Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 839072" data-attributes="member: 32260">DLL hijacking can be also a weak point of Anti-EXE solutions (and generally all default-deny solutions) that do not block DLLs.For example, Voodooshield in Autopilot mode can be bypassed in the same way as SmartScreen, because the legal EXE file will be allowed to run both by VT check and AI check. NVT ERP will initially block the EXE file, but some users will allow it to run after checking by VT or on-demand scanner. Of course, most users will be smart enough to set Explorer to show hidden files, and will not run the EXE file when seeing the DLLs in the same folder.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite135" alt=":giggle:" title="Giggle&nbsp; &nbsp; :giggle:" loading="lazy" data-shortname=":giggle:" /><img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 839072, member: 32260"] DLL hijacking can be also a weak point of Anti-EXE solutions (and generally all default-deny solutions) that do not block DLLs. For example, Voodooshield in Autopilot mode can be bypassed in the same way as SmartScreen, because the legal EXE file will be allowed to run both by VT check and AI check. NVT ERP will initially block the EXE file, but some users will allow it to run after checking by VT or on-demand scanner. Of course, most users will be smart enough to set Explorer to show hidden files, and will not run the EXE file when seeing the DLLs in the same folder.:giggle:(y) [/QUOTE]

Verification