This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

"Custom dynamic link libraries are being loaded for every application."

We recently deployed Sophos Endpoint Advanced in our environment. So far so good. However when installing ont he servers and reviewing the logs we noticed this Warning; "Custom dynamic link libraries are being loaded for every application."

A fellow Sys Admin that manages the exchange server would like to know if this is related to Sophos and which dlls are being changed. I searched the web and the Sophos forums and found nothing that I could see related directly.

Does anyone here have details on the dlls that Sophos might be modifying?

:36265


This thread was automatically locked due to age.
  • HI,

    This warning is just to let the admin know that a third party library is being loaded into processes.  

    In this case I assume it is detours: http://www.sophos.com/en-us/support/knowledgebase/112099.aspx

    The Sophos DLL is loaded from the keys:

    32-bit

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Window\AppInit_DLLs

    64-bit

    HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows NT\CurrentVersion\Window\AppInit_DLLs

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Window\AppInit_DLLs

    Regards,

    Jak

    :36267