Sujet : Re: About That “inetpub” Folder ...
De : ldo (at) *nospam* nz.invalid (Lawrence D'Oliveiro)
Groupes : comp.os.linux.advocacy alt.comp.os.windows-11Date : 14. Jun 2025, 08:10:13
Autres entêtes
Organisation : A noiseless patient Spider
Message-ID : <102j78l$1qt6$1@dont-email.me>
References : 1 2 3 4 5 6 7 8 9
User-Agent : Pan/0.162 (Pokrosvk)
On Fri, 13 Jun 2025 22:53:33 -0400, Paul wrote:
The file was named that way by Russinovich, the developer.
And he does his own file injection. If he finds the procmon23.sys he
removes it and installs the procmon24.sys. It's a private file just for
him, not shared in the conventional sense. It's not tracked and updated
by Windows Side By Side (WinSXS). Windows is not supposed to know it is
there, it's not loaded on boot, but it is used privately for doing a
trace.
It’s pretty scary to think one lone developer can inject such code into
Windows that Windows itself does not know about.
Just as Linux keeps some kernels,and if the latest kernel won't boot,
you can use the menu to select a slightly older one.
The Linux kernel itself knows which version it is, though. Nothing is
being hidden from it.
About That “inetpub” Folder ...
Re: About That “inetpub” Folder ...