RE: protect MS Windows 95/98/Me

["Alexander Suhovey" <asuhovey () mtu-net ru>]

It was long ago when I played with win9x last time, but if I recall
correctly, "Disable registry tools" policy in win9x only restricts ability
to run regedit.exe. There are other ways to edit registry:
- rename regedit.exe
- use reg files
- use third-party registry editing software 
Correct me here if I'm wrong.


IMO only way to secure win9x box is to use custom boot loader and custom
shell plus physical security (locks on case, BIOS superuser password, maybe
no floppy/CD etc)
Also nobody mentioned FolderGuard [http://www.winability.com/folderguard/]
which (among other features) gives you something like NTFS' ACL for FAT.

My $0.02
--Al

> -----Original Message-----
> From: Spencer D'oro [mailto:sdoro () comcast net]
> Sent: Friday, September 26, 2003 7:33 PM
> To: 'Ansgar -59cobalt- Wiechers'
> Cc: security-basics () securityfocus com
> Subject: RE: protect MS Windows 95/98/Me
>
> But if Registry editing is disabled on the machine for that user through
> system policies, then how do you disable it through registry?  And what
> editor are you talking about?  I don't know what you are referring too,
> but please enlighten us, because if there is a way to do it, I want to
> know.
>
> Regards,
> Spencer
>
> -----Original Message-----
> From: Ansgar -59cobalt- Wiechers [mailto:bugtraq () planetcobalt net]
> Sent: Thursday, September 25, 2003 2:13 PM
> To: security-basics () securityfocus com
> Subject: Re: protect MS Windows 95/98/Me
>
>
> On 2003-09-25 Steven A. Fletcher wrote:
> > This is not necessarily true.  If Win9x policies are configured
> > properly, the users can be quite limited in what they can change, even
>
> > for the current session.  It's just a matter of putting the proper
> > time and effort into it.
>
> All I need to disable any policy is an editor and regedit.
>
> Regards
> Ansgar Wiechers
>
> ------------------------------------------------------------------------
> ---
> ------------------------------------------------------------------------
> ----
>
> ---
> Incoming mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.521 / Virus Database: 319 - Release Date: 9/23/2003
>
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.521 / Virus Database: 319 - Release Date: 9/23/2003
---------------------------------------------------------------------------
>
----------------------------------------------------------------------------


---------------------------------------------------------------------------
----------------------------------------------------------------------------