#1 ShellExecuteHooks to be analysed

I caught another malicious worm (whatever his name), I may add new functionalities to slow their progression. Many company like mine installed an antivirus. But due network configuration changes, anti-virus are not kept up to date and new menaces remain undetected.

• add scanner to detect .dll, .exe, .cmd, .bat, autorun.inf files in temporary or root directories from some registry entries (to be determined) like MountPoints2
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks is to be examined (a white list system could be used)

[Anonymous]

I have to search some informations about BB4C402F-882A-4526-8C08-51278EA437C1
Notice that CLSID to identify an object is not sufficient to detect risks since they are easily falsifiable (looking for another method...)