[exelist] Re: Time to detect ProcDump...

["G-RoM" <g-rom@...>]

Hi,

Time to detect ProcDump ? Well I encountered many tricks against ProcDump
already. However they are transparent to end-user (see Neolite Erase loader
objects infos trick for example). Detecting the tracer is not new, PEshield,
PEcrypt32, PElockNT already did it. Those tools states clearly in their docs
that they have several anticode for ProcDump. The lack of support for them
is however rather a lack of time than something else. ProcDump tracers are
not designed  to fight with ADT, they only have workaround as stated Lorian.
May be a real tracer will come later ;).

Best regards,
G-RoM
"If it runs, it can be defeated."


------------------------------------------------------------------------
eGroup home: http://www.eGroups.com/group/exelist
Free Web-based e-mail groups by eGroups.com