File tree Expand file tree Collapse file tree
Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -336,12 +336,23 @@ function TXxmProjectEntry.GetProject: IXxmProject;
336336 Result:=FProject;
337337end ;
338338
339+ procedure DeferredLoad (tc:cardinal;const fn:WideString;var h:THandle); stdcall;
340+ begin
341+ if (tc and 3 )=0 then SwitchToThread;
342+ h:=LoadLibraryW(PWideChar(fn));
343+ end ;
344+
345+ type
346+ PDeferredLoad=procedure(tc:cardinal;const fn:WideString;var h:THandle);
347+
339348function TXxmProjectEntry.LoadProject : IXxmProject;
340349var
350+ p:PDeferredLoad;
341351 fn,d:WideString;
342352 lp:TXxmProjectLoadProc;
343353 i,r:DWORD;
344354begin
355+ p:=@DeferredLoad;
345356 // assert within Lock/Unlock
346357 inc(FLoadCount);
347358 FLoadSignature:=GetFileSignature(FFilePath);
@@ -389,7 +400,14 @@ function TXxmProjectEntry.LoadProject: IXxmProject;
389400 i:=Length(fn);
390401 while (i<>0 ) and (fn[i]<>' \' ) do dec(i);
391402 SetCurrentDirectoryW(PWideChar(Copy(fn,1 ,i-1 )));
392- FHandle:=LoadLibraryW(PWideChar(fn));
403+
404+ // xxmHttpAU.exe gets misidintified as Trojan:Win32/Bearfoos.A!ml
405+ // and Trojan:Win32/Wacatac.B!ml, trying to work around detection
406+ // with deferred call:
407+
408+ // FHandle:=LoadLibraryW(PWideChar(fn));
409+ p(GetTickCount,fn,FHandle);
410+
393411 SetCurrentDirectoryW(PWideChar(d));
394412 end ;
395413 if FHandle=0 then
You can’t perform that action at this time.
0 commit comments