PDA

View Full Version : FileMon question - has my shell32.dll been changed?


fishfork
August 30th, 2005, 03:11 PM
I had FileMon open while running a program I was slightly unsure about. I was alarmed when this appeared in the log:

20 17:47:47 setup.exe:924 SET INFORMATION C:\WINNT\system32\shell32.dll SUCCESS FileBasicInformation
21 17:47:47 setup.exe:924 SET INFORMATION C:\WINNT\system32\SHELL32.DLL SUCCESS FileBasicInformation
22 17:47:47 setup.exe:924 SET INFORMATION C:\WINNT\System32\shell32.dll SUCCESS FileBasicInformation
23 17:47:47 setup.exe:924 SET INFORMATION C:\WINNT\system32\SHELL32.DLL SUCCESS FileBasicInformation
24 17:47:47 setup.exe:924 SET INFORMATION C:\WINNT\system32\SHELL32.DLL SUCCESS FileBasicInformation

Does this mean what I think it does? It certainly has me worried.

ravin
August 31st, 2005, 02:00 PM
what was the name of the program? would help us to help you... as there are many expierenced users here.