Posted October 16, 20195 yr I am studying about a virus.The virus hooks the some functions of nt.dll loaded in to the space of explorer.exe.It seemes that the nt.dll loaded by aother process ( say wordpad.exe) may not be hooked by the virus.Is it possible to compare the the two nt.dll address space and locate the hooked apis.I am using windows XP
October 22, 20195 yr try PChunter with r3 process check feature. it will list all hooked functions in any found module and you can also export them into text file.
Create an account or sign in to comment