Edit C:\Windows\System32\csrsrv.dll
MZ? ?? ? @ ? ? ? ?!?L?!This program cannot be run in DOS mode. $ p?c4?04?04?04?0_?0?07?0? 02?0?05?0?05?0?0>?0?05?0?05?0Rich4?0 PE d? ?R ? " ? ? 8t ? ` ? ` ? ? ` ( 0 0 L P 0 8 ? ` .text ? ? `.data ? ? ? @ ?.pdata L ? @ @.idata , ? @ @.rsrc 0 0 ? @ B.reloc P ? @ B Px ? ?R # ? ? ?R ? ? ?? ? ? ? \ T M P I N I T C A P T U R E P R O C E S S T H R E A D S E C U R I T Y S E S S I O N W A I T C S R S S ! ObjectDirectory \ S e s s i o n s %ws\%ld%s MaxRequestThreads SharedSection \ C s r S b S y n c E v e n t CSRSS ServerDLL Windows Off ProfileControl SubSystemType % w s \ B N O L I N K S % l d \ B a s e N a m e d O b j e c t s % w s \ % l d \ B a s e N a m e d O b j e c t s % w s \ % l d D o s D e v i c e s \ R e g i s t r y \ M a c h i n e \ S y s t e m \ C u r r e n t C o n t r o l S e t \ C o n t r o l \ S e s s i o n M a n a g e r P r o t e c t i o n M o d e ??3 ? ? ? ? ? ? ? ? ? ?-j1? RO??X? ? ?ServerDllInitialization S h a r e d S e c t i o n ! C S R S H R I N I T C S R S H R ! S b A p i P o r t ? ? ? ? ? ? T? ? A p i P o r t \ R e g i s t r y \ M a c h i n e \ S o f t w a r e \ P o l i c i e s \ M i c r o s o f t \ W i n d o w s \ S y s t e m S e r i a l i z e A p p S h u t d o w n ? ? ? ? RSDS?l?s\@?T??? csrsrv.pdb UGPCSRSS: CsrCreateSessionObjectDirectory failed status = %lx CSRSS: NtCreateDirectoryObject failed in CsrCreateSessionObjectDirectory - status = %lx CSRSS: NtCreateSymbolicLinkObject failed in CsrCreateSessionObjectDirectory - status = %lx CSRSS: GetDosDevicesProtection failed - status = %lx W i n d o w s S u b S y s t e m D e f a u l t L o a d P a t h CSRSS: CsrSrvCreateProcess: NtOpenProcess failed - Status = %lx CSRSS: CsrSrvCreateProcess: ReadUnicodeString ImageFileName failed - Status = %lx CSRSS: CsrSrvCreateProcess: ReadUnicodeString CurrentDirectory failed - Status = %lx CSRSS: CsrSrvCreateProcess: ReadUnicodeString CommandLine failed - Status = %lx CSRSS: CsrSrvCreateProcess: RtlCreateProcessParameters failed - Status = %lx CSRSS: CsrSrvCreateProcess: RtlCreateUserProcess failed - Status = %lx \ D o s D e v i c e s % w s \ % l d % w s CSRSS: NtOpenDirectoryObject failed in CsrSbCreateProcess - status = %lx CSRSS: NtSetInformationProcess failed in CsrSbCreateProcess - status = %lx CSRSS: CsrSrvCreateProcess - NtResumeThread failed Status %lx CSRSS: CsrSrvCreateProcess: NtDuplicateObject failed for process - Status = %lx CSRSS: CsrSrvCreateProcess: NtDuplicateObject failed for thread - Status = %lx CSRSS: ReadUnicodeString: NtReadVirtualMemory failed - Status = %lx CSRSS: ReadUnicodeString: NtReadVirtualMemory Buffer failed - Status = %lx H?(? H? `? ?? 3??(??????????H?(?\?uB?H?$ H? ?\H?H;??@?u-??@H??7 H?H;??3??$ H?(?K ??(?? ???????????H?(?ILu?! H? ? H?(H?%7? H?(???????$WH? H?8H?? H? ? ?? H?@?? H?? H?H?$0H? _? ?????SH? ?dH??~????duH? [?? (? ?? ?Kd?[ H?H? [? ???????H? ? 3??%? ???????SH? H?H?H?H?H9BueH9u`H?H?H?H?8 tH?H?H9Bu;H9u6H?H?H?8H? H9 u?\?r??\H?8? ?HH? [? ?)? ?)?????SH? H?? H?0H?t?4 H?8H?u L?@M?u.H?P?`? H?H? [????? ?0? H?8?>? ?H? ? 3?? ???????????UWAVAWH?$x??H?? eL?%0 H?L?I?@E3?L?$H? H??Z I?pH?? H?$PH?$(H?$x H?? ? E3??D?? ?$P0 L?$X?$ D?$hL?$`L?$pL?$x?/? ="