NetMon is in even better shape than I expected. I have not had a
single crash over the course of about 8 hours. VS15 now displays a
live memory/cpu usage chart while debugging, which is very nice. It
tells me NetMon quickly ramps up to a bit less than 4MB and then stays
there, and rarely uses more than 10% cpu. Nice to know.
The trust list is now working about 99%. I still see occasional
single entries that should be hidden. This may be a race condition
on the trust list, I should guard it with a mutex.
Using NetMon casts a lot of suspicion on my old friend svchost. It
seems to be a commonly used way to obfuscate the source of outboard
network traffic. I need to be able to display the command line for the
process so I can check the pedigree on the requesting DLL.
I also need to work on displaying the captured streams. I am more
interested in the outbound data than inbound. Inbound data can be both
overwhelming and indecipherable while mostly benign. Outbound data
should be much smaller and contain the evidence of privacy violations.
I need to remember that I am looking for privacy leaks, not trying to
build a virus/malware detector.
Very strange: I want to create a popup dialog to display detailed
process information when I double-click an item in the EventList. I
added a WM_COMMAND handler that parses out the LBN_DBLCLK notification,
but EventList::ListCmdDblClk() was never called. I verified that the
Notify property for the listbox was set to TRUE. I noticed that the
resource file did not include LBS_NOTIFY in the style for the listbox,
so I manually added it. Still no callback.
So I manually set the bit when I create the window, and finally
the callback occurred. This is very strange because according to the
definition in WinUser.h, LBS_NOTIFY is normally set. ListProc is the
message handler for the child dialog containing the listbox.
