Mark
Sat Sep 02 22:05:50 CDT 2006
Delete them.
Explenation:
A word, sentance etc in a computer is made up of a set of bytes one after
eachother, in almost all windows programming systems the way of telling how
long a string is involves looking for a character with value 0, the nul
byte. This indicates the end of a string (a string being a word, letter,
line of text etc).
When you copy a string, usually you only copy up to the nul, a string copy,
for example if you were to copy the text "{12381-2132-12231-1221}" blah
blah, you get the idea at the end of the quotes is a nul character, so you
could quite easily copy that visible text.
Some application interfaces give a way of specifiy a length of a string,
including the registry methods, so it will not stop copying the string when
it reaches the nul, it will keep on going past it...
Not a problem you say? well, there is...
In almost every single program not explicitly looking for this kind of hack,
the string will only be read up to the nul, and therefore when you look at
it in something like reg edit, reg edit will only show you the letters up to
the nul - everything after is hidden because to the text writing API its
'off the end'.
This means that 2 things that look identical actually arnt, and can be used
to hide nasty things.
--
- Mark Randall
http://www.temporal-solutions.co.uk
http://www.awportals.com
"Jeff" <jeff@naol.com> wrote in message
news:ehofU1rzGHA.996@TK2MSFTNGP03.phx.gbl...
>I just used RootkitRevealer and it found 2 paths that contained "Keyname
>contains embedded nuls (*)". Both are
>HKLM\SOFTWARE\Classes\CLSID\{numbers} keys.
>
> Should I be worried? do something?
>
> Thanks.
>
> Jeff
>