Groups | Blog | Home
all groups > visual c > april 2006 >

visual c : how to inject system process SERVICES.EXE as system restart?


William DePalo [MVP VC++]
4/26/2006 12:02:01 PM
[quoted text, click to view]

Why not take a step back an explain what you want to do and not how to do
it?

Regards,
Will

Vic.Dong
4/26/2006 7:14:40 PM
Hello. all:

I want to inject a DLL of my custome hook dll to system serice SERVICES.EXE
application as every OS restart?

B.R.

VIC

William DePalo [MVP VC++]
4/26/2006 11:08:55 PM
[quoted text, click to view]

Can you open the file exclusive access and with the
FILE_FLAG_DELETE_ON_CLOSE option set. By the way, it is not enough to delete
the file. You should overwrite its sensitive data. There are published
algorithms and standards for this kind of thing, btw.

Regards,
Will

Tim Roberts
4/26/2006 11:35:33 PM
[quoted text, click to view]

The rumor is that this ability will be removed from Vista, because almost
the only users of winlogon add-ins have been spyware.
--
- Tim Roberts, timr@probo.com
Scherbina Vladimir
4/27/2006 12:34:39 AM
Why exactly to services.exe? Try documented approach - winlogon notification
packages - it will allow you to create your own dll that will handle
winlogon.exe events and process them in the address space of winlogon
process.

--
Vladimir
manage content: http://www.infostoria.com/
blog: http://thespoke.net/blogs/vladimir_scherbina/

[quoted text, click to view]

Vic.Dong
4/27/2006 10:36:14 AM
Hello:

Sorry.
I make a application that is about some file data security. I want to delete
my some important temp file as OS restart.
If I put it to registry "HKEY...\RUN" setting, but it maybe be deleted by
someone.


B.R.

VIC


"William DePalo [MVP VC++]" <willd.no.spam@mvps.org> дÈëÏûÏ¢ÐÂÎÅ:%23NelCrUaGHA.1220@TK2MSFTNGP02.phx.gbl...
[quoted text, click to view]

Scherbina Vladimir
4/27/2006 8:38:49 PM
Yes, I remember this rumor. I hear it each time when the talk about winlogon
notification packages begin. Thanks for reminding once again.

--
Vladimir
manage content: http://www.infostoria.com/
blog: http://thespoke.net/blogs/vladimir_scherbina/

[quoted text, click to view]

AddThis Social Bookmark Button