Hello everybody,
I was studying about the PsSetCreateProcessNotifyRoutineEx.
The notification routine has a creationstatus parameter to block the creation of the process for which the notification has come.
What are the scenarios in which it is useful? Why would one want to stop creation of a process from the notification routine?
thank you.
-Tushar
This is something that an anti-virus driver would use. For instance, it
could do a virus scan of the executable for the process the user wants to
create and find that it has a virus in it, so it would want to fail the
create process call. Previous to Windows Vista anti-viruses would
accomplish this by patching the system call tables to intercept process
creations and fail them. In Vista patching the system call tables directly
is not kosher anymore, so this routine was added to provide a way to
accomplish the same thing.
wrote in message news:xxxxx@ntdev…
> I was studying about the PsSetCreateProcessNotifyRoutineEx.
> The notification routine has a creationstatus parameter to block the
> creation of the process for which the notification has come.
>
> What are the scenarios in which it is useful? Why would one want to stop
> creation of a process from the notification routine?