I've just read the release notes of Notepad++ 7.3.3 and I've discovered that in the recent Wikileaks revelations about the CIA hacking tools there's something affecting Notepad++. The program itself is fine, but it relies on an external DLL, called SciLexer.dll, of which there exists a version that was modified by the CIA and which enables data collection in the background. In light of this, the newest version of Notepad++ checks the signature of that library, and if it isn't the right one, it simply doesn't start.
My problem is that I'm using a pc where I don't have admin privileges and I can't install/update programs myself, and even asking the IT to do it is long because they are allowed to install only some approved versions, and the entire procedure, due to the usual bureaucratic complicacies, could take weeks or months. So, without being able to install the newest version, how can I check whether my version of SciLexer.dll is good? Is there a direct way to check the certificate (maybe using the
CertUtil command)? If not, can I take a SHA-256 hash and verify it against a known good one? And which one?
For example, to have the SHA-256 hash of my file I can open a shell and run this command:
certutil -hashfile "C:\Program Files (x86)\Notepad++\SciLexer.dll" SHA256
And its output is:
SHA256 hash of file SciLexer.dll: ea 47 f3 18 a8 09 6b 0b 37 f0 cf 04 be 07 76 f0 33 80 27 50 57 a6 cc 10 44 28 df 38 3e d7 69 68 CertUtil: -hashfile command completed successfully.
I currently have Notepad++ v6.6.9 and it's running on Windows 7 64 bit Enterprise.
So, how can I verify whether the library installed on my pc is the original one or not?