How to prevent modules from attaching to my application? FROM#

Question

How to prevent modules from attaching to my application? FROM#

Example: I installed an application called "RivaTuner Statistics Server v6.6.0" which made it for gamers to show the FPS tag in games, since WPF applications use DirectX, this program attaches a module to my WPF application by mistake, which leads to a crash (without any exceptions) before my application is downloaded, and when I close this program, my application works fine!

I fixed this problem by installing RenderOptions.ProcessRenderMode = RenderMode.SoftwareOnly

I also have the same problem with BitDefender antivirus, my program is a VPN Connection application that uses the Proxifier application to set up a global proxy server. When my application starts running the Proxifier process, my application shuts down without any exceptions .. by the way, BitDefender does not detect Proxifier or my application as a virus or a threat, it just causes my application to crash, and Proxifier continues to work without any problems. (Which whitelist of my application solved the problem).

What I want to know in general, is there a way to prevent DLL injection or stop it after attaching it?

Here is the provided EventViewer information:

Version=1
EventType=APPCRASH
EventTime=131414331835897163
ReportType=2
Consent=1
UploadTime=131414331849773927
ReportStatus=393
ReportIdentifier=c52be1e0-6378-4555-bddc-cd49f22e98d4
IntegratorReportIdentifier=e415e187-7b4d-4689-92a7-5522957c6300
Wow64Host=34404
NsAppName=TurboVPN.exe
AppSessionGuid=000037d0-0001-0015-6d89-3176a3e0d201
TargetAppId=W:00065bd30e4a6caee77eb9ec126f39eeb11200000000!000072443a77ce17608085aa75f649187cf7129fd9a8!TurboVPN.exe
TargetAppVer=2017//06//08:20:58:47!0!TurboVPN.exe
BootId=4294967295
TargetAsId=3395
Response.BucketId=c2e6858b6015d605f3dea6f209e5a680
Response.BucketTable=4
Response.LegacyBucketId=120776215139
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=TurboVPN.exe
Sig[1].Name=Application Version
Sig[1].Value=8.0.0.0
Sig[2].Name=Application Timestamp
Sig[2].Value=5939ba87
Sig[3].Name=Fault Module Name
Sig[3].Value=d3d9.dll
Sig[4].Name=Fault Module Version
Sig[4].Value=10.0.15063.0
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=631de416
Sig[6].Name=Exception Code
Sig[6].Value=c0000005
Sig[7].Name=Exception Offset
Sig[7].Value=000000000000fd0c
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=10.0.15063.2.0.0.256.4
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=1033
DynamicSig[22].Name=Additional Information 1
DynamicSig[22].Value=9b4f
DynamicSig[23].Name=Additional Information 2
DynamicSig[23].Value=9b4f78d83ca7cfa07fe4d1531372a428
DynamicSig[24].Name=Additional Information 3
DynamicSig[24].Value=9991
DynamicSig[25].Name=Additional Information 4
DynamicSig[25].Value=99915f8f3f68939dc06e64d116ece58a
UI[2]=C:\Users\Mr\Documents\Visual Studio 2015\Projects\TurboVPN\TurboVPN\bin\Release\TurboVPN.exe
UI[3]=TurboVPN has stopped working
UI[4]=Windows can check online for a solution to the problem.
UI[5]=Check online for a solution and close the program
UI[6]=Check online for a solution later and close the program
UI[7]=Close the program
LoadedModule[0]=C:\Users\Mr\Documents\Visual Studio 2015\Projects\TurboVPN\TurboVPN\bin\Release\TurboVPN.exe
LoadedModule[1]=C:\WINDOWS\SYSTEM32\ntdll.dll
LoadedModule[2]=C:\WINDOWS\SYSTEM32\MSCOREE.DLL
LoadedModule[3]=C:\WINDOWS\System32\KERNEL32.dll
LoadedModule[4]=C:\WINDOWS\System32\KERNELBASE.dll
LoadedModule[5]=C:\Program Files\Bitdefender\Bitdefender 2017\Active Virus Control\Avc3_00125_004\avcuf64.dll
LoadedModule[6]=C:\WINDOWS\SYSTEM32\apphelp.dll
LoadedModule[7]=C:\WINDOWS\System32\ADVAPI32.dll
LoadedModule[8]=C:\WINDOWS\System32\msvcrt.dll
LoadedModule[9]=C:\WINDOWS\System32\sechost.dll
LoadedModule[10]=C:\WINDOWS\System32\RPCRT4.dll
LoadedModule[11]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll
LoadedModule[12]=C:\WINDOWS\System32\SHLWAPI.dll
LoadedModule[13]=C:\WINDOWS\System32\combase.dll
LoadedModule[14]=C:\WINDOWS\System32\ucrtbase.dll
LoadedModule[15]=C:\WINDOWS\System32\bcryptPrimitives.dll
LoadedModule[16]=C:\WINDOWS\System32\GDI32.dll
LoadedModule[17]=C:\WINDOWS\System32\gdi32full.dll
LoadedModule[18]=C:\WINDOWS\System32\msvcp_win.dll
LoadedModule[19]=C:\WINDOWS\System32\USER32.dll
LoadedModule[20]=C:\WINDOWS\System32\win32u.dll
LoadedModule[21]=C:\WINDOWS\System32\IMM32.DLL
LoadedModule[22]=C:\WINDOWS\System32\kernel.appcore.dll
LoadedModule[23]=C:\WINDOWS\SYSTEM32\VERSION.dll
LoadedModule[24]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll
LoadedModule[25]=C:\WINDOWS\SYSTEM32\MSVCR120_CLR0400.dll
LoadedModule[26]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\mscorlib\59ea37125345a946fbfb8868aa11ed27\mscorlib.ni.dll
LoadedModule[27]=C:\WINDOWS\System32\ole32.dll
LoadedModule[28]=C:\WINDOWS\system32\uxtheme.dll
LoadedModule[29]=C:\Program Files (x86)\RivaTuner Statistics Server\RTSSHooks64.dll
LoadedModule[30]=C:\WINDOWS\SYSTEM32\WINMM.dll
LoadedModule[31]=C:\WINDOWS\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9279_none_08e667efa83ba076\MSVCR90.dll
LoadedModule[32]=C:\WINDOWS\SYSTEM32\WINMMBASE.dll
LoadedModule[33]=C:\WINDOWS\System32\cfgmgr32.dll
LoadedModule[34]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\4b4b69a2aa9b596c8b8e7a32267eac35\System.ni.dll
LoadedModule[35]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Core\d4035216edd875be919d339859343a6c\System.Core.ni.dll
LoadedModule[36]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\WindowsBase\d6053a0b7badab04868dc6e51ab4c02e\WindowsBase.ni.dll
LoadedModule[37]=C:\WINDOWS\SYSTEM32\CRYPTSP.dll
LoadedModule[38]=C:\WINDOWS\system32\rsaenh.dll
LoadedModule[39]=C:\WINDOWS\SYSTEM32\bcrypt.dll
LoadedModule[40]=C:\WINDOWS\SYSTEM32\CRYPTBASE.dll
LoadedModule[41]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\PresentationCore\b5bfbcf78210cf783ff665fea098ebfa\PresentationCore.ni.dll
LoadedModule[42]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f#\73dece296df0b44862aa59e1f73825c3\PresentationFramework.ni.dll
LoadedModule[43]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Xaml\44f34f029c456762dba3d085d6b9fa9c\System.Xaml.ni.dll
LoadedModule[44]=C:\WINDOWS\SYSTEM32\dwrite.dll
LoadedModule[45]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\wpfgfx_v0400.dll
LoadedModule[46]=C:\WINDOWS\System32\OLEAUT32.dll
LoadedModule[47]=C:\WINDOWS\SYSTEM32\MSVCP120_CLR0400.dll
LoadedModule[48]=C:\WINDOWS\SYSTEM32\D3DCOMPILER_47.dll
LoadedModule[49]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationNative_v0400.dll
LoadedModule[50]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll
LoadedModule[51]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Configuration\9f298b9fdf9d3d88c051ba8d0cfcdd98\System.Configuration.ni.dll
LoadedModule[52]=C:\WINDOWS\SYSTEM32\urlmon.dll
LoadedModule[53]=C:\WINDOWS\System32\shcore.dll
LoadedModule[54]=C:\WINDOWS\System32\windows.storage.dll
LoadedModule[55]=C:\WINDOWS\System32\powrprof.dll
LoadedModule[56]=C:\WINDOWS\System32\profapi.dll
LoadedModule[57]=C:\WINDOWS\SYSTEM32\iertutil.dll
LoadedModule[58]=C:\WINDOWS\SYSTEM32\SspiCli.dll
LoadedModule[59]=C:\WINDOWS\SYSTEM32\msiso.dll
LoadedModule[60]=C:\WINDOWS\SYSTEM32\PROPSYS.dll
LoadedModule[61]=C:\WINDOWS\System32\shell32.dll
LoadedModule[62]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Xml\246b8fa70f43db970414bb4119fe629f\System.Xml.ni.dll
LoadedModule[63]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Runt73a1fc9d#\9ed83e5a61548d2d78bc4b7a667e9139\System.Runtime.Remoting.ni.dll
LoadedModule[64]=C:\WINDOWS\System32\ws2_32.dll
LoadedModule[65]=C:\WINDOWS\system32\mswsock.dll
LoadedModule[66]=C:\WINDOWS\system32\dwmapi.dll
LoadedModule[67]=C:\WINDOWS\System32\MSCTF.dll
LoadedModule[68]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Drawing\763d0ca89a77cfd983874efe156a9296\System.Drawing.ni.dll
LoadedModule[69]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\d63d7f874bb64e51ee0ef09cc99218f6\System.Windows.Forms.ni.dll
LoadedModule[70]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Security\35f9d2604274a3e8fbf814e10789dc51\System.Security.ni.dll
LoadedModule[71]=C:\WINDOWS\System32\crypt32.dll
LoadedModule[72]=C:\WINDOWS\System32\MSASN1.dll
LoadedModule[73]=C:\WINDOWS\SYSTEM32\DPAPI.dll
LoadedModule[74]=C:\WINDOWS\SYSTEM32\WindowsCodecs.dll
LoadedModule[75]=C:\WINDOWS\SYSTEM32\d3d9.dll
LoadedModule[76]=C:\WINDOWS\SYSTEM32\igdumdim64.dll
LoadedModule[77]=C:\WINDOWS\System32\SETUPAPI.dll
LoadedModule[78]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Presentatioaec034ca#\248dd0bba3037acdc2ab60513b34c3f2\PresentationFramework.Aero2.ni.dll
LoadedModule[79]=C:\WINDOWS\SYSTEM32\WtsApi32.dll
LoadedModule[80]=C:\WINDOWS\SYSTEM32\WINSTA.dll
LoadedModule[81]=C:\WINDOWS\System32\clbcatq.dll
LoadedModule[82]=C:\WINDOWS\system32\dataexchange.dll
LoadedModule[83]=C:\WINDOWS\system32\d3d11.dll
LoadedModule[84]=C:\WINDOWS\system32\dcomp.dll
LoadedModule[85]=C:\WINDOWS\system32\dxgi.dll
LoadedModule[86]=C:\WINDOWS\system32\twinapi.appcore.dll
LoadedModule[87]=C:\WINDOWS\SYSTEM32\igdusc64.dll
State[0].Key=Transport.DoneStage1
State[0].Value=1
File[0].CabName=Report.zip
File[0].Path=Report.zip
File[0].Flags=196608
File[0].Type=11
File[0].Original.Path=\\?\C:\WINDOWS\system32\Report.zip
FriendlyEventName=Stopped working
ConsentKey=APPCRASH
AppName=TurboVPN
AppPath=C:\Users\Mr\Documents\Visual Studio 2015\Projects\TurboVPN\TurboVPN\bin\Release\TurboVPN.exe
NsPartner=windows
NsGroup=windows8
ApplicationIdentity=ED5A83A5552697FBE579A0CAAEF2FF9E
MetadataHash=1411986728

If you look, you can see the attached module LoadedModule[29]=C:\Program Files (x86)\RivaTuner Statistics Server\RTSSHooks64.dll

+6

c # module wpf hook

Mohamad rashidi Jun 08 '17 at 10:41

3

DLL, , . , DirectX . , AccessViolationException . , API, , , "", .

, . , -. , Win10, .

, , . , , , WPF. WPF Performance Suite.

+4

Hans Passant 11 . '17 10:34

Have you tried to catch exceptions during the initializecomponents function? Since this happens while drawing a window, you can try the following:

public MainWindow()
{
   try{
   InitializeComponent();
   //you remaining code
   }
   catch(Exception ex){
     Console.Out.Writeline(ex.Message);
   }
}

In addition, you can try subscribing to _Application.DispatcherUnhandledException_and _AppDomain.CurrentDomain.UnhandledException_, which can provide you with additional information on eliminating an application crash.

+1

Eric Jalbert Jun 14 '17 at 19:03

source share

Vahid K. · Accepted Answer · 2017-06-17T13:50:41+0000

AFAIK, . , :

, - ( . )

, CreateRemoteThread LoadLibrary , .

How to prevent modules from attaching to my application? FROM#

More articles: