Article View: borland.public.cppbuilder.nativeapi
Article #1903Re: How to detect dll injection and hook installers on a Windows system
From: Mark Jacobs
Date: Fri, 01 Jun 2007 10:16
Date: Fri, 01 Jun 2007 10:16
19 lines
2029 bytes
2029 bytes
"Mike Collins" <its@TheBottomOfThePost> wrote in message news:465d98ef$1@newsgroups.borland.com... > Are you looking for a global protection and alert system to inform on rouge > injection or do you have a specific requirement. I am looking for something similar to KAV6.0's detection mechanism. In fact, I just want to log something to a file if my app detects such activities. > A particularly good text is "Rootkits - Subverting the Windows kernal" by > Greg Hoglund and James Bulter. Madshi's site is also a very good basis for > practical information. Thanks. I have a lot of reading to do. It seems some injection techniques do not even call Win API routines to achieve their purpose - they install low-level drivers to do it! Yikes! I wonder if KAV6.0 detects those?!? -- Mark Jacobs DK Computing http://www.dkcomputing.co.uk
Technical Details
Message-ID:
<465ff1e9@newsgroups.borland.com>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!border1.nntp.dca.giganews.com!border2.nntp.dca.giganews.com!nntp.giganews.com!newspeer1.nwr.nac.net!newsfeeds.ihug.co.nz!ihug.co.nz!newsgroups.borland.com!not-for-mailReferences:
<465b45cb$1@newsgroups.borland.com> <465d98ef$1@newsgroups.borland.com>Show Full Headers
Complete Article Headers
X-Google-Thread: 10cc67,1b1d8084f8b63121 X-Google-Attributes: gid10cc67,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit From: "Mark Jacobs" <http://www.jacobsm.com/mjmsg.htm?BorlandNG> Newsgroups: borland.public.cppbuilder.nativeapi References: <465b45cb$1@newsgroups.borland.com> <465d98ef$1@newsgroups.borland.com> Subject: Re: How to detect dll injection and hook installers on a Windows system Date: Fri, 1 Jun 2007 11:16:08 +0100 Lines: 20 Organization: DK Computing MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="Windows-1252"; reply-type=response Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Newsreader: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 NNTP-Posting-Host: 81.144.157.8 Message-ID: <465ff1e9@newsgroups.borland.com> X-Trace: newsgroups.borland.com 1180692969 81.144.157.8 (1 Jun 2007 03:16:09 -0700) Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!border1.nntp.dca.giganews.com!border2.nntp.dca.giganews.com!nntp.giganews.com!newspeer1.nwr.nac.net!newsfeeds.ihug.co.nz!ihug.co.nz!newsgroups.borland.com!not-for-mail