Hiding using processes

- [Instructor] Some malware hides in plain sight. … Let's look at a simple piece of malware … which uses a technique called Windows Hooks, … to intercept keystrokes. … In Microsoft Windows, … when a key on the keyboard is pressed, … an event is signaled to the operating system. … Windows uses its keyboard driver … to read the character that's been pressed … and sends it as a message to the application … that's been waiting for it. … However, Windows also allows other processes … to look at the message as it passes through the system. … That's how hotkeys work. … Windows does this by using some known … as a Keyboard Hook Callback Routine. … It hooks the key that's been pressed … and then calls back after processing it … to pass it on to its original destination. … Using this technique, it only takes a few lines of code … to write a simple keystroke logger. … I've prepared a keyboard hook program … called intercept.cpp, which we can see here in WordPad. … This is a very simple program. …