Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 839175" data-attributes="member: 32260">RunBySmartScreen and DLL hijacking.When the user applied H_C&#039;s Allow EXE setup, the SmartScreen check can be done via &#039;Run By SmartScreen&#039; option on the Explorer right-click context menu. This option allows checking and opening any file which is located in an untrusted location (like USB drive, Download folder, etc.), without knowing if the file is a photo, document, video clip, script, shortcut, or executable.Suppose now that the user wants to check the file, and it happened to be the LegalApp.exe with hijacked DLL. Then in the new H_C version, using &quot;Run By SmartScreen&quot; will show the alert with some instructions and two buttons &lt;Cancel&gt; and &lt;Run anyway&gt;:&quot;This is an executable EXE file (*.exe) - it cannot be Run By SmartScreen from the current location. One or more DLL files are in the same location, and this can bypass SmartScreen via DLL hijacking.Press the &lt;Cancel&gt; button, if you are not sure what to do. Next, check if all the DLL files are clean and necessary in the current location. Please note, that they can be often hidden, except when Windows Explorer is set to show hidden files. Do not run the initial EXE file without using &#039;Run By SmartScreen&#039;, until you are sure that these DLL files are clean.Press the &lt;Run anyway&gt; button only if you are sure that the initial EXE file is a standalone application installer or portable application executable. The file will be executed from another location, without loading the DLL files from the current location.&quot;Please let me know if something can be improved in the alert text.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite135" alt=":giggle:" title="Giggle&nbsp; &nbsp; :giggle:" loading="lazy" data-shortname=":giggle:" /></blockquote>

[QUOTE="Andy Ful, post: 839175, member: 32260"] [B][SIZE=5]Run[COLOR=rgb(184, 49, 47)]By[/COLOR]SmartScreen and DLL hijacking.[/SIZE][/B] When the user applied H_C's Allow EXE setup, the SmartScreen check can be done via 'Run By SmartScreen' option on the Explorer right-click context menu. This option allows checking and opening any file which is located in an untrusted location (like USB drive, Download folder, etc.), without knowing if the file is a photo, document, video clip, script, shortcut, or executable. Suppose now that the user wants to check the file, and it happened to be the [COLOR=rgb(0, 168, 133)][B]LegalApp.exe[/B][/COLOR] with [COLOR=rgb(184, 49, 47)][B]hijacked DLL[/B][/COLOR]. Then in the new H_C version, using "Run By SmartScreen" will show the alert with some instructions and two buttons <Cancel> and <Run anyway>: [I]"This is an executable EXE file (*.exe) - it cannot be Run By SmartScreen from the current location. One or more DLL files are in the same location, and this can bypass SmartScreen via DLL hijacking. Press the <Cancel> button, if you are not sure what to do. Next, check if all the DLL files are clean and necessary in the current location. Please note, that they can be often hidden, except when Windows Explorer is set to show hidden files. Do not run the initial EXE file without using 'Run By SmartScreen', until you are sure that these DLL files are clean. Press the <Run anyway>[I] button [/I]only if you are sure that the initial EXE file is a standalone application installer or portable application executable. The file will be executed from another location, without loading the DLL files from the current location."[/I] [B]Please let me know if something can be improved in the alert text.:giggle:[/B] [/QUOTE]

Verification