Registry key to add to protect against Coreflood botnet

Learn about Computer Security Leak Testing/Attacks/Vulnerability Research
1

From http://www.secureworks.com/research/threats/coreflood/?threat=coreflood:

Coreflood itself has a unique method of startup - it uses the registry key Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers

This key is not well-known as a startup method and not always checked by anti-malware scanners. However, when Windows Explorer or Internet Explorer is started, this key is checked and any listed DLL (referenced by GUID) will be loaded into the process and initialized. For malware, this is similar to using a browser helper object (BHO) but without using the well-known BHO registry keys

2

Interesting. Thanks for posting it. (CNY)

3

Thanks,

I added *\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers* to My protected registry keys :-TU

4

The key is covered by Autoruns.

5

Strange ??? Automatic Startup on my configuration didn’t have it

6

I mean Autoruns by Sysinternals, not CFP.

7

You’re welcome :).