trojan virus in dsetup.dll

[Secrets]

Originally Posted by haksum [You must be logged in to view images. Log in or Register.]

Interesting.

It starts just fine because the other DLL that comes with EverQuest Titanium by default simply asks you, "Do you want to upgrade your version of DirectX" and if you already have it installed, it does nothing.
It works like this:

Application loads up, allocates a memory space to the executable. It then imports functions from dynamic link libraries that are assigned to the executable.
When it loads dsetup.dll, in the entry point of said library, it executes more code - some of which writes to eqgame.exe, which in return can load more code when sections of eqgame are accessed. The original library does not do this, it simply exports a function for use that the application can reference.
Once this is done, the application starts, and code is activated as-needed based on what the library has written, for example in the application's main execution thread.

Basically, it's a way of modifying an executable you have no source code for.
If EQEmu had the source code to EverQuest, this DLL would not even be needed.