[ANN] MSKB 3004375 available for Windows 2000 and later too (but NOT from Mcirosoft) Feb 11 2015 03:42PM
Stefan Kanthak (stefan kanthak nexgo de)
Hi @ll,

yesterday Microsoft published the security advisory 3004375
announcing an update which enables Windows 7 and newer to log
the command lines used to start processes to the event log.

If you want to have this functionality on older versions of
Windows too see <http://home.arcor.de/skanthak/appinit.html>
(but notice the license terms).

Limitation: command lines of processes that dont load USER32.DLL
are not logged. Fortunately almost all Win32 applications but
load USER32.DLL

JFTR: APPINIT.DLL works since 20 years.

Stefan Kanthak

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus