EMET 4.1 update 1 and WerFault.exe, runonce.exe, dllhost.exe on clean install RRS feed

  • Question

  • Hi, 

    I've try to enforce security on windows executable's and got some issues with those 3 executable :

    WerFault.exe, runonce.exe and  dllhost.exe.

    It is a clean windows installation, using a proper windows DVD and all done offline until critical services like samba, ipv6 tunneling and stuff where removed.

    When I try to enforce ROP gadget and heap spraying detection on those 3 executable, they don't seem to work properly. 

    Either way it's a "computer trace-like" virus or a clever developer optimization that make them incompatible with EMET 4.1 update 1.

    I tried to report it to windows help-desk but it looks like it's out of there scope :/ so I ended up here.

    All I want is to report that bug and maybe have it fix one day. 

    Cordialement, Neo Satsuki .

    • Moved by Cloud_TS Monday, July 7, 2014 1:23 PM move to appropriate forum
    Thursday, July 3, 2014 2:12 PM