I was writing some
.VBS code at the office that would allow certain file extensions to be downloaded without a warning dialog on a Windows7x32 system.
The system I was writing this on is in a lab on a segmented subnet. All web access is via a proxy server. The only means of accessing my machine is via the internet or from within the lab's AD domain.
While writing and testing my code I found a message of sorts. Upon refreshing the registry to verify my code changed a
dword, instead the message HELLO was written and visible in regedit where the
dword value was called for.
I took a screen shot and proceeded to edit my code. This same weird behavior occurred last time I was writing registry code except on another internal server.
I understand that remote registry access exists for windows systems. I will block this immediately once I return to the office.
What I want to know is, can I trace who made this connection? How would I do this?
I suspect the cause of this is the cause of other "odd" behaviors I'm experiencing at work such as losing control of my input director master control for over an hour and unchanged code that all of a sudden fails for no logical region.
These failures occur at funny times, whenever I'm about to give a demonstration of my test code. I know this sounds crazy however knowledge of the registry component makes this believable. Once the registry can be accessed, the entire system is compromised.
This is on a test network where everybody is a domain admin so anybody in that group has the ability to enable remote registry access. Can remote assistance be enabled secretly?
Any help or sanity checking is appreciated.