Reply to thread

Message

<blockquote data-quote="xor_dhillon" data-source="post: 704930" data-attributes="member: 69165">Thanks, [USER=65228]@Opcode[/USER] <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite115" alt=":p" title="Stick out tongue&nbsp; &nbsp; :p" loading="lazy" data-shortname=":p" /> for clearing it up for me, I have begun to write a file IRP I only needed it to detect file movement and thanks for clearing up my confusion <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite120" alt="o_O" title="Er... what?&nbsp; &nbsp; o_O" loading="lazy" data-shortname="o_O" />For my first question, it was a question based on formgrabbers. Most formgrabbers have some sort of inline hook to PR_Write(firefox) SSL_Write(chrome) etc. So my question was If my program detects an inline hook with DLL injection capabilities, can I label this as banking malware?And yes I am already using PsSetLoadProcessNotifyRoutine and PsSetCreateThreadNotifyRoutine and PsSetLoadImageNotifyRoutine to detect creation of any thread/image/process as well as protect my own process. And I thought you cannot really patch the windows kernel anymore because of KPP?</blockquote>

[QUOTE="xor_dhillon, post: 704930, member: 69165"] Thanks, [USER=65228]@Opcode[/USER] :P for clearing it up for me, I have begun to write a file IRP I only needed it to detect file movement and thanks for clearing up my confusion o.O For my first question, it was a question based on formgrabbers. Most formgrabbers have some sort of inline hook to PR_Write(firefox) SSL_Write(chrome) etc. So my question was If my program detects an inline hook with DLL injection capabilities, can I label this as banking malware? And yes I am already using PsSetLoadProcessNotifyRoutine and PsSetCreateThreadNotifyRoutine and PsSetLoadImageNotifyRoutine to detect creation of any thread/image/process as well as protect my own process. And I thought you cannot really patch the windows kernel anymore because of KPP? [/QUOTE]

Verification