Custom dynamic link libraries are being loaded for every application

Can anyone tell me why I get this warning in my System Event Viewer (Event ID:11) every time Windows7 x64 boots? Should I worry about it? Is there anything I can do to make it go away?

 

Walt

 

Question Info


Last updated September 29, 2019 Views 79,795 Applies to:
Answer
Answer

For the time being, it won't affect anything else, if AppInit_Dlls is empty.  LoadAppInit_Dlls is a flag that tells Windows to "respect" (load the DLLs in AppInint_DLLs) the AppInit_DLLs value.  Older, pre-Vista apps won't know to set LoadAppInit_DLLs to 1, so the DLLs the would add to this location would not be loaded.  This can be viewed as a good thing, as this was a quick way to get code (good and bad) loaded into the address space of every process that loaded user32.dll (pretty much all of them), which processes AppInit_DLLs.  Newer apps are savvy to the LoadAppInit_DLLs setting so they set it to 1 and also add their components to AppInit_DLLs.  In your case it seems that some program added DLLS to AppInit_DLLs, set LoadAppInit_DLLs to 1, and then the DLLs were removed (manually? cleanup program? uninstall program?) from AppInit_DLLs, but LoadAppInit_DLLs was not restored to the default value of 0 (or not being present at all).

So, our exploration indicates that Windows bases the decision to log the event about "Custom Dynamic Link Libraries being loaded for every application" on the LoadAppInit_DLLs setting, regardless of the contents of the AppInit_DLLs value.

69 people were helped by this reply

·

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.