I got tired of manually checking if processes were tampered with, so I built Ghost. It scans running processes and flags anything that looks like code injection. Took a few months of evenings and weekends.

What it detects:

The usual injection techniques malware uses:

RWX memory regions (shouldn't exist in normal programs)
Shellcode patterns...