Reply to thread

Message

<blockquote data-quote="xor_dhillon" data-source="post: 704889" data-attributes="member: 69165">There are few things I had ideas on, Could you please tell me which are bad ideas and which are good to detecting/helping prevent malware? I am kind of new to this so any help is appreciated <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />.1. If a file has inline hooks and attempts to do some sort of Remote Thread creation or DLL Injection, is it safe to label it as malware?2. Is it okay to prevent creation of remote non privileged threads? Of course not system threads... because that would lead to bsod. 3. What is the difference between PFLT_PRE_OPERATION_CALLBACK and using IRP codes like IRP_MJ_CREATE to notify on file movement. 4. Is there any use of creating a keyboard and mouse driver filter?5. Is ObRegisterCallbacks good enough for self protection ? (I am not talking about registry and etc.)6. Also is it a bad idea to maybe upload files (of course with user consent and if it is not detected as malware)&nbsp; dropped as a subprocess of word/pdf/ppt etc.. after checking it against a database of goodware?</blockquote>

[QUOTE="xor_dhillon, post: 704889, member: 69165"] There are few things I had ideas on, Could you please tell me which are bad ideas and which are good to detecting/helping prevent malware? I am kind of new to this so any help is appreciated :). 1. If a file has inline hooks and attempts to do some sort of Remote Thread creation or DLL Injection, is it safe to label it as malware? 2. Is it okay to prevent creation of remote non privileged threads? Of course not system threads... because that would lead to bsod. 3. What is the difference between PFLT_PRE_OPERATION_CALLBACK and using IRP codes like IRP_MJ_CREATE to notify on file movement. 4. Is there any use of creating a keyboard and mouse driver filter? 5. Is ObRegisterCallbacks good enough for self protection ? (I am not talking about registry and etc.) 6. Also is it a bad idea to maybe upload files (of course with user consent and if it is not detected as malware) dropped as a subprocess of word/pdf/ppt etc.. after checking it against a database of goodware? [/QUOTE]

Verification