And then its starts to load32 bits stuff and finally my 64bit dll in kind of a 32bit mode. It starts by loading some 64bit dlls (maybe rundll depencies). We can see that in the output by looking at the base addresses when the modules get loaded. Also it loads 32Bit versions of some depencies. It looks like it loads my mmbbq.dll into a 32bit address space. But im having strange results when checking the result in windbg (see output below).
The DLL can be build and linked and even executed. Now, im trying to use the x86_64-w64-mingw32 toolchain to build a 64bit version of it. The project used to build a 32bit dll using i686-w64-mingw32 toolchain that could be used with rundll to start it.
#C windows system32 rundll32 exe update
C:\Program Files\Trend Micro\Internet Security\TmProxy.Im currently trying to update my project to 64bit support. O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. C:\Program Files\Trend Micro\Internet Security\TmPfw.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. C:\Program Files\Trend Micro\BM\TMBMSRV.exe O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Bonjour Service - Apple Inc. O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc.
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Apple Mobile Device - Apple Inc. O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe R3 - URLSearchHook: SearchSettings Class - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Any help you can offer me would be appreciated:Ĭ:\Program Files\Java\jre1.6.0_07\bin\jusched.exeĬ:\Program Files\Microsoft Office\Office12\GrooveMonitor.exeĬ:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exeĬ:\Program Files\TomTom HOME 2\HOMERunner.exeĬ:\Program Files\Windows Live\Messenger\msnmsgr.exeĬ:\Program Files\Windows Desktop Search\WindowsSearch.exeĬ:\Program Files\Microsoft Office\Office12\ONENOTEM.EXEĬ:\Program Files\Trend Micro\BM\TMBMSRV.exeĬ:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exeĬ:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeĬ:\Program Files\Bonjour\mDNSResponder.exeĬ:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exeĬ:\Program Files\Trend Micro\Internet Security\SfCtlCom.exeĬ:\Program Files\Trend Micro\Internet Security\TmPfw.exeĬ:\Program Files\Trend Micro\Internet Security\TmProxy.exeĬ:\Program Files\iPod\bin\iPodService.exeĬ:\Program Files\Windows Live\Messenger\usnsvc.exeĬ:\Program Files\Java\jre1.6.0_07\bin\jucheck.exeĬ:\Program Files\Mozilla Firefox\firefox.exeĬ:\Program Files\Trend Micro\HijackThis\HijackThis.exe This is the Trend Micro HijactThis report the scan generated. I'm running a Compaq Presario, about 2 years old, OS is Windows XP home edition. The family spends a lot of time on youtube / facebook / some gaming sites.
Cannot execute most commands in control panel, because of this.
#C windows system32 rundll32 exe Pc
I have Trend Micro Internet Security on and up to date, but over the last few weeks my home pc has become crippled by the C:\WINDOWS message in the subject line.
0 kommentar(er)
