reference purposes. normally users would have to reformat as indicated in a previous post in this thread, but as i said the altered dll helped me bypass the ban.
The principal matter is that I feel 3rd party alterations to the registry seemingly should be deemed a security breech, and I basically wanted to remove this breech.
THen your only recourse is probably removing the software completely, or getting banned from another computer/OS/fresh install and install a monitoring software before hand. BTW windows 2k server cd comes with a handy tool that will take a snap shot before and after of your system and then show you every reg key and file thats been changed or added since that time.Quote:
Originally posted here by isle_of_infamy
well see the program I am speaking about is a chat service that I go to. and the registry key that which is a 3rd party reg key is implemented in order to ban the user from the chat service, but it proved to be more of annoyance than an effective ban of the user. so that's why I wanna find this key so I will know exactly where it is for reference purposes. normally users would have to reformat as indicated in a previous post in this thread, but as i said the altered dll helped me bypass the ban.
The principal matter is that I feel 3rd party alterations to the registry seemingly should be deemed a security breech, and I basically wanted to remove this breech.
so you got banned somewhere and you want us to help you bypass the ban.. or figure out how to do it so that in the future you can bypass it again when they figure out why it didn't work correctly in the first place.. is that right ? If so.. forget it.. you should know better than to ask that kind of question here to begin with. If you're so anxious to get back in, I'd email the admin and beg forgiveness or bribe him/her with more money than he/she's ever seen before. (that last part is a joke.. the rest, I wasn't joking about)
sumdumguy open ur eyes and read the thread . never once did i say i wanted anyones help 2 bypass a ban, I already bypassed the ban myself without anyones help because i am that good, so seriously if u wanna add your 2 cents about something please read beforehand about the topic at hand.
what i am trying to say is that 3rd party breaching is a security violation and if u wanna argue this point i will argue it until i am blue in the face because u obviously know nothing about having a security breach implemented on ur computer so please keep ur comments to urself or i will have to mute you.
I don't need to beg anyone for anything ok.. u seem to assume way too much on this.
The bottom line is i know the date of the security breach and all that i ask is that i need a program to chronologically see registry changes in my registry so that I may eradicate the security breach. Again I emphasize the ban was more of an annoyance than anything as well as a violation of the law. the chat service is in violation of the law by using such techniques to ban people off their service, and if you want I can look this up to prove my point is correct.
nevertheless it seems as no one knows anything about this and the thread has essentially become moot, but if anyone has any further suggestions of positive nature feel free to speak up... thanks...
extremez i tried uninstalling the software about 4 years ago when i first started using their service to no avail. i'm on 98se...
I think in registry u cant figure it out the date when the registry is entered, inserted, modified, or deleted.