Jump to content
Tuts 4 You
Sign in to follow this  
joxxx

Comparing nt .dll loaded by two processes

Recommended Posts

joxxx

I am studying about a virus.The virus hooks the some functions of nt.dll loaded in to the space of explorer.exe.It seemes that the  nt.dll loaded by aother process ( say wordpad.exe) may not be hooked by the virus.Is it possible to compare the the two nt.dll address space and locate the hooked apis.I am using windows XP

 

Share this post


Link to post
Scotch

try PChunter with r3 process check feature. it will list all hooked functions in any found module and you can also export them into text file.

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  
×
×
  • Create New...