> Is Norton 2005 hooking system call table
to filter windows register table as well ?
You may investigate this yourself by setting breakpoint to ntdll!NtCreateFile
and going through until you reach nt!NtCreateFile. This can be easily done using
Soft-ICE, it should be easily done using WinDbg too.
L.