Avatar billede viper911111 Nybegynder
06. marts 2009 - 16:11 Der er 7 kommentarer

hooked shimeng.dll

[968]explorer.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification at address 0x01001268 hook handler located in [shimeng.dll]

  ADVAPI32.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
Information about ShimEng.dll:
Base address:    5CB70000
Size:        00026000
Flags:        8000400C
Load count:    1
Name:        Microsoft® Windows® Operating System
Prod. Version:    5.1.2600.5512
Company:    Microsoft Corporation
File Version:    5.1.2600.5512 (xpsp.080413-2105)
Description:    Shim Engine DLL
Location:    C:\WINDOWS\system32\ShimEng.dll
Signed:        YES
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
  RPCRT4.dll  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  Secur32.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  BROWSEUI.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  GDI32.dll  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  USER32.dll  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  msvcrt.dll  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  ole32.dll  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  SHLWAPI.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  OLEAUT32.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  SHDOCVW.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  CRYPT32.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  MSASN1.dll  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  CRYPTUI.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  NETAPI32.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  VERSION.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  WININET.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  iertutil.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  WINTRUST.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  IMAGEHLP.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  WLDAP32.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  SHELL32.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  UxTheme.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  WINMM.dll  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  MSACM32.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  USERENV.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  IMM32.DLL  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  comctl32.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  comctl32.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  msctfime.ime:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  appHelp.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  CLBCATQ.DLL :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  cscui.dll  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  CSCDLL.dll  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  themeui.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  actxprxy.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  msutb.dll  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  MSCTF.dll  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  ntshrui.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  ATL.DLL    :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  SETUPAPI.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  msi.dll    :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  LINKINFO.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  ieframe.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  PSAPI.DLL  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  urlmon.dll  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  MLANG.dll  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  NETSHELL.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  credui.dll  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  WTSAPI32.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  eappcfg.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  iphlpapi.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  WS2_32.dll  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  WS2HELP.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  webcheck.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  stobject.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  BatMeter.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  WPDShServiceOGetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  WINHTTP.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  mydocs.dll  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  PortableDevicGetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  PortableDevicGetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  mswsock.dll :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  DNSAPI.dll  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  rasadhlp.dll:GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
  DUSER.dll  :GetProcAddress          --[HOOKED]--  @5CB77774 by ShimEng.dll
Avatar billede johnstigers Seniormester
06. marts 2009 - 18:12 #1
Ja?
Avatar billede viper911111 Nybegynder
07. marts 2009 - 01:28 #2
Er dette en normal kode i windows xp ?

jeg har fjernet hooken, men den bliver genskabt ved genstart !
07. marts 2009 - 10:14 #3
... stadig ikke forstået ?

Hvad er pointen / forhistorien i dit indlæg #1 ???
Avatar billede johnstigers Seniormester
07. marts 2009 - 12:12 #4
Og hvordan er du faldet over den?
Avatar billede johnstigers Seniormester
08. marts 2009 - 13:31 #5
hallo?
Avatar billede viper911111 Nybegynder
09. marts 2009 - 17:08 #6
fundet med  - rootkit unhooker LE

jeg har fundet ud af at det er en normal funktion i xp/vista

http://silviocesare.wordpress.com/2009/01/19/vista-shim-engine-messing-with-imports/

Secrets of the Application Compatilibity Database (SDB) - Part 1

Secrets of the Application Compatilibity Database (SDB) - Part 2

Secrets of the Application Compatilibity Database (SDB) - Part 3

tak
Avatar billede johnstigers Seniormester
09. marts 2009 - 19:52 #7
Godt :)
Husk at lukke!
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester