Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was writing some .VBS code at the office that would allow certain file extensions to be downloaded without a warning dialog on a Windows7x32 system.

The system I was writing this on is in a lab on a segmented subnet. All web access is via a proxy server. The only means of accessing my machine is via the internet or from within the lab's AD domain.

While writing and testing my code I found a message of sorts. Upon refreshing the registry to verify my code changed a dword, instead the message HELLO was written and visible in regedit where the dword value was called for.

I took a screen shot and proceeded to edit my code. This same weird behavior occurred last time I was writing registry code except on another internal server.

I understand that remote registry access exists for windows systems. I will block this immediately once I return to the office.

What I want to know is, can I trace who made this connection? How would I do this?

I suspect the cause of this is the cause of other "odd" behaviors I'm experiencing at work such as losing control of my input director master control for over an hour and unchanged code that all of a sudden fails for no logical region.

These failures occur at funny times, whenever I'm about to give a demonstration of my test code. I know this sounds crazy however knowledge of the registry component makes this believable. Once the registry can be accessed, the entire system is compromised.

This is on a test network where everybody is a domain admin so anybody in that group has the ability to enable remote registry access. Can remote assistance be enabled secretly?

Any help or sanity checking is appreciated.

share|improve this question

migrated from stackoverflow.com Jan 16 '11 at 5:53

This question came from our site for professional and enthusiast programmers.

    
@Slugster: I hope not :) The question is "What I want to know is, can I trace who made this connection? How would I do this?" which sounds more like server admin (or security) than programming...but I could be wrong. –  Cameron Skinner Jan 16 '11 at 3:49
    
@Cameron, i agree, and all due respect to the OP but i think there is probably no Bad Guy :) –  slugster Jan 16 '11 at 4:01

2 Answers 2

I would speculate that this may be programming related... but you better post some code fast before it gets closed.

These failures occur at funny times, whenver I'm about to give a demonstration of my test code.

To be honest, this is probably a mix of paranoia and bad coding and bad environment setup. How does the bad guy know you are about to do a demo?

Upon refresing the registry to verify my code changed a dword, instead the message HELLO was written and visible in regedit where the dword value wass called for.

Post your code. I also have difficulty believing the Bad Guy knew which registry key you were about to write..... and you can't put a string into a DWORD type registry key... which means you are either looking at the wrong key, or there is a bug in your code.

share|improve this answer

Remote-Registry access requires a login, which records and event in the Security event-log. Since this is Win7, it's actually on by default, which isn't the case in Win7. Troll through the Security log looking for accesses you don't recognize. You may see some 'anonymous' attempts, those are fairly normal on Windows networks.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.