Honestly, I never saw that thread before!
Webcheck.dll was also displayed by Autoruns on my laptop, which runs Internet Explorer v6.0.2600, downloaded on 20-Sep-2001 from MS and re-installed after a clean install of Win98SE on 10-Oct-2003. Webcheck.dll on my laptop has 258.048 bytes, is displayed as v6.00.2600.0000 - but with a file modification date of 10-Oct-2003, 2 years after the original download. Iexplore.exe is v6.00.2600.0000 but has the modification date 17-Aug-2001 and ie6setup.exe is digitally signed 20-Aug-2001 [i.e. before Sep.11, 2001] IE probably called home during the installation on 10-Oct-2003., but why would webcheck.dll have a much later modification date than Iexplore.exe?
The ShellServiceObjectDelayLoad is an old hook, one of many exploitable startup access points that appeared in the Win95 shell. Thankfully we have Autoruns to illustrate them. This particular entry point has always been used by Microsoft to load its controversial WebCheck.dll
BTW, are the excellent postings about webcheck.dll (of 2005) http://www.msfn.org/...opic=46066&st=0 still Ok with todays new hardware?
(was before my time here). Amazingly, in Post #8
, I see the great MDGx
has a REG file that is almost identical to one I handmade many years ago. He even mentions the SENS components which I also yanked out by the roots! Consider this operation independently verified.
Nice thread you found there. Bookmarking for later reading.
What I ended up doing was very extreme and very complicated. I essentially removed many of the core components like the previously mentioned WebCheck/Sens
to other things like Power Management and parts of SysTray
and EventLog/Event System
and much more. The only downside I see is that a FlashDrive left in a USB port will prevent shutdown (no big deal). The speed gain and overall stability is substantial, and that was the whole point anyway.
About those file stamps, without looking at other archives (WinME/2K/XP etc) I find these versions of WebCheck.dll in my Win98se stash (MSIE never was used above version 6 of course) ...
WEBCHECK DLL ... 342,800 ... 09-18-97 ... 11:28a ... Webcheck.dll_47117123WEBCHECK DLL ... 356,352 ... 05-11-98 .... 7:01p ... Webcheck.dll_47231100 (Win98)WEBCHECK DLL ... 274,704 ... 02-24-99 .... 3:10p ... Webcheck.dll_5002014200 (Corel 10)WEBCHECK DLL ... 274,704 ... 03-25-00 ... 12:11p ... Webcheck.dll_50023141000WEBCHECK DLL ... 274,704 ... 04-23-99 ... 10:22p ... Webcheck.dll_50026143500 (Win98se)WEBCHECK DLL ... 258,048 ... 08-17-01 ... 10:34p ... Webcheck.dll_60026000000 (MSIE6)WEBCHECK DLL ... 258,048 ... 08-29-02 .... 7:07a ... Webcheck.dll_60028001106(MSIE6sp1)
Maybe the file date/time/size will be of some comparative use to you. I see the default Win98se, then MSIE6 and SP1. I am pretty sure that it was between 2001 and 2002 that I physically stopped these features
from running. If you are in need of more info, it is easy enough to extract the unaltered files from the original distros (e.g., MSIE offline setup cabs). I defintely have them somewhere.IMPORTANT REMINDER for others that may be reading: cutting out these and other core components is not for the faint-hearted. Having spare good copies of System.dat and User.dat handy for quick replacement from DOS is vital and will rescue you from the inevitable system stop at bootup!