| Donate $25 for two DVDs of the Cryptome collection of files from June 1996 to the present |
23 October 2010
Previous:
http://cryptome.org/0002/clsid-list-06.htm http://cryptome.org/0002/clsid-list-05.htm
http://cryptome.org/0001/clsid-list-04.htm http://cryptome.org/0001/clsid-list-03.htm http://cryptome.org/0001/clsid-list-02.htm http://cryptome.org/0001/clsid-list-01.htm http://cryptome.org/isp-spy/ms-analysis.htm http://cryptome.org/0001/vista-clsids.htm
CLSID Shit List 7
A sends:
Before scrolling through this updated list, I recommend reading CLSID Shitlist Beyond.
http://cryptome.org/0002/clsid-beyond.htm
_________________________________________
What (A) told us is true, the registry is not the only place to hunt down viruses, spyware, or other malware infections.
Taking snapshots of the system and using a utility that tracks any changes does help filter out hidden rogue activity, good point. An inbound/outbound firewall would also help catch anything trying to establish a remote connection.
I'm surprised others have taken interest to these shit lists ; these help me to thwart registry infection, while finding more ways to improve stability and defense.
Also working with several computers, I've practiced editing and researching registry. Not only finding infected CLSIDs but what files/programs may depend on them, whether those files/programs can be trusted, or if they exist for third parties, or at times, perhaps stable.
The truth is I happen to be better detecting something abnormal or rogue inside the registry than I am finding the proper software that can be trusted.
Hard copy backups are smart, that helps alot.
I am familiar with common techniques some people use. People sometimes use an unregistered computer, with basic system defense. No updating (which should NEVER be trusted), no emailing, no logging into accounts linking to personal identity.
One computer I use now is always offline.
As (A) stated before, "someone who's trying to keep a normal Windows system secure and non-invasive has to watch a lot more than just CLSIDs." That's true.
Keep in mind, when I use the term "bleach", this does not mean "delete". What I have stumbled across after deleting infected files, is the fact they can re-surface, same as deleting an infected CLSID. (NOT referring to the system32 files meant to re-surface for protection.)
Bleaching the CLSID keeps the CLSID inside the registry without data, no strings no value, without the permission set. ... That cannot be fixed unless you stand by the computer to reprogram it. That can be a pain in the ass, sometimes that won't work either. When it's bleached, it's dead with ONLY the physical owner holding the bones to reincarnate it.
Learn how to bleach here: http://ht.ly/19nj0Z
One problem I have trouble with is finding the proper software I can trust. Most of the freeware now days is corrupt, that also goes for most of the anti-spyware people pay for in the stores. GARBAGE!
I best stick with what I study here, and that is unnecessary, unstable registry.
_________________________________________
The registry looks more complex than it is, however it IS very sensitive!
The benefit of using these guides help average folks protect their computers
from exploitation.
MMC Plugable Internet Protocol Updated
HKCR\CLSID\{3C5F432A-EF40-4669-9974-9671D4FC2E12}
HKCR\CLSID\{43136EB5-D36C-11CF-ADBC-00AA00A80033}
HKCR\CLSID\{7F1899DA-62A6-11D0-A2C6-00C04FD909DD}
HKCR\CLSID\{ADE6444B-C91F-4E37-92A4-5BB430A33340}
HKCR\CLSID\{B708457E-DB61-4C55-A92F-0D4B5E9B1224}
HKCR\CLSID\{D6FEDB1D-CF21-4BD9-AF3B-C5468E9C6684}
HKCR\CLSID\{F1E752C3-FD72-11D0-AEF6-00C04FB6DD2C}
HKCR\CLSID\{F7A4F1DA-96C3-4BCF-BEB3-1D9FFDE89EE9}
Here are all those MMC Node Manager CLSIDs.
HKEY_CLASSES_ROOT\NODEMGR.AppEventsDHTMLConnector
{ADE6444B-C91F-4E37-92A4-5BB430A33340}
HKEY_CLASSES_ROOT\NODEMGR.ComCacheCleanup
{F7A4F1DA-96C3-4BCF-BEB3-1D9FFDE89EE9}
HKEY_CLASSES_ROOT\NODEMGR.MMCDocConfig
{F1E752C3-FD72-11D0-AEF6-00C04FB6DD2C}
HKEY_CLASSES_ROOT\NODEMGR.MMCProtocol
{3C5F432A-EF40-4669-9974-9671D4FC2E12}
HKEY_CLASSES_ROOT\NODEMGR.MMCVersionInfo
{D6FEDB1D-CF21-4BD9-AF3B-C5468E9C6684}
HKEY_CLASSES_ROOT\NODEMGR.MMCViewExt
{B708457E-DB61-4C55-A92F-0D4B5E9B1224}
HKEY_CLASSES_ROOT\NODEMGR.NodeInitObject
{43136EB5-D36C-11CF-ADBC-00AA00A80033}
HKEY_CLASSES_ROOT\NODEMGR.ScopeTreeObject
{7F1899DA-62A6-11D0-A2C6-00C04FD909DD}
The Node Manager belongs to Cisco. These
CLSIDs help cache messages inside a system.
The three Cisco ports are located on ports
130 - 132; cisco-fna, cisco-tna and cisco-sys.
These CLSIDs have been bleached and tested on both
wireless and wired internet connections, both
separate systems. Node Manager is not required.
The Node Manager can be exploited by third parties
and can be used to bypass security. Safe to bleach.
There are rumors that MMC runs with a trojan rootkit.
Hacked RDNs FOUND [DO NOT BLEACH THESE]
FlashBroker
HKCR\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}
The two hacks are "Everyone" and "Anonymous Logon"
Right click, go to the permission set.
Remove both RDNs listed above!
Click "Apply" then click OK.
NEXT RDN HACKS
Follow the same procedure above. Do not bleach!
IFlashBroker2
HKCR\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}
HKCR\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}
Once fixed in HKCR, they are stable in HKLM.
BitBucket Hacker Hacks "Everyone" RDN
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Explorer\BitBucket [SAFE TO BLEACH]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Explorer\NetworkCrawler [SAFE TO BLEACH]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Explorer\RemoteComputer [SAFE TO BLEACH]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
WindowsUpdate [SAFE TO BLEACH]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
NetCache [SAFE TO BLEACH]
"Power Users" and "CREATOR OWNER" RDNs Hacked
[DO NOT BLEACH!]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc
Right click, go to the permission set.
Remove both RDNs listed above!
Click "Apply" then click OK.
FIVE RDNs TO DISABLE!
GO TO HKEY_CLASSES_ROOT, HKEY_CURRENT_USER,
HKEY_LOCAL_MACHINE, HKEY_USERS, AND HKEY_CURRENT_CONFIG.
MAKE SURE "Power Users", "CREATOR OWNER", "EVERYONE"
"Anonymous Logon" AND "RESTRICTED" ARE TAKEN OFF
OR DISABLED. LEAVE THE OTHER RDNs ALONE!
WSecEdit Security Manager is a malicious trojan
that presents security risks to the compromised
computer. Modifies security settings automatically.
WSecEdit Security Manager Class
HKCR\CLSID\{011BE22D-E453-11D1-945A-00C04FB984F9}
WSecEdit RSOP Security Settings Class
HKCR\CLSID\{1B6FC61A-648A-4493-A303-A1A22B543F01}
WSecEdit Security Configuration Class
HKCR\CLSID\{2AABFCD0-1797-11D2-ABA2-00C04FB6C6FA}
WSecEdit Local Security Settings Class
HKCR\CLSID\{2E8EA1E5-F406-46F5-AF10-661FD6539F28}
WSecEdit Security Configuration Class
HKCR\CLSID\{5ADF5BF6-E452-11D1-945A-00C04FB984F9}
WSecEdit Security Manager Class
HKCR\CLSID\{5C0786ED-1847-11D2-ABA2-00C04FB6C6FA}
WSecEdit Security Settings Class
HKCR\CLSID\{5C0786EE-1847-11D2-ABA2-00C04FB6C6FA}
WSecEdit Extension Class
HKCR\CLSID\{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}
WSecEdit Local Security Settings Class
HKCR\CLSID\{CFF49D53-EE51-49F2-A807-7E3DF4EA36E3}
WSecEdit RSOP Security Settings Class
HKCR\CLSID\{FE883157-CEBD-4570-B7A2-E4FE06ABE626}
HKEY_CLASSES_ROOT\WPDSp.WPDServiceProvider
{77F7F122-20B0-4117-A2FB-059D1FC88256}
HKEY_CLASSES_ROOT\Wsecedit.Extension
{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}
HKEY_CLASSES_ROOT\Wsecedit.LS
{CFF49D53-EE51-49F2-A807-7E3DF4EA36E3}
HKEY_CLASSES_ROOT\Wsecedit.LSAbout.1
{2E8EA1E5-F406-46F5-AF10-661FD6539F28}
HKEY_CLASSES_ROOT\Wsecedit.RSOP
{FE883157-CEBD-4570-B7A2-E4FE06ABE626}
HKEY_CLASSES_ROOT\Wsecedit.RSOPAbout.1
{1B6FC61A-648A-4493-A303-A1A22B543F01}
HKEY_CLASSES_ROOT\Wsecedit.SAV
{011BE22D-E453-11D1-945A-00C04FB984F9}
HKEY_CLASSES_ROOT\Wsecedit.SCE
{5ADF5BF6-E452-11D1-945A-00C04FB984F9}
WECAPI2 CLSIDs Updated
WECAPI2.FpStructureModification.1
HKCR\CLSID\{F6FD0A00-43F0-11D1-BE58-00A0C90A4335}
WECAPI2.FpStructureElement.1
HKCR\CLSID\{F6FD0A01-43F0-11D1-BE58-00A0C90A4335}
WECAPI2.FpFile.1
HKCR\CLSID\{F6FD0A0E-43F0-11D1-BE58-00A0C90A4335}
WECAPI2.FpMetaInfo.1
HKCR\CLSID\{F6FD0A0F-43F0-11D1-BE58-00A0C90A4335}
WECAPI2.FpFolder.1
HKCR\CLSID\{F6FD0A11-43F0-11D1-BE58-00A0C90A4335}
WECAPI2.WebExtenderClient.1
HKCR\CLSID\{F6FD0A13-43F0-11D1-BE58-00A0C90A4335}
HKEY_CLASSES_ROOT\WECAPI2.FpFile
{F6FD0A0E-43F0-11D1-BE58-00A0C90A4335}
HKEY_CLASSES_ROOT\WECAPI2.FpFolder
{F6FD0A11-43F0-11D1-BE58-00A0C90A4335}
HKEY_CLASSES_ROOT\WECAPI2.FpMetaInfo
{F6FD0A0F-43F0-11D1-BE58-00A0C90A4335}
HKEY_CLASSES_ROOT\WECAPI2.FpStructureElement
{F6FD0A01-43F0-11D1-BE58-00A0C90A4335}
HKEY_CLASSES_ROOT\WECAPI2.FpStructureModification
{F6FD0A00-43F0-11D1-BE58-00A0C90A4335}
HKEY_CLASSES_ROOT\WECAPI2.WebExtenderClient
{F6FD0A13-43F0-11D1-BE58-00A0C90A4335}
This vulnerability lets remote users execute arbitrary
scripts inside compromised systems. Windows Explorer
includes a preview pane (web view), which displays
information on some types of files when they become
selected. The preview pane is implemented via an HTML
resource file (in webvw.dll). Scripts can be injected
to execute malicious threats to the system, even
used to spy on remote users.
Microsoft claims WebView is safe. It is not safe.
WebViewCoord Class
HKEY_CLASSES_ROOT\CLSID\{7A707490-260A-11D1-83DF-00A0C90DC849}
WebViewCoord Class
HKEY_CLASSES_ROOT\CLSID\{BCFD624E-705A-11d2-A2AF-00C04FC30871}
HKEY_CLASSES_ROOT\WebViewCoord.WebViewCoord
HKLM\SOFTWARE\Classes\WebViewCoord.WebViewCoord
{7A707490-260A-11D1-83DF-00A0C90DC849}
HKEY_CLASSES_ROOT\WebViewFolderIcon.WebViewFolderIcon
HKLM\SOFTWARE\Classes\WebViewFolderIcon.WebViewFolderIcon
{e5df9d10-3b52-11d1-83e8-00a0c90dc849}
SharedTaskScheduler Spyware
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\
Explorer\SharedTaskScheduler
[Links {8C7461EF-2B13-11d2-BE35-3078302C2030}]
[Part of Component Categories conditional cache daemon.]
Component Categories conditional cache daemons
HKCR\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}
HKCR\CLSID\{DC651A43-0720-4a2b-9971-BD2EF1329A3D}
HKCR\CLSID\{E56829C9-2D59-11d2-BE38-3078302C2030}
!DO NOT BLEACH RANDOM SHELL EXTENSIONS!
*THESE ARE SAFE TO BLEACH* THESE KEEP
TRACK OF WHAT YOU DO ON YOUR SYSTEM.
*Fusion Cache*
{1D2680C9-0E2A-469d-B787-065558BC7D43}
*Microsoft History AutoComplete List*
{00BB2764-6A77-11D0-A535-00C04FD7D062}
*Microsoft Multiple AutoComplete List*
{00BB2765-6A77-11D0-A535-00C04FD7D062}
*WebCheckWebCrawler*
{08165EA0-E946-11CF-9C87-00AA005127ED}
ONLY THOSE FOUR LISTED ABOVE ARE SAFE TO BLEACH!
OTHERS CAN BE FOUND HERE:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Shell Extensions\Approved
DON'T SCREW AROUND! SHELLS ARE SENSITIVE.
Windows NT Abusive Vulnerabilities
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Network\World Full Access Shared Parameters
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
CurrentVersion\Network\Location Awareness
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
CurrentVersion\Time Zones
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
CurrentVersion\WOW\WowFax