Normal
0
false
false
false
EN-US
X-NONE
HE
MicrosoftInternetExplorer4
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin-top:0cm;
mso-para-margin-right:0cm;
mso-para-margin-bottom:10.0pt;
mso-para-margin-left:0cm;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
One of the ways malware activates itself after it
infiltrates a system, is by adding itself to the registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Run
with a value of Rundll32.Exe, the malware DLL (usually a random character
combination) and an entry point.
However, if you open RegEdit.Exe and try to find those keys -
you usually won't. That's because they're hidden, or to be more precise -
hidden from RegEdit.Exe.
RegEdit.Exe uses the Win32 API to query and manipulate the
registry. Keys and values are NULL terminated (with the ‘\0' character). But,
the Native API (the undocumented API exposed through NtDll.Dll allows embedded ‘\0'
characters (a length is provided, which is all that's needed), so if a malware
creates such a value with an additional NULL, RegEdit will fail to see it (or
delete it).
The Native API function signatures are "known", but before
you attempt to create such a registry editor (or at least viewer), you can try
the Reg.Exe tool that is part of Windows.
For example, the command
Reg Query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Will show all the values in that key (including the hidden
ones).
Reg Delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run
/v SomeValue
Will delete the value SomeValue even if it has a NULL after
the name.
Happy malware hunting!