Didier Stevens

Tuesday 8 January 2008

Quickpost: Windows Server 2008 UserAssist Keys

Filed under: Forensics,My Software,Quickpost — Didier Stevens @ 21:18

My first post for 2008 has to be about Windows Server 2008.

It looks like the UserAssist entries for Windows Server 2008 have the same format as for Windows Vista, my UserAssist tool can also extract the data from Windows Server 2008:

windows-2008-userassist.png

Like Vista, the Windows Server 2008 browserui.dll file (version 6.0.6001.17051) contains only 5 UEME strings:

UEME_RUNPATH
UEME_CTLCUACount:ctor
UEME_CTLSESSION
UEME_RUNPIDL
UEME_RUN

Quickpost info

1 Comment »

  1. […] Quickpost: Windows Server 2008 UserAssist Keys […]

    Pingback by Liquidmatrix Security Digest » Security Briefing: January 9th — Wednesday 9 January 2008 @ 12:56


RSS feed for comments on this post. TrackBack URI

Leave a Reply (comments are moderated)

Fill in your details below or click an icon to log in:

Gravatar
WordPress.com Logo

You are commenting using your WordPress.com account. ( Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. ( Log Out /  Change )

Cancel

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Blog at WordPress.com.