Useful security tip

I came across this one at http://www.wilders.org/ , and I thought it was worth while sharing:

Windows(98) has a built in bit that allows outsiders
(any site) to read, write, and edit (in other words, to "hack") your Windows
registry. This can cause many problems for you, such as making your browser
behave strangely, changing your homepage, causing programs to hang up or not function, and launching
programs you don't want to run.

The Windows program that allows the hacking is called REGWIZC.DLL
(registry wizard control module).

The good news is that you can disable it so that it does not allow scripts on
web sites you visit to hack your registry. Here is how to disable it:

1. Click on - taskbar/start menu/run
2. Copy and paste the following line into the run field:
regsvr32.exe -u c:\windows\system\regwizc.dll
3. Click OK. You should get a popup message confirming the successful disabling
of regwizc.dll.

It is also possible to re-enable regwizc.dll, if you should later decide to allow
outsiders to get into your registry. I can't think of any reason why you should,
but this is how to do it:

1. Click on - taskbar/start menu/run
2. Copy and paste the following line into the run field:
regsvr32.exe -c c:\windows\system\regwizc.dll
3. Click OK. You should get a popup message confirming the successful reenabling of
regwizc.dll.

Good luck, Tony



[This message has been edited by Kleinkramer (edited 01-21-2002).]

Thanks, Kleinkramer, I have done it and know how to undo it, I find the word "server" in the dialog confirmation box enlightening.
I need to do more research regarding "It is also possible to re-enable regwizc.dll, if you should later decide to allow
outsiders to get into your registry. I can't think of any reason why you should".
Luke.
http://www.boomspeed.com/lukeg/R_W_C.jpg

Quote:

---

Originally posted by lukeg:
I can't think of any reason why you should".

---

Neither can I.

Actually, I disabled it myself by renaming it, which amounts to the same thing.

Cheers, Tony

By now, you've probably heard about the leak in Windows 98's Registration Wizard that compromises your privacy by exposing unique ID numbers that identify you and your PC. The ID numbers are only supposed to be available to Microsoft and were designed help Microsoft identify registered users of their products. However, it has been determined that the numbers are also attached to files created with Office applications, and even more alarming, that the numbers are available via Internet Explorer to any Web site developer who knows how to access the ID number.
To see the leak in action, point your browser to http://pharlap.com/
While Microsoft is working on a solution to this Registration Wizard leak, you may want to plug the leak immediately. Fortunately, you can do so simply by disabling the Registration Wizard. To begin, select the Run command on the Start menu. When the Run dialog box appears, type the command

regsvr32.exe -u c:\windows\system\regwizc.dll

in the Open text box and click OK. You'll then see a dialog box containing the text string ``DllUnregisterServer in c:\windows\system\regwizc.dll succeeded'' that informs you that the operation was a success. (To reenable the Registration Wizard, you'll use the same command, but substitute a -c for the -u.)

Now, return to Phar Lap Software's Windows 98 RegWiz privacy leak demo page and click the Refresh button. When you do, you'll see that the demo page can no longer access your ID numbers.

The Registration Wizard also creates an easily identifiable document on your hard disk called Reginfo.txt that can leak information about you. To prevent this, simply rename, move, or delete the Reginfo.txt file.

Do not know if this related.
Recently on the Win98 Windows Update site, I am offered the following

"Registration Wizard Update

This update allows you to remove hardware identification information from the Windows registry, if you registered your Windows 98 online.

If you registered online, the Windows 98 Registration Wizard allowed you the option of sending hardware configuration information to Microsoft. This information helps to speed up the time you spend on the phone during a support call. However, if you are concerned about storing that hardware identification information on your machine, downloading this update to delete it.

System Requirements

This update applies to Windows 98. "

Kleinkramer--Is there no down side to disabling regwizc.dll? I do have it on my PC, but no reginfo.txt file.

------------------
Jim
WIN98, IE6, cable,
Norton AV, ZoneAlarm

Quote:

---

Originally posted by Welshjim:
Do not know if this related.
Recently on the Win98 Windows Update site, I am offered the following

"Registration Wizard Update

This update allows you to remove hardware identification information from the Windows registry, if you registered your Windows 98 online.


Kleinkramer--Is there no down side to disabling regwizc.dll? I do have it on my PC, but no reginfo.txt file.

---

Hi Jim,

We're talking about the same file, and this MS update's purported to be a update, aiming to improve security.

However, there's no disadvantage that I know of to disabling it altogether.

One other article: How to Disable Microsoft's Registration Wizard

Well mine is Registered (=1) and there is
absolutely NO Info about Hardware. No problems getting updates, no need for registation wizards. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion]

"HWID"="0"
"MSID"="0"
"RegDone"="1"

Tony:

I don't believe that this is a risk any longer. Please see these links and see if you come to the same conclusion.

This documents the vulnerability in the activex controls and provides a link to the patch (IE4 and IE5).
http://www.securiteam.com/windowsntf...R5PSRPPPY.html

The patch is documented in Q241361 and indicates it is no longer a problem with IE 5.01.
http://support.microsoft.com/default...;EN-US;q241361

[This message has been edited by WhitPhil (edited 01-21-2002).]

Phil,

I've checked out the links, and the info at Wilders.org does indeed seem to be outdated.

Well, no harm done, and we can all re-register or rename the file back again and relax.. https://discussions.virtualdr.com/

Thanks again for the heads up.

Tony

OK https://discussions.virtualdr.com/

Hi,
So does that mean that IE6 is safe from this vulnerability? (It mentions a patch for IE4 and 5.)
Thanks.
Sincerely, Nancee

My read would be that the vulnerability was fixed in IE versions 5.01 and later.

Thanks Whitphil! https://discussions.virtualdr.com/
Sincerely, Nancee