Didier Stevens

Tuesday 8 January 2008

Quickpost: Windows Server 2008 UserAssist Keys

Filed under: Forensics,My Software,Quickpost — Didier Stevens @ 21:18

My first post for 2008 has to be about Windows Server 2008.

It looks like the UserAssist entries for Windows Server 2008 have the same format as for Windows Vista, my UserAssist tool can also extract the data from Windows Server 2008:

windows-2008-userassist.png

Like Vista, the Windows Server 2008 browserui.dll file (version 6.0.6001.17051) contains only 5 UEME strings:

UEME_RUNPATH
UEME_CTLCUACount:ctor
UEME_CTLSESSION
UEME_RUNPIDL
UEME_RUN


Quickpost info

1 Comment »

  1. [...] Quickpost: Windows Server 2008 UserAssist Keys [...]

    Pingback by Liquidmatrix Security Digest » Security Briefing: January 9th — Wednesday 9 January 2008 @ 12:56


RSS feed for comments on this post. TrackBack URI

Leave a Reply (comments are moderated)

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

The Rubric Theme. Blog at WordPress.com.

Follow

Get every new post delivered to your Inbox.

Join 236 other followers

%d bloggers like this: