Anyone else observing change in "explorer.exe" settings in HKLM

I'm dealing with a "probable" infection affecting 2 large network segments with around 4000 odd machines. Our firewalls and IPS show no major activity in last 2 weeks. I went through VM copies of machines currently deployed but I've found nothing. I'm to an extent convinced that this is not due to infection, however there is one thing which has changed on ALL the machines (when i say all - around 400 machines where load load point analysis was done are being considered.)

Registry value: "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell" is set to "". but it should be "explorer.exe".

Is anyone else noticing the same in their environment? Ill check with my counterparts in different group companies today morning (4 AM here) but i wanted to see if anyone else is going through a network clog and is seeing this same registry change.

Hi there ByTe,

Sorry for the delay in replying, but time zones, sleep and :drink:............the usual suspects? :D

I have looked at my home setup and two small clients'.............no sign of this here. I seem to recall that you could make this adjustment so that if "" was detected it then opened a new shell specific to a user or possibly user group? You had to define this somewhere so if you search for the registry string you mentioned you will probably find the M$ article, and where to look for what the system will now do?

I seem to recall that the general idea was to cut the login time caused by loading explorer.exe and possibly stop users going where the shouldn't (albeit a Smith & Wesson is a better solution for the latter:lildevil:)

To be honest with you mate I don't like the looks of this?.............My first (CYA) move would be to isolate one of the machines and run a few online AV scanners against it..............then MalwareBytes and SpyBot S&D for good measure.

I would also ask myself "who within the organisation is empowered to make such changes?" ;)

Has someone tried to do something "clever"?????????

As ever, Good Luck mate!

We are not seeing any issues here (about 4000 PC's). I checked a couple of random devices and that reg key has "explorer.exe" in it.

Good luck.

Sorry Mate nothing on my networks

Hey Byte,

Checked internally and called a few clients and nothing different, all set to explorer.exe.

I would go with Nihil and run some online scans.

Malwarebytes is usually the king with registry finds.

Well i slept for 14 hours straight plus maybe another 6 hours.. which i think is weird for me. Anyway all machines here are showing this. i am not sure why.. I made a VM copy of one of the machine but didnt find anything in it..

Whatever it is for the first time is going out of my net..

Thanks for the response guy.. Appreciate it.

Hey sorry for the late response on the subject, Just got back in from vegas ;)
I would look into the registry file deeper. If this was somebody trying to be clever he could have had regedit display "" via a null character in the name and thus hide what the actual registry value in the name is. I don't ever recall hearing exactly what Nihil is talking about but the article I think he is referring to is here http://msdn.microsoft.com/en-us/libr...dded.5%29.aspx

though I didn't see any indication of "" going to another value >.< Then again I am slightly rushed today.

Anywho, I suggest looking into that registry value with a program that isn't regedit, like the REG command on the command prompt, if you haven't already done so in order to see if somebody is hiding some secret path =P

Also are you on a VISTA or up windows version? If so, then you should know the HKLM is virtualized and the actual values are stored in HKCU\Softwate\Classes\VirtualStore\Machine\Software\

Hey Snuggles:

Quote:

---

Just got back in from vegas

---

do you still own your own shirt sir? :bigpimp:

ByTe: I don't know what is going on mate............maybe we have a "first" (zero day?)...................this is what this site used to be like........we used to have some fun times?

ByTe: I am an old fart...............so I can't remember that much (like the five lakhs I owe you?:lildevil:)......................

And how many of us know what a lakh is?

I was talking back in the days when I was doing embedded XP............I guess that would be about 2002? :eek::eek:

Snuggles: what you linked to was pretty much what I was talking about, from what little I remember:drink:

Quote:

---

Originally Posted by nihil

Hey Snuggles: do you still own your own shirt sir? :bigpimp:

---

nah, but I got some other person's shirt ;) and in my defense, it is a much nicer shirt :D

Have you run any online scans?

Ver interested in the outcome of this.

Same here.

I know that there is malware that will edit that registry entry and may even set it to "null" or blank, which I suppose is what " " is?

Here is an (old) example:

http://www.ca.com/us/securityadvisor....aspx?id=58501

I would have thought that the current entry would mean that the desktop wouldn't load? I just find it odd that so many machines have been affected without someone saying something sooner.

Probably a thing of the past, but in the old days (NT 4) we used to use logon scripts to do that sort of thing.

I would be interested to know what runs when you boot an affected machine? Are the users supposed to get the normal desktop?

Quote:

---

Originally Posted by nihil

Same here.

I know that there is malware that will edit that registry entry and may even set it to "null" or blank, which I suppose is what " " is?

---

Keep me posted too!
Technically a null entry would be "" not " " ;)
Sorry felt like being a pedantic dick :D

Quote:

---

Originally Posted by nihil

I would have thought that the current entry would mean that the desktop wouldn't load? I just find it odd that so many machines have been affected without someone saying something sooner.

---

meh, not that surprising really. A lot of malware is meant to avoid detection cleverly hide itself so a standard user does not notice it at all =P AV can only do so much and really is a minor hassle for attackers that aren't script kiddies really what with all the advanced encoding libraries out there. It makes detection via definitions a very difficult task and one that will always be a step behind at best >.<

Quote:

---

Originally Posted by nihil

I would be interested to know what runs when you boot an affected machine? Are the users supposed to get the normal desktop?

---

You should get the seemingly normal desktop unless the attacker doesn't want that >.< It seems weird though that the only weird registry value that stands out is the shell one. I would figure that if an attacker was trying to be very stealthy they would just patch explorer.exe or whatever file they were most concerned with and not change the registry in such a blatant way. It kind of makes me lean a little on the side of windows being windows, but it is definitely something I want more info about.............

Quote:

---

It seems weird though that the only weird registry value that stands out is the shell one. I would figure that if an attacker was trying to be very stealthy they would just patch explorer.exe or whatever file they were most concerned with and not change the registry in such a blatant way. It kind of makes me lean a little on the side of windows being windows, but it is definitely something I want more info about.............

---

I agree, I can't quite figure out what it is supposed to achieve. Makes me wonder if there might not be another explorer.exe on the systems? Is the original still there and where it should be? AFAIK the explorer value is there by default but if it were null or blank then explorer.exe is the default shell anyway???

As for "windows being windows" that might explain the odd occurrence but not 4,000 instances or even 400?

It looks pretty deliberate to me, but who did it, how and why?

Quote:

---

As for "windows being windows" that might explain the odd occurrence but not 4,000 instances or even 400?

---

sure it would. Windows on each box, similar or identical configuration for each box, i would suspect we would see very close behavior. <@):P

But I was wondering if you found anything Byte?

Nothing ... Just 1 DLL in all images but that was found as an adware (not-a-virus-advertisement-program by Kaspersky)..

The problem was network degradation. Since i look after anti-malware for the company, i was asked to investigate malware issue (since network assurance manager said his side was clear). However as it turns out we gave up on considerable amount of bandwidth (purchased from sister company) and the network dude had given for reduction (he calls is degradation) in bandwidth so someone goofed up in the process leading to the dial up performance.

(rant here)


I did find 4 new variants of w32.SillyFDC (or DFC one of them) and w32.pilleuz but i dont think they are connected to the registry issue. Since i analyzed all the malware samples before submission and they did not modify the reg key i'm talking about.

Quote:

---

sure it would. Windows on each box, similar or identical configuration for each box, i would suspect we would see very close behavior. <@):P

---

I see what you are trying to say, but that would only work if all were mirrored at least in some part (the basics)?

My next move would be to take the corporate mirror image and load it onto an offnet virgin system...............then take a look? ;)

Quote:

---

Originally Posted by ByTeWrangler

Nothing ... Just 1 DLL in all images but that was found as an adware (not-a-virus-advertisement-program by Kaspersky)..

The problem was network degradation. Since i look after anti-malware for the company, i was asked to investigate malware issue (since network assurance manager said his side was clear). However as it turns out we gave up on considerable amount of bandwidth (purchased from sister company) and the network dude had given for reduction (he calls is degradation) in bandwidth so someone goofed up in the process leading to the dial up performance.

(rant here)


I did find 4 new variants of w32.SillyFDC (or DFC one of them) and w32.pilleuz but i dont think they are connected to the registry issue. Since i analyzed all the malware samples before submission and they did not modify the reg key i'm talking about.

---

did u test them in a VM? Some malware detects a Vm and doesnt reproduce as it would undetected.

I never booted the machine into VM. I just mounted the VM disk on my physical machine and scanned it.. Like i said found nothing!