hiding exectables using ADS (Alternate data streams)

Posted by Dr Deo on Stack Overflow See other posts from Stack Overflow or by Dr Deo
Published on 2010-03-30T18:28:12Z Indexed on 2010/03/30 18:43 UTC
Read the original article Hit count: 350

Filed under:
|
|
|
|

i hear that NTFS alternate data streams can be used to hide running executabes.
eg supporse i have an exe called hiddenProgram.exe on windows xp,using cmd.exe or system(char*) calls in c,

type hiddenProgram.exe > c:\windows\system32\svchost.exe:hiddenProgram.exe

start c:\windows\system32\svchost.exe:hiddenProgram.exe

starts svchost and at the same time hiddenProgram.exe
but hiddenProgam.exe is not displayed in windows task manager!! unfortunately, svchost is displayed as svchost:hiddenProgram

Qn how can i ensure that hiddenProgram.exe is hidden totally in task manager.

© Stack Overflow or respective owner

Related posts about c

    Related posts about c++