As far as I know, driver is used to be an interface between OS and hardware.
Both Duqu and Stuxnet use a kernel driver to decrypt and load certain encrypted files on the infected computer. The kernel driver serves as an "injection engine" for loading the files into a specific process, according to SecureWorks. "The kernel drivers for both Stuxnet and Duqu use many similar techniques for encryption and stealth, such as a rootkit for hiding files," the security vendor said in its report.
2-I read the article in wikipedia for DLL injection and it makes no sense, May someone tell me about it?What is difference between DLL injection and process injection?
Bookmarks