Windows sysinternals

428 Part III Troubleshooting—”The Case of the Unexplained...”
for programs it didn’t like. Because window enumeration returns only the windows on the
same desktop as the caller, he surmised that the malware author probably hadn’t considered
the possibility of programs running on non-default desktops. Sure enough, after
running Desktops and switching to the second desktop, he was able to launch Procmon
and other utilities. (See Figure 18-1.) (For more information about these concepts, see
“Sessions, Window Stations, Desktops, and Window Messages” in Chapter 2, “Windows Core
Concepts.”)
FIGURE 18-1 Running Sysinternals utilities on a different desktop.
First he looked at Procexp. All the process names looked legitimate, so he enabled the
Verify Signers option and the Verified Signer column. He was able to ascertain that all of the
process’ main executable image files appeared valid.
Next he ran Procmon. He noticed a lot of activity in the Winlogon process. He set a filter
to show only Winlogon.exe activity (shown in Figure 18-2) and saw that it was checking a
strange registry key once every second:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\acdcacaeaacbafbeaa
FIGURE 18-2 Procmon displaying unusual registry activity from Winlogon.exe.
Now he ran Autoruns, opting to verify image signatures and to hide Microsoft and Windows
entries. With only third-party and unsigned entries displayed, he quickly found the culprit: an
unsigned DLL with a random-looking name registered as a Winlogon notification package
www.it-ebooks.info