From: "Geo" 

This is a multi-part message in MIME format.

------=_NextPart_000_0073_01C6B801.FDA00A80
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

The one I remember reading the writeup on, patched explorer to hide.

Geo.
  "Rich"  wrote in message news:44d34e36$1{at}w3.nls.net...
     Not that I can think of.  The ones I know of patch the kernel to =
intercept APIs which they then return incorrect or filtered results.

  Rich
    "Geo"  wrote in message =
news:44d2c0b8$2{at}w3.nls.net...
    Don't some of the rootkits use an API to hide themselves?

    Geo.

------=_NextPart_000_0073_01C6B801.FDA00A80
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable








The one I remember reading the
writeup=20
on, patched explorer to hide.
 
Geo.

  "Rich" <{at}> wrote in message news:44d34e36$1{at}w3.nls.net...
     Not
that I can think =
of.  The=20
  ones I know of patch the kernel to intercept APIs which they then =
return=20
  incorrect or filtered results.
   
  Rich
  

    "Geo" <georger{at}nls.net>=20">mailto:georger{at}nls.net">georger{at}nls.net>=20
    wrote in message news:44d2c0b8$2{at}w3.nls.net...
    Don't some of the rootkits use an =
API to hide=20
    themselves?
     
    Geo.
    
 

------=_NextPart_000_0073_01C6B801.FDA00A80--

--- BBBS/NT v4.01 Flag-5