Thursday, August 6, 2009

Why is DLL Important?

The reason for this posting is because, we [the RootkitAnalytics team] would like to respond to some of the queries that we have been noticing recently.


Stimulus: "Why is SpyDLLRemover" working on finding only Injected DLL's?

Response: As the name implies, SpyDLLRemover is intended for Injected/Spyware DLL Remover.


Stimulus: "Why do you want a tool that can do only DLL testing?"

Response: Well, DLL[Dynamic Link Library] is the artery of Windows Operating System. If you notice, most of the famous malwares uses DLL injection. The most recent example includes[but is not limited to] Conficker. Conficker is delivered as DLL's and hence it cannot run as a stand alone program. All these DLL's needs to be loaded into another running process or applications. Which means that when we perform scan of Processes, Services [and in the near future Registry and File System] for injected DLL's[Severe/Critical/Red], or DLL's that could be called by other processes[Orange/Suspicious], or DLL's that could be used in non-native process[Yellow]. But in all cases, DLL plays major role, hence we thought that we would give the users a standalone tool just for this purpose.


Stimulus: "Is this your first and last tool?"

Response: We would be launching other tools pretty soon. Our aim is to release tools that could interrupt malware's functioning before it does the harm to your system, rather than triggering an alert after it is allowed to do malicious activities. Hence, we are moving in the direction of real-time/live analysis. But since this is free stuff we are doing and free volunteering, it always takes time for such releases to happen.


Stimulus: "Is this tool safe?"

Response: We guarantee that it is safe. But our name has "evil" in it. Hence, we have also listed what other folks have guaranteed on our tools. "User Reviews" section would be listed in our site pretty soon. Hence, if you are a user and if you have recommended your organization to use our tool for detection or if you are a free-lancer/consultant using our tool, please send us your reviews and we would be glad to publish them in this section. Contact us at and we would send you the preferred format and other details that are essential.


If you have any other questions at all, please feel free to contact us at any point of time, and we would be more than glad to help you. Our support is 100% free, but we do not guarantee that we would be able to support every request. But on either case, we would always respond to your queries.

Thanks and have a great day.

No comments: