Custom dynamic link libraries are being loaded for every application

Question

Can anyone tell me why I get this warning in my System Event Viewer (Event ID:11) every time Windows7 x64 boots? Should I worry about it? Is there anything I can do to make it go away?

Walt

Answer 1

For the time being, it won't affect anything else, if AppInit_Dlls is empty.  LoadAppInit_Dlls is a flag that tells Windows to "respect" (load the DLLs in AppInint_DLLs) the AppInit_DLLs value.  Older, pre-Vista apps won't know to set LoadAppInit_DLLs to 1, so the DLLs the would add to this location would not be loaded.  This can be viewed as a good thing, as this was a quick way to get code (good and bad) loaded into the address space of every process that loaded user32.dll (pretty much all of them), which processes AppInit_DLLs.  Newer apps are savvy to the LoadAppInit_DLLs setting so they set it to 1 and also add their components to AppInit_DLLs.  In your case it seems that some program added DLLS to AppInit_DLLs, set LoadAppInit_DLLs to 1, and then the DLLs were removed (manually? cleanup program? uninstall program?) from AppInit_DLLs, but LoadAppInit_DLLs was not restored to the default value of 0 (or not being present at all).

So, our exploration indicates that Windows bases the decision to log the event about "Custom Dynamic Link Libraries being loaded for every application" on the LoadAppInit_DLLs setting, regardless of the contents of the AppInit_DLLs value.

Answer 2

Sounds like some AppInit_DLLs are configured to load.  Check the value of HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs.  Those would be the "custom dynamic link libraries" referenced.  See if the software relates to something you recognize.

(Also check HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs on an x64 system, for the 32-bit view.)

Run Sysinternals Autoruns and check the AppInit tab.  What shows up there?  If you recognize the applications / modules listed there, you can ignore the event that is logged.  If not, then investigate what the software is and if it is supposed to be there.

I do not believe there is a way to prevent the event from being logged in the first place - if the AppInit_DLLs are set to be loaded, the warning will be logged.  To stop the logging you will need to change the AppInit_DLLs setting (directly via regedit, or using Autoruns) so those DLLs aren't referenced.  If you're concerned about the impact this may have on the application that configured those DLLs to be loaded, contact the maker of the application with those concerns.

Answer 3

"Yes, I have added 4 folders to my "libraries" folder. Is that what is causing the warning?"  No I don't think so, wrong trend of thought, I presume the 4 folders do not contain any .dll files.

There is a reference to Kaspersky as a possible cause.

JS

http://www.pagestart.com

---

Never be afraid to ask. This forum has some of the best people in the world available to help.

Answer 4

"Yes, I have added 4 folders to my "libraries" folder. Is that what is causing the warning?"  No I don't think so, wrong trend of thought, I presume the 4 folders do not contain any .dll files.

There is a reference to Kaspersky as a possible cause.

JS

http://www.pagestart.com

---

Never be afraid to ask. This forum has some of the best people in the world available to help.

Answer 5

"Yes, I have added 4 folders to my "libraries" folder. Is that what is causing the warning?"  No I don't think so, wrong trend of thought, I presume the 4 folders do not contain any .dll files.

There is a reference to Kaspersky as a possible cause.

JS

http://www.pagestart.com

---

Never be afraid to ask. This forum has some of the best people in the world available to help.