Menu
HKML\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs
What is the purpose of the KnownDLLs?(To load some Dlls faster?)
If I have a admin's token, I can control the registry values.
Isn't there any security hole?
Why did Microsoft support the feature?
668
Certain operating system–supplied DLLs get special treatment. These are called known DLLs. They are just like any other DLL except that the operating system always looks for them in the same directory in order to load them.
Your DLL files are located in C:\Windows\System32. When Windows Defender runs a Full Scan, it includes that directory and so all of your DLLs will be scanned. This will scan your DLL files for any malware infections.
Most DLL files are very useful and aid in the process of running your applications. However, others are malicious, acting as browser hijackers or Trojan horses. These programs can alter your system and allow intruders to gain remote access to your system.
A DLL is a library that contains code and data that can be used by more than one program at the same time. For example, in Windows operating systems, the Comdlg32 DLL performs common dialog box related functions. Each program can use the functionality that is contained in this DLL to implement an Open dialog box.
The only thing KnownDLLs does is prevent implicitly loaded DLLs being loaded from the applications folder.
For security reasons, the only folder that a "KnownDll" is valid in is c:\Windows\System32 (or your localized equivalent) - and this folder is 2nd on the search list after the folder of the process.
In essence, it prevents rogue copies of system dll's - such as kernel32.dll - being loaded from an applications folder.
It doesn't stop an an application loading a dll using a fully qualified path. It doesn't stop a lengthy search of the path or the discovery of system dlls in the path - system32 is always searched before those locations anyway.
65
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
