hiding exectables using ADS (Alternate data streams)
- by Dr Deo
i hear that NTFS alternate data streams can be used to hide running executabes.
eg
supporse i have an exe called hiddenProgram.exe on windows xp,using cmd.exe or system(char*) calls in c,
type hiddenProgram.exe > c:\windows\system32\svchost.exe:hiddenProgram.exe
start c:\windows\system32\svchost.exe:hiddenProgram.exe
starts svchost and at the same time hiddenProgram.exe
but hiddenProgam.exe is not displayed in windows task manager!!
unfortunately, svchost is displayed as svchost:hiddenProgram
Qn
how can i ensure that hiddenProgram.exe is hidden totally in task manager.