FileMon question - has my shell32.dll been changed?

Discussion in 'other security issues & news' started by fishfork, Aug 30, 2005.

Thread Status:
Not open for further replies.
  1. fishfork

    fishfork Registered Member

    Joined:
    Aug 30, 2005
    Posts:
    1
    I had FileMon open while running a program I was slightly unsure about. I was alarmed when this appeared in the log:

    20 17:47:47 setup.exe:924 SET INFORMATION C:\WINNT\system32\shell32.dll SUCCESS FileBasicInformation
    21 17:47:47 setup.exe:924 SET INFORMATION C:\WINNT\system32\SHELL32.DLL SUCCESS FileBasicInformation
    22 17:47:47 setup.exe:924 SET INFORMATION C:\WINNT\System32\shell32.dll SUCCESS FileBasicInformation
    23 17:47:47 setup.exe:924 SET INFORMATION C:\WINNT\system32\SHELL32.DLL SUCCESS FileBasicInformation
    24 17:47:47 setup.exe:924 SET INFORMATION C:\WINNT\system32\SHELL32.DLL SUCCESS FileBasicInformation

    Does this mean what I think it does? It certainly has me worried.
     
    fishfork, Aug 30, 2005
    #1
  2. ravin

    ravin Registered Member

    Joined:
    May 2, 2003
    Posts:
    241
    Location:
    South Carolina
    what was the name of the program? would help us to help you... as there are many expierenced users here.
     
    ravin, Aug 31, 2005
    #2
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...