An easy-to-use library for emulating memory dumps. Useful for malware analysis (config extraction, unpacking) and dynamic analysis in general (sandboxing).

Kernel-Mode Driver that loads a dll into every new created process that loads kernel32.dll module

This is a virus removal (protection) tool for a virus commonly known as "Dulla virus" and several weeks later by A/V vendors Win32.Agent.cb. Motivation of the work: even though this PE infector is very dangerous and was stealthily spreading fast, the major A/V companies failed to respond to this threat. Hence, needed to make own removal and prot…