Re: Can Malware Automatically Startup in Safe Mode?

From: "Stefan Kanthak" <postmaster@[127.0.0.1]>


| Which process but injects this DLL? And who starts the injector
| process?
| Back to square one!

A trojan dropper or trojan downloader may inject the process

| Malware has to install a driver/service and create the necessary
| registry entries
| beyond

| [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\<driver/service>]

| to
| start automatically in safe mode, for example.

| Stefan


One of *many* places to inject a DLL is...
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

Two others using EXE files are under...
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Userinit
C:\WINDOWS\system32\userinit.exe, malware_name.exe

Shell
Explorer.exe malware_name.exe


--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp


.

Relevant Pages

  • Re: SetWindowsHookEx
    ... automatically inject into all programs. ... It sets the global hook on the ... DLL injecting - in all likelyhook SetWindowsHook returns before the DLL has ... with your shared-section, then the gHook variable (which contains ...
    (microsoft.public.vc.language)
  • Re: undestroyable process
    ... hooking SSDT does not seem to be the task he is able to handle ... program as dll and attach it to some running critical system ... will eventually learn some basic Windows concepts while trying to ... And to inject a dll he would need to run an executable that injects the code, so your objections to b)point would still apply. ...
    (microsoft.public.win32.programmer.kernel)
  • Re: CreateRemoteThread in DLL
    ... Why is it you think that the pAddr is the first executable address of the function you ... I am trying to inject some code into a foreign process with the aid of a DLL. ...
    (microsoft.public.vc.mfc)
  • Re: MS Detours system wide / global hook
    ... There are also registry keys which allows you to register your DLLs ... Then I remember you can inject an arbitrary ... DLL into every process by using some undocumented features of the ... I can't see to find an explanation of how detours can be used to hook ...
    (microsoft.public.win32.programmer.kernel)
  • CreateRemoteThread in DLL
    ... I've a question regarding CreateRemoteThread in a DLL I am creating. ... I am trying to inject some code into a foreign process with the aid of a DLL. ...
    (microsoft.public.vc.mfc)
Quantcast