hiding exectables using ADS (Alternate data streams)
Posted
by Dr Deo
on Stack Overflow
See other posts from Stack Overflow
or by Dr Deo
Published on 2010-03-30T18:28:12Z
Indexed on
2010/03/30
18:43 UTC
Read the original article
Hit count: 350
i hear that NTFS alternate data streams can be used to hide running executabes.
eg
supporse i have an exe called hiddenProgram.exe on windows xp,using cmd.exe
or system(char*)
calls in c,
type hiddenProgram.exe > c:\windows\system32\svchost.exe:hiddenProgram.exe
start c:\windows\system32\svchost.exe:hiddenProgram.exe
starts svchost and at the same time hiddenProgram.exe
but hiddenProgam.exe is not displayed in windows task manager!!
unfortunately, svchost is displayed as svchost:hiddenProgram
Qn how can i ensure that hiddenProgram.exe is hidden totally in task manager.
© Stack Overflow or respective owner