Windows NT WinLogon Notify
2017-06-10 23:26
288 查看
参考文章:http://www.programlife.net/windows-nt-winlogon-notify.html
今天试了下 WinLogon Notify,怎么都不成功,原来是WIN7不支持该功能了?
In Windows Vista and later, Winlogon notification packages are no
longer supported. Winlogon notification packages are discussed in detail in the next section. After upgrading systems to Windows Vista, Winlogon will not load Winlogon notification packages. Organizations that are using Winlogon notification packages must
either remove the functionality or create a new solution when deploying Windows Vista and later.
https://technet.microsoft.com/zh-cn/library/cc721961(v=ws.10).aspx
贴下原文:
在NT系列Windows操作系统中,恶意软件可以通过关联Winlogon特定的事件来使自身被启动,如Lock,Logoff,Logon,Shutdown,StartScreenSaver,StartShell,Startup,StopScreenSaver,Unlock等,这甚至能够使得恶意软件在安全模式下被加载。WinLogon的通知事件在注册表的位置是:
当WinLogon.exe产生一个事件通知的时候,Windows会检查注册表里面指定的DLL并调用DLL指定的导出函数。示例(当屏幕锁定时调用WinLogonDemo.dll导出的LockFun函数):
从Windows Vista开始,这项特性被取消了。可以通过注册一个服务来监听相应的事件(部分事件不支持),参见Using Service Control Manager (SCM) Notifications
今天试了下 WinLogon Notify,怎么都不成功,原来是WIN7不支持该功能了?
In Windows Vista and later, Winlogon notification packages are no
longer supported. Winlogon notification packages are discussed in detail in the next section. After upgrading systems to Windows Vista, Winlogon will not load Winlogon notification packages. Organizations that are using Winlogon notification packages must
either remove the functionality or create a new solution when deploying Windows Vista and later.
https://technet.microsoft.com/zh-cn/library/cc721961(v=ws.10).aspx
贴下原文:
在NT系列Windows操作系统中,恶意软件可以通过关联Winlogon特定的事件来使自身被启动,如Lock,Logoff,Logon,Shutdown,StartScreenSaver,StartShell,Startup,StopScreenSaver,Unlock等,这甚至能够使得恶意软件在安全模式下被加载。WinLogon的通知事件在注册表的位置是:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify |
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Test] @="" "DLLName"="WinLogonDemo.dll" "Asynchronous"=dword:00000001 "Impersonate"=dword:00000001 "Lock"="LockFun" |
相关文章推荐
- Windows NT WinLogon Notify(转载+修改版)
- Windows NT WinLogon Notify
- 开机出现invalid boot.ini filebooting from c:\windows\ntdetect failed 修复方法
- How Do Windows NT System Calls REALLY Work?
- Retiring Windows NT Server 4.0: Changes in Product Availability and Support
- 从ON_MESSAGE和ON_NOTIFY理解windows的消息机制
- 用VB得到windows系统安装时的时间(for NT,2000,XP,..)
- IIS 之当前标识(NT AUTHORITY/NETWORK SERVICE)没有对“C:/WINDOWS/Microsoft.NET/Framework/v2.0.50727/Temporary ASP.NET Files”的写访问权限 问题的解决
- 当前标识(NT AUTHORITY/NETWORK SERVICE)没有对“C:/WINDOWS/Microsoft.NET/Framework/v2.0.50727/Temporary ASP.NET Files”的写访问权限。
- npm install时报错 npm ERR!Windows_NT 6.1.7601
- nodejs error Windows_NT 6.1.7601 21 error code ELIFECYCLE 22 error angular-adminlte-plugin@0.1.0
- windows环境中mysql忘记root密码的解决办法 (不用mysqld-nt.exe)
- 在Windows NT TaskManager(任务管理器)中隐藏程序(进程)
- SHChangeNotifyRegister in Windows CE
- Cacti+Nagios(七):Nagios监控windows(基于check_nt)
- React Native创建项目时报错:npm ERR! Windows_NT 10.0.10240 错误
- Windows 驱动开发基础(六)NT驱动的基本结构
- 再谈Windows NT/2000环境切换
- Windows常见基本进程七:winlogon
- How Do Windows NT System Calls REALLY Work?