FileMon question - has my shell32.dll been changed?

Discussion in 'other security issues & news' started by fishfork, Aug 30, 2005.

Thread Status:
Not open for further replies.
  1. fishfork

    fishfork Registered Member

    Joined:
    Aug 30, 2005
    Posts:
    1
    I had FileMon open while running a program I was slightly unsure about. I was alarmed when this appeared in the log:

    20 17:47:47 setup.exe:924 SET INFORMATION C:\WINNT\system32\shell32.dll SUCCESS FileBasicInformation
    21 17:47:47 setup.exe:924 SET INFORMATION C:\WINNT\system32\SHELL32.DLL SUCCESS FileBasicInformation
    22 17:47:47 setup.exe:924 SET INFORMATION C:\WINNT\System32\shell32.dll SUCCESS FileBasicInformation
    23 17:47:47 setup.exe:924 SET INFORMATION C:\WINNT\system32\SHELL32.DLL SUCCESS FileBasicInformation
    24 17:47:47 setup.exe:924 SET INFORMATION C:\WINNT\system32\SHELL32.DLL SUCCESS FileBasicInformation

    Does this mean what I think it does? It certainly has me worried.
     
  2. ravin

    ravin Registered Member

    Joined:
    May 2, 2003
    Posts:
    241
    Location:
    South Carolina
    what was the name of the program? would help us to help you... as there are many expierenced users here.
     
Loading...
Thread Status:
Not open for further replies.