3 votes
Accepted

How are malware able to start on boot on windows without administrator rights?

How are malware able to start on boot on windows without administrator rights? Find a Service which runs an executable which a user can overwrite (Hint: Installed software that has its own updater ...
gowenfawr's user avatar
  • 72.9k
2 votes

Country code top-level domain (ccTLD) hijacking?

Actually this kind of thing happens all the time but it's not dependent upon Registry resources. Quite often BGP (Border Gateway Protocol) changes will misdirect vast swaths of IP addresses through ...
user10216038's user avatar
  • 8,113
2 votes
Accepted

Does this registry entry for implementing custom protocol handlers in Windows present a security risk?

In Windows command line, first nine arguments can be referenced as %1...%9. Even without the quotes, %1 represents the first argument, which from decent browsers will be a URL escaped and quoted full ...
Esa Jokinen's user avatar
  • 18.9k
1 vote

Country code top-level domain (ccTLD) hijacking?

Yes, absolutely. Each ccTLD is operated by a company within that country. Here's a list of TLDs including ccTLDs, and who manages them. For example, .ad is managed by Andorra Telecom. Not only that, ...
user253751's user avatar
  • 4,901
1 vote

Does this registry entry for implementing custom protocol handlers in Windows present a security risk?

Yes, this should be sufficient to prevent malicious websites from executing additional unexpected commands. Chromium both escapes and quotes the url before passing it to the protocol handler, and I ...
nobody's user avatar
  • 11.6k
1 vote

Is doc file really modifying registry in Windows?

As a general rule, no, the file isn't doing any of that. It's being done by the program that processes the file - in this case, the Windows version of Microsoft Word, which still uses the amazingly ...
CBHacking's user avatar
  • 48.4k
1 vote

Is doc file really modifying registry in Windows?

A Microsoft Word file does not -usually- have the ability to modify you machine, especially at any administrative level. What you are seeing is probably the inner workings of Microsoft Word/Libre ...
ARGYROU MINAS's user avatar
1 vote

How do I stop local users from bypassing the UAC on Windows 10?

You can run and install software without being admin. UAC doesn't enter into the equation. What you're looking for is AppLocker or WDAC. You will have to combine this with appropriate file system ...
vidarlo's user avatar
  • 16.1k
1 vote
Accepted

What tools can recover or do forensic analysis on deleted registry entry?

That's Registry Explorer/RECmd from -- https://ericzimmerman.github.io/#!index.md
atdre's user avatar
  • 19.1k
1 vote
Accepted

How can I remove Sticky Keys Exploit via cmd?

The syntax of the command is incorrect. reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger This will delete the value. You can do the ...
Justine Krejcha's user avatar
1 vote
Accepted

How to read command line argument for potential issue

mshta.exe parses web code to run. If you take the Javascript and run it through a beautifier: GO3sOtu = BN1; Z0y = new ActiveXObject(WScript.Shell); Aer53IGv = BY5S; Quaj7 = Z0y.RegRead(HKCU\\ ...
schroeder's user avatar
  • 129k
1 vote
Accepted

Windows registry debug

Many tools can do that. Regshot, InstallWatch Pro, InCtrl5 are some of them widely used. Get one that fits you well and use it. From Windows itself, you could use WMIC to track changes using the ...
Overmind's user avatar
  • 8,899
1 vote

Help with viewing hidden registry entries

I recently had a problem like this only yesterday (although the adware was transmitted to mine through a web server). A useful way to get rid of it and find it in the key, that I've personally found ...
MountainSide Studios's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible