A new sample came in today - an ad injector for Internet Explorer. I was analyzing it and noticed that the malware hid several of its key files. “Aha - a rootkit!” I thought and proceeded to find out how the trojan had hooked into the system to hide its traces. An SSDT hook perhaps, or maybe an injected user-mode DLL?

I looked and looked and couldn’t find a thing. No rootkit, no driver, no IAT modifications; nothing. Even stranger, the trojan seemed to have rootkitted the entire C:\Windows\system32 folder - it was invisible in Windows Explorer and couldn’t be seen when executing dir in a CMD prompt. That’s strange - why would a rootkit want to hide the system32 folder? If anything would tip you off that something is horribly wrong with your system, a missing system32 folder would be it (see figure 1 below).

After about an hour of looking for the rootkit and not finding it I started to get frustrated. So I decided to take another look at RegMon to see what the trojan was doing with the registry. That’s when I stumbled upon this:

The HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden determines whether or not Explorer shows files that have the hidden and system attribute set. It wasn’t a rootkit after all! The trojan simply disabled this setting and this caused all files with the system and hidden attribute to be invisible in Windows Explorer. And since the lab machine had the ShowSuperHidden setting enabled the trojan was hidden after performing the above registry tweak.

However, this didn’t explain why the files and folders were invisible in a Command Prompt as well. The explanation is obvious and simple: I had entered a simple “dir”. And since the system32 folder and the trojan files had attributes +h +s (hidden and system) set, they were hidden in the listing. Doing a “dir /ah” showed the missing files.

Moral of the story: Somtimes malware will use “old reliable” instead of messing about with a rootkit and drivers. So check the obvious stuff first before assuming it’s something more advanced.

A new wave of Zhelatin emails is currently going out. A typical example is this email:

Greetings,
Are you ready to have fun at Web Joker.
Account Number: 775152935455
Temp Login ID: user1160
Your Password ID: px259
Please keep your account secure by logging in and changing your login info.
Use this link to change your Login info: http://74.64.28.xx/
Enjoy,
Confirmation Dept.
Web Joker

The page linked to in the email advises the user to install a “Secure Login Applet” to view the page, which of course is an executable trojan file — a typical name is applet.exe. Below is a brief analysis.

The applet.exe file, when run, performs the standard Zhelatin actions: Copying itself to C:\Windows\spooldr.exe, and extracting a driver file to C:\Windows\system32\spooldr.sys. It also adds a rename entry for a .tmp file:

HKLM\System\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations = C:\Windows\system32\drivers\OLD3.tmp"

This entry will simply delete the file on reboot. Interestingly enough, the variants we’ve examined so far haven’t patched the tcpip.sys file to make themselves autostart. This makes removal easier since tcpip.sys does not need to be restored from backup. (Check that the digital signature on tcpip.sys is valid though, in case you are infected with this and it is a different variant!)

The OLD3.tmp file is actually a patched version of the legitimate Microsoft kbdclass.sys driver file. The trojan version has an extra 15 KB of data appended to it. The entry point of the patched driver file has been modified to point to the start of this extra block of data. Once loaded, the OLD3.tmp file loads the spooldr.sys trojan driver using the native Windows API function ZWSetSystemInformation.

The spooldr.sys driver will as usual disable most common firewalls, including the built-in Windows firewall.

Manual removal steps

1. Reboot computer in Safe Mode without networking
2. Delete the following files: C:\Windows\spooldr.exe, C:\Windows\system32\spooldr.sys
3. Restart computer normally

If you’ve recently received emails with the subject line “You’ve received a greeting ecard from a Friend!” then you’ve already made acquintance with a piece of malware known as Worm.Zhelatin. If you were to visit the linked site in the email and run the ecard.exe file, your system would be compromised by the Zhelatin trojan which uses a particularly sneaky way to load itself – one that no autostart viewer can detect.

When executed, ecard.exe copies itself to C:\Windows\spooldr.exe and drops a driver named spooldr.sys into C:\Windows\system32 (as usual, C:\Windows is used to represent your Windows folder – the path may differ on your system). It then infects the Windows file tcpip.sys in the C:\Windows\system32\drivers folder.

It also disables Windows File Protection and then infects the C:\Windows\system32\dllcache copy of tcpip.sys.

After doing all this, it goes dormant until the next reboot to further avoid detection.

The code patched into tcpip.sys is designed to load the spooldr.sys driver, which is the main rootkit component of the Zhelatin worm. Once active, spooldr.sys attempts to hide spooldr.exe, spooldr.sys.

Interestingly, the trojan disables a number of security utilities, such as F-Secure’s Blacklight rootkit detector and the ZoneAlarm firewall.

Manual removal procedure:

1. Reboot Windows into Safe Mode (not Safe Mode with Networking!)
2. Delete the following files: C:\Windows\spooldr.exe and C:\Windows\system32\drivers\spooldr.sys
3. Reboot Windows into normal mode
4. Go to Start -> Run…, type sfc.exe /scannow and click OK
5. When prompted, insert your Windows CD to restore the corrupted tcpip.sys

Disclaimer: Follow the manual removal steps at your own risk! You should always back up all important data prior to modifying your operating system.