I have researched IAT hooking by malware and i still have a few questions:
If the IAT of the program in memory is different to the IAT of the static program (before it has been ran) does this imply a api hook?
How are these detected i have read the question here: What are the methods to find hooked functions and APIs? but i am still confused could you please provide a basic step by step explaination?
Is there legitimate uses for api hooking other than antiviruses which could lead to false posatives in a detection tool?