Fake having installed another SP

Thanks mate, but I already scanned the whole registry for "service pack" and "SP1" without any (useful) results.

venom96737:
I don't understand what you clearly. I never planned on changing files by installing the Service Pack 2 and then switch between installations. Where is the "CSDVersion key sp2" you are speaking of?

jkr:
Thanks, I will try that at least, but I doubt only hooking that function will not do the whole trick. I already said that within my question.

Hello, aren't you familiar with Regedit?
From the RUN box type REGEDIT and press enter.
Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Make sure "currentversion" is highlighted.
look at the items on the right side of the screen.
In mine I see:
item-CSDVersion  value - Service Pack 2
Also:
item-BuildLab value-2600.xpsp_sp2_gdr.050301-1519

Dave

davexnet:
No, I am.

There is no item named "CSDVersion". The ZString of "BuildLab" has the value "2600.xpclient.010817-1148" - I hope you will now believe me that I haven't found anything. Maybe the Service Pack is determined by the datetime in the text. I wonder how it looks like on a windows without any SP.

I bet you also have another Explorer.exe - could you please look it up? Mine has the version number "6.00.2600.0000 (xpclient.010817-1148)" and a filedate of 2001-08-23, 12:00 UTC. Thanks.

Hello,
my exeplorer.exe file version is 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
Date August 04, 2004


I think yours is the base install - not even SP1 ?

As I stated in my original post System files will be different for the service packs explorer is different the kernal is different and a whole list of other files.  Thats what I was saying by just a registry tweak or trying to fool it into thinking it has something it does not will not work.  The CSD version that dave indicated in his post goes back to the one that I stated in my post.  I was saying that the value for the CSDVersion that represents service pack 2 is 200 in the location that I specified just to clear it up.  

Also yes that does represent a base system with no service packs installed at all 6.00.2600.0000 is base .1106 is sp 1 and .2180 is sp2

davexnet:
Thanks for the info. At least it is very interesting when it comes down to determine unknown installations.

venom96737:
I understand that a couple of files will be different due to Service Packs - it's their sense to patch and extend the system of course. Years ago I also underestimated how much "tweaks" can do, e.g. NT5 professional and server are nearly identical and can be switched vice versa. Thanks for the version build numbers.

both:
You are both right, I don't even have SP1. That's a bit surprising to me - must have forgotten about it with my last install on april 2003. It's even more impressing that everything works without any SP. I thank you both so far for giving me all the information. If nobody else comes in and knows where the system precisely determines the installed SP I will try jkrs codehook and after that split the points amongst you three, ok?

Amigo right now you are on a very dangerous system that is so so very easy to hack its not even funny.  Its so easy even a remote desktop simulating program can hack your system right now you really need to upgrade i remember when xp first came out i used to play with the remote desktop exploit and mess with my friends taking control of thier systems, but to have it this day in age is really not needed an update is vital in your sense and yes alot of files are changed and will the reg tweaks work probalbly not to tell you the truth.

Venom96737:
Sorry, I somehow awaited such an answer. Nothing is fully unintrudable but my system has always been secure: no needless services, no needless accounts, always an overview about my NIC activity, desktop firewall with process creation restrictions, downshifted policies, renamed administrator account, no ActiveX, true registry backups, downshifted write permissions on files/folders/registry keys and for extreme situations always an antivirus guard. Due to my NIC overview, I always know if some upload occurs which I didn't initiate (and such a case never happened). I have a handful of tools for process analyzation, handle listing, streams listing, rootkit revealation. And last but not least: I don't behave like a berzerk. My system also runs stable, reboots occur only when I shut the machine down - a BSoD happens very seldom and can be totally associated with one application.

Hmm... I think I know much about Windows to use it properly. Much enough to not be illusioned that Service Packs alone will do the thinking for me. Believe it or not :) My system is and stays uninfected. If it happens, I know what to do (and I don't mean a reinstall).

HAHAHAH I wasnt speaking of virus's at all your computer is so wide open to hackers its not even funny even a rookie could crack and take your system.  If I was running a scanner (which i dont anymore) I would have a hayday on your system antivirus and all.

Do you want to try to "take" my system? I'm always willing be proven better :)

HAHA that might be fun

I would like to split points amongst you. Everybody tried to help and gave me some info. However, as I suspected nobody really hit the point. jkrs hook example is the closest one, but also only an introduction. If you all agree, I'll do it this way:

125pts davexnet
125pts venom96737
150pts jkr (accept, B)