Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

wikipedia article's section on user mode rootkits is not quite clear about the mechanism of injecting code into running processes. Does this take advantage of normal OS functionality and so could be (or even can be, right now) monitored from within the relevant Windows api? Or does each injection constitute a unique hack aimed at the specific process's vulnerabilities and generally not dependent on any standard OS functionality, so that detection might require some sort of "signing" the process's executable code in memory?

share|improve this question
This may shed some light:… – hydroparadise Apr 30 '12 at 14:55
thanks, that was enlightening. So from that discussion and the linked article it sounds like injection/hooking/etc via Windows mechanisms. Presumably some of these mechanisms could be stopped or at least monitored and logged. – EndangeringSpecies Apr 30 '12 at 15:02
@EndangeringSpecies you're right, but the key word is some. It's near impossible to stop all of them, especially if the rootkit manages to obtain higher level permissions through other means. You could also use WinDbg or SoftICE to aid in detecting these events, but that requires running Windows in debug mode (and wouldn't be viable for use in a distributed application). – Breakthrough Apr 30 '12 at 16:48
One specific problem is that a number of legitimate applications use DLL injection. It's bad practice, in my opinion, but users tend to get upset when their favorite application stops working. – Harry Johnston Apr 30 '12 at 21:43

You must log in to answer this question.

Browse other questions tagged .