content: I was thinking about that too.  Maybe refusing to load DLLs that don't match an expected checksum? That's not necessarily easy to do in a way that couldn't be hacked.  Maybe encrypted/signed DLLs? Applications should also stop hunting around various places for DLLs they need and only load them from the specific folder they are expected to be in.  A lot of the time you can just drop a DLL into an application's install folder and if it has the right name, that's the one that'll get loaded.