ujtrader wrote: Sun Feb 15, 2026 1:25 pm
First, no offense intended to you personally. I understand you are just sharing the indicator and not the developer. My comment was about the technical risk model of DLL-based indicators in general, not about this specific tool or you.
When an MT4 indicator loads an external DLL, it is no longer just an indicator.
It becomes native Windows software with the same privileges as your user account.
When an indicator imports DLLs like kernel32.dll, user32.dll, ws2_32.dll, advapi32.dll, or ntdll.dll, it is calling native Windows API functions directly, bypassing MetaTraderās internal security restrictions.
This means:
kernel32.dll and ntdll.dll allow low-level OS operations (memory, processes, file access).
user32.dll can interact with keyboard, mouse, and windows.
ws2_32.dll allows raw network communication (sending data to external servers).
advapi32.dll can access Windows registry and security APIs.
These libraries are not needed for a simple oscillator indicator, which can be coded fully in MQL4 without any external dependencies. That is why I said it is unnecessary for such a simple tool.
DLLs are often used for licensing, GUIs, neural networks, or high-performance calculations. But they increase the attack surface and reduce transparency, especially when the source code is not provided.
Evidence is not about this specific indicator being malicious it's about the documented capabilities of Windows APIs. Microsoftās official documentation clearly shows what these DLLs can do. MT4 simply exposes those functions when āAllow DLL importsā is enabled.
So my point is not that this indicator is malware. My point is:
From a security and risk-management perspective, I personally prefer not to run system-level DLL code for a simple indicator when it can be done in pure MQL4.
Everyone has different risk tolerance. I prefer minimal dependencies.
Lastly, Iām sorry if this sounded personal my intention is purely technical and about security, not about anyone here.
.
.
