Re: How to detect dll injection and hook installers on a Windows system

Article View: borland.public.cppbuilder.nativeapi

Article #1816

Back to borland.public.cppbuilder.nativeapi Previous Next

#1816

From: Mark Jacobs
Date: Mon, 11 Jun 2007 09:16

9 lines
1744 bytes

After some experiments with KAV6 (followed by a reinstall of Windows XP!), and 
some delving into madshi's forums, I decided to shelve the idea for a while - 
it looks really complicated. To detect hooks, I have to install a hook first! 
To detect DLL code injection, I have to learn about executable file formats 
and redirection tables. It seems a bit steep at the moment! Thanks anyway.
-- 
Mark Jacobs
DK Computing
http://www.dkcomputing.co.uk

Technical Details

Message-ID: <466d12d7@newsgroups.borland.com>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!border1.nntp.dca.giganews.com!nntp.giganews.com!newsfeed00.sul.t-online.de!newsfeed01.sul.t-online.de!t-online.de!newsgroups.borland.com!not-for-mail

References:

<465b45cb$1@newsgroups.borland.com> <465d98ef$1@newsgroups.borland.com> <465ff1e9@newsgroups.borland.com> <46601737@newsgroups.borland.com> <4660a772$1@newsgroups.borland.com> <4663dfaa@newsgroups.borland.com>

Show Full Headers

Complete Article Headers

X-Google-Thread: 10cc67,1b1d8084f8b63121
X-Google-Attributes: gid10cc67,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
From: "Mark Jacobs" <http://www.jacobsm.com/mjmsg.htm?BorlandNG>
Newsgroups: borland.public.cppbuilder.nativeapi
References: <465b45cb$1@newsgroups.borland.com> <465d98ef$1@newsgroups.borland.com> <465ff1e9@newsgroups.borland.com> <46601737@newsgroups.borland.com> <4660a772$1@newsgroups.borland.com> <4663dfaa@newsgroups.borland.com>
Subject: Re: How to detect dll injection and hook installers on a Windows system
Date: Mon, 11 Jun 2007 10:16:06 +0100
Lines: 10
Organization: DK Computing
MIME-Version: 1.0
Content-Type: text/plain;
 format=flowed;
 charset="Windows-1252";
 reply-type=response
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
NNTP-Posting-Host: 81.144.157.8
Message-ID: <466d12d7@newsgroups.borland.com>
X-Trace: newsgroups.borland.com 1181553367 81.144.157.8 (11 Jun 2007 02:16:07 -0700)
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!border1.nntp.dca.giganews.com!nntp.giganews.com!newsfeed00.sul.t-online.de!newsfeed01.sul.t-online.de!t-online.de!newsgroups.borland.com!not-for-mail

Reply to Parent Message