Question

I saw some anti-virus software notice me that some other process was trying to modify my registry entry and ask me whether to allow it. How can this anti-virus software hang that process up and stop if from modifying my registry until I make a decision? I fail to find any API that could do such things, which is crucial for my project.

Thanks,

Feng

Answer 1

The antivirus is most likely hooking the registry functions so it’s own code gets called first before passing the requests to the real functions.

Note that doing this in anything but a few very specific circumstances can be suspicious behaviour.