hooking system stuff

[iNsAnE-MS]

Is there any way to hook into like... windows? I need to see what process spawns another process. (Trying to write a tool I can use to kill this goofy spyware.)

[iNsAnE-MS]

I managed to whack the spyware spawner at the source by killing the power to my computer and then starting computer in safe mode, replacing the offending exe with a harmless nothing exe with read-only and system attribs, and deleting registry entries. Still need to know how to hook stuff like that though...

[Warrior]

You're a die hard Spyware killer. :]

[iNsAnE-MS]

Rawr.

[OnlyMeat]

Is there any way to hook into like... windows? I need to see what process spawns another process. (Trying to write a tool I can use to kill this goofy spyware.)

Don't install spyware?

[iNsAnE-MS]

No choice, didn't have XP all updated and it hijacked me. First time I've had spyware in two years.

[MyndFyre]

You need the Windows DDK to hook the CreateProcess() routine.  You'll need to create a kernel-mode driver that uses the PsSetCreateProcessNotifyRoutine system function.

Note that products like Norton Internet Security and Microsoft Anti-Spyware already do things like this.

[iNsAnE-MS]

Although they do this already, they don't notify of what program performs certain actions like modifying the registry, and do not notify me of what spawns 'approved' programs.

[Adron]

Although they do this already, they don't notify of what program performs certain actions like modifying the registry, and do not notify me of what spawns 'approved' programs.

To find out what program spawns a program I think you can just turn on process tracking in the security auditing settings for 2k+. To find out who modifies the registry you need to write a kernel mode driver that hooks the registry functions. Or use regmon....

[Stealth]

Is there any way to hook into like... windows? I need to see what process spawns another process. (Trying to write a tool I can use to kill this goofy spyware.)

One of my favorite anti-spyware tools will help you here: SysInternals' ProcessExplorer lets you see and terminate entire process trees as well as process handle information and plenty of other good stuff.