E

E-mail Filtering

code for testing the Lotus Notes Client Extension, 242

code for testing the Outlook Client Extension, 232

EXCHEXT.H skeletal file, 216

installing a Lotus Notes client filter, 241–242

installing an Outlook client filter, 231

Lotus files, 233

Lotus Notes, 232–241

LotusExtension.c file code, 235–239

LotusExtension.c implementation file, 232, 234–239

LotusExtension.def file code, 240

LotusExtension.def implementation file, 233, 240

LotusExtension.h file code, 234

LotusExtension.h implementation file, 232, 234

LotusExtension.mak file code, 240

LotusExtension.mak implementation file, 233, 240

Microsoft Outlook, 215–231

OutlookExtension.cpp file code, 219–230

OutlookExtension.cpp implementation file, 216, 218–231

OutlookExtension.dsp skeletal file, 216

OutlookExtension.dsw skeletal file, 216

OutlookExtension.h file code, 216–218

OutlookExtension.h implementation file, 216, 218

readme.txt file code, 241

Readme.txt implementation file, 233

Readme.txt skeletal file, 216

Stdafx.cpp skeletal file, 216

Stdafx.h skeletal file, 216

summary, 242

testing the Lotus Notes client extension, 242

testing the Outlook client extension, 231–232

End User License Agreements (EULAs), overview, 244–245

EndOfInjectedCode, function, 66–78

environment variables, modifying, 23

Etw (Event Tracing for Windows), functional group, 40

EtwEnableTrace, routine, 40

EtwGetTraceEnableFlags, routine, 40

EtwGetTraceEnableLevel, routine, 40

EtwTraceEvent, routine, 40

EULAs (End User License Agreements), overview, 244–245

Event History, control category, 257

Event operations, Zw routine, 41

Event Status, control category, 257

Event Tracing for Windows (Etw), functional group, 41

example

Communication, 120–133

File Filtering, 141–166

Kernel Hooks, 33–38

Key Logging, 171–185

Rootkit Controller, 258–273

testing the Key Logging, 185

ExchEntryPoint, function, 216, 218–231

EXCHEXT.H, E-mail filtering skeletal file, 216

ExInterlockedInsertTailList, function, 170

ExInterlockedRemoveHeadList, function, 170