Solved

Trying to find a malware dll

Posted on 2011-02-11
3
346 Views
Last Modified: 2013-11-22
Using Procmon how do I found the setup_0a.dll?

A simple newbie question: a .txt file can be infected with malware?
0
Comment
Question by:rebelscum0000
3 Comments
 
LVL 4

Assisted Solution

by:HawyLem
HawyLem earned 150 total points
Comment Utility
Everything can be infected with malware, particularly with a shell exploit (malicious artifact code that would exploit the editor/reader of the file). But in the specific case of a txt file, this would be very rare.. due to the low complexity of the notepad application too

Using Procmon you can double click and show properties for an executable image and list his DLLs modules
0
 
LVL 23

Assisted Solution

by:edbedb
edbedb earned 150 total points
Comment Utility
Try finding it in regedit or with Process Explorer.
http://technet.microsoft.com/en-us/sysinternals/bb896653
0
 
LVL 29

Accepted Solution

by:
Sudeep Sharma earned 200 total points
Comment Utility
Using ProcMon (Process Monitor) Press Ctrl+H or click on Filter --> Hightlight. It would open a new window.

In this window on first drop down select "Process Name" in second drop down "is" third "setup_0a.dll" and in fourth "include". Click on Add and then click on OK, how when ever the "setup_0a.dll" is used or invoked you would see it ProcMon in different color or highlighted.

Sudeep
tmp.JPG
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Article by: btan
Provide an easy one stop to quickly get the relevant information on common asked question on Ransomware in Expert Exchange.
This story has been written with permission from the scammed victim, a valued client of mine – identity protected by request.
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
This Micro Tutorial will give you a basic overview of Windows DVD Burner through its features and interface. This will be demonstrated using Windows 7 operating system.

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now