Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71468
ClamWin Portable DLL Hijack
ClamWin looks for "quserex.DLL" in just about every place it can think of:
The DLLDynamic Link Library doesn't seem to be "needed" as returning FALSE on ProcessAttach doesn't cause anything to break
This DLLDynamic Link Library is also attempted to be laoded in the same manner by ClamWin's scanning executable, "clamscan.exe"