> It has been some time since I worked with this, but I do remember a project
where we had to filter image loading; virus scanning. When we registered the
load image callback routine, we saw that the executable would already be
running sometimes when we got the callback. Having said that, we were forced
to hook the create section and map view of section routines in order to
ensure that we were able to perform a scan of the image prior to execution.Have the semantics of this callback changed over versions and service packs?
Max?
I remember this project, but IIRC hooking was used to support the older OS
versions (NT4?) where there was no image load notify routine.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com