Sfc_os.dll Download
Tanner Brodnax
Normal process usually entails hex editing sfc_os.dll. I am testing SP3 RC1 and I could not find anyone who had hacked it yet. Searching the net I found a guy who figured out a way to make XP think it was in safe mode thus SFC/WMP is disabled. The cool thing about this hack is no matter what previous or future version you are running WFP can be disabled in the same manner. Using the hex editor method the values constantly change. He also found out a way to enable the security tab when your machine is not a member of a domain.
Rshx32.dll is patched... but what about the others? Are you ready to patch your whole OS? Not to mention that I still fail to comprehend how this dll relates to SFC... But maybe that's just me. Or THAT is the method that the author has discovered. But I wouldn't risk to patch it on a live system (while I don't have that problem with sfc_os.dll).
The malware injects a remote thread into winlogon.exe and calls afunction exported by sfc_os.dll, ordinal 2 (SfcTerminateWatcherThread), to disable Windows File Protection until the next reboot. The ...
760c119bf3