New users who want to read up on it can open our coverage of the issue, or Microsoft’s Security Advisory. Both offer a deeper explanation and workarounds for the issue.

The free software DLLHiJackAuditor has been designed to test software for the vulnerability. The portable program can audit any 32-bit Windows application.

The program is dead easy to use. Users need to select an application from the computer system first before they click on the start audit button to test the application.

dll hijack vulnerability

The portable software will automatically load the application, and terminate it. It will uncover any vulnerable DLLs that are found during the audit, and report those back to the user of the program.

The Exploit button becomes active if a vulnerable DLL has been found in the selected software.

Finally, it is possible to create a HTML report of the findings, which contains detailed technical information that the developer of the vulnerable application can use to fix the issue.

DLL Hijack Audit does not require any third party tools to function properly. It has in addition been designed in a way that it does not trigger antivirus or security software on the system. Finally, the program require no special privileges for auditing applications, with the exception if the target executable does).

The software program is available for download at the developer website over at SecurityXploded. The tool can be useful for software developers, and users who want to make sure that the programs they run on their system are not affected by the security issue.

Automated software like Process Explorer, Autoruns but also SpyDLL Remover aid the user in analysing and protecting the computer system from malicious software.

The filename of a process, dynamic link library or generic executable file can hint at problems but it does not have to be thanks to rootkits and spyware injection which can turn harmless files into spyware spreading time bombs.

SpyDLL Remover is a portable software program that concentrates on the running processes and especially the active dll files that are linked to them. It scans and analyzes all the dlls and displays the result of the analysis in a color coded table sorted by threat level.

Dll files that have passed the scan are not displayed in the program’s interface, only dangerous, suspicious and those that need further analysis are displayed.

The detected files can then be processed by the user. The spyware remover supports removing the dll, killing the process and removing all which will remove both the processes and dlls.

The software program suggests to research dlls online that need further analysis. This can be done by selecting a dll in the interface and clicking on the Check Online button.

This opens up information about the dll at the Process Library website. The website is a vast resource for file related information. We did experience some “not found” messages on the other hand when trying to check some of the dlls running on our computer system.

The only option in this case is to perform a manual research in a search engine.

Reports about the findings of the application can be exported as html files to the local computer system for further analysis and archiving.

SpyDLL Remover is a solid security software for the Windows operating system that combines a fast scan with good results. Its portability makes it an ideal candidate for a user’s repair CD or USB stick.

The software can be downloaded from the developer’s homepage over at Rootkit Analytics (via Rarst)

DLL Archive has been designed to scan and backup a computer system for orphan dll files. The program will identify all dll files and then verify if these files are references by files that load dll files. Orphan dlls are not references by any of these files.

It is then possible to add all of the orphan dll files or only selected ones to an archive that functions as a backup in case false positives are found in that list. The developer of the software program suggests to backup the dlls and work with the computer system for a couple of days the least before deleting the archive to ensure that the backup contains indeed only orphan dll files.

DLL Archive is compatible with every version of the Windows operating system including Windows XP, Windows Vista and Windows 7. It can be downloaded from the developer’s website.

The DLL Remover works by pointing the application to a dll on the system which initiates four actions in the software. It searches for infected threads, deleted infected files, deletes entries in the Windows Registry and restarts the computer at the end to complete the operation.

UnDLL (via Techtrends) can be dowloaded from the Italian ESET (Essential Security against Evolving Threats) website only.

DLL Archive is able to clear this mess. The freeware scans and verifies all dll files on your system and adds them to a list of dlls that are most likely obsolete. Most likely means that there is of course a chance that this dll is still needed and for this purpose DLL Archive archives the dlls which means that they are moved from the system dirs to an archive dir (DLLArchive in the windows folder). You have to work with your computer as usual at this point, reboot it for instance and see if everything is still working as intended.

If you receive errors you should move the dll that is mentioned back to the system directory. I performed a scan and it found more than 450 dll files. I decided to archive them all and see what would happen. Well, nothing happened at all. I was able to reboot my computer, start my programs as usual without problems at all.

The size of the DLLArchive folder was 196 megabytes, this is huge if you ask me. I suggest you keep those files at least for a week and see if any error pops up at a later time. If not appears delete them or back them up before you do.