Regulating remote registry access over a computer network

A computer implemented method for regulating remote registry access, the method comprising the steps of:

• a remote registry access manager on a computer detecting a remotely initiated attempt by a process to access a target registry key of the computer's registry;
• the remote registry access manager determining whether the remotely initiated attempt to access the computer's target registry key is legitimate by verifying that a computer from which the attempt originated is authorized to access the target registry key in the registry of the computer;
• and
• the remote registry access manager performing a step from a group of steps consisting of:
• responsive to determining that the attempt is legitimate, allowing the remotely initiated access to the target registry key;
• and
• responsive to determining that the attempt is not legitimate:
• blocking the remotely initiated access to the target registry key;
• logging the blocked attempt;
• responsive at least in part to the process having made a plurality of blocked attempts, determining that the process comprises malicious code;
• responsive to determining that the process comprises malicious code, performing a step from a group of steps consisting of:
• executing a remote malicious code processing engine;
• informing a remote automatic malicious code manager of the malicious code;
• and
• informing a human user of the malicious code.

A computer readable storage medium containing a computer program product for regulating remote registry access, the computer program product comprising:

• program code for detecting an attempt by a first computer to remotely access a second computer's registry via a remote registry access system call;
• program code for determining whether the attempt to remotely access the second computer's registry is legitimate;
• and
• program code for performing a step from a group of steps consisting of:
• responsive to determining that the attempt is legitimate:
• allowing the remote access to the registry,
• storing a registry key handle returned by the remote registry access system call,
• intercepting a local registry access system call,
• determining whether the local registry access system call is attempting to access a remote registry key through the stored handle,
• responsive to determining that the attempt to access the remote registry key through the stored handle is legitimate, allowing the attempt to access the remote registry key through the stored handle to proceed, and
• responsive to determining that the attempt to access the remote registry key through the stored handle is not legitimate, blocking the attempt to access the remote registry key through the stored handle;
• and
• responsive to determining that the attempt is not legitimate:
• blocking the remote access to the registry;
• logging the attempt;
• responsive at least in part to the process having made a plurality of blocked attempts, determining that the process comprises malicious code;
• responsive to determining that the process comprises malicious code, performing a step from a group of steps consisting of:
• executing a malicious code processing engine;
• informing an automatic malicious code manager of the malicious code;
• and
• informing a human user of the malicious code.