For the time being, it won't affect anything else, if AppInit_Dlls is empty. LoadAppInit_Dlls is a flag that tells Windows to "respect" (load the DLLs in AppInint_DLLs) the AppInit_DLLs value. Older, pre-Vista apps won't know to set LoadAppInit_DLLs to
1, so the DLLs the would add to this location would not be loaded. This can be viewed as a good thing, as this was a quick way to get code (good and bad) loaded into the address space of every process that loaded user32.dll (pretty much all of them), which
processes AppInit_DLLs. Newer apps are savvy to the LoadAppInit_DLLs setting so they set it to 1 and also add their components to AppInit_DLLs. In your case it seems that some program added DLLS to AppInit_DLLs, set LoadAppInit_DLLs to 1, and then the DLLs
were removed (manually? cleanup program? uninstall program?) from AppInit_DLLs, but LoadAppInit_DLLs was not restored to the default value of 0 (or not being present at all).
So, our exploration indicates that Windows bases the decision to log the event about "Custom Dynamic Link Libraries being loaded for every application" on the LoadAppInit_DLLs setting, regardless of the contents of the AppInit_DLLs value.
70 people were helped by this reply
Did this solve your problem?
Sorry this didn't help.
Great! Thanks for marking this as the answer.
How satisfied are you with this reply?
Thanks for your feedback, it helps us improve the site.