Article View: borland.public.cppbuilder.nativeapi
Article #1869How to detect dll injection and hook installers on a Windows system
From: Mark Jacobs
Date: Mon, 28 May 2007 21:13
Date: Mon, 28 May 2007 21:13
7 lines
1475 bytes
1475 bytes
I need some information on how an application can raise an alert if another process on the system attempts to perform DLL code injection. I also need to know how to detect when a process attempts to install a hook into the Windows system. Any ideas anyone? It is for a security application. TIA, -- Mark Jacobs http://jacobsm.com
Technical Details
Message-ID:
<465b45cb$1@newsgroups.borland.com>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!border1.nntp.dca.giganews.com!nntp.giganews.com!nx01.iad01.newshosting.com!newshosting.com!198.186.194.247.MISMATCH!news-xxxfer.readnews.com!news-out.readnews.com!transit4.readnews.com!newspeer1.nwr.nac.net!newsfeeds.ihug.co.nz!ihug.co.nz!newsgroups.borland.com!not-for-mailShow Full Headers
Complete Article Headers
X-Google-Thread: 10cc67,1b1d8084f8b63121,start X-Google-Attributes: gid10cc67,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Reply-To: "Mark Jacobs" <www.jacobsm.com/mjmsg.htm?Borland Newsgroup> From: "Mark Jacobs" <www.jacobsm.com/mjmsg.htm?Borland Newsgroup> Newsgroups: borland.public.cppbuilder.nativeapi Subject: How to detect dll injection and hook installers on a Windows system Date: Mon, 28 May 2007 22:13:13 +0100 Lines: 9 X-Priority: 3 X-MSMail-Priority: Normal X-Newsreader: Microsoft Outlook Express 6.00.2900.3028 X-RFC2646: Format=Flowed; Original X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 NNTP-Posting-Host: 195.137.123.182 Message-ID: <465b45cb$1@newsgroups.borland.com> X-Trace: newsgroups.borland.com 1180386763 195.137.123.182 (28 May 2007 14:12:43 -0700) Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!border1.nntp.dca.giganews.com!nntp.giganews.com!nx01.iad01.newshosting.com!newshosting.com!198.186.194.247.MISMATCH!news-xxxfer.readnews.com!news-out.readnews.com!transit4.readnews.com!newspeer1.nwr.nac.net!newsfeeds.ihug.co.nz!ihug.co.nz!newsgroups.borland.com!not-for-mail