Invisible Processes - Why?

Z

Zack Whittaker \(R2 Mentor\)

Shurrup you :blush:P you can talk! Hehe!

--
Zack Whittaker
Microsoft Beta (Windows Server R2 Beta Mentor)
» ZackNET Enterprises: www.zacknet.co.uk
» MSBlog on ResDev: http://msblog.resdev.net
» ZackNET Forum: www.zacknet.co.uk/forum
» VistaBase: www.vistabase.co.uk
» This mailing is provided "as is" with no warranties, and confers no
rights. All opinions expressed are those of myself unless stated so, and not
of my employer, best friend, mother or cat. Let's be clear on that one!


--- Original message follows ---
 
S

Steve Drake

Are you SURE it can be done?

I would love to see an example, you can sort of hide what you program is
doing by running it from rundll or svchost.

but as for HIDING a PID, I don't think this can be done, hiding from task
manager is not the same as hiding a process.

The root tool kit stuff was done by writing a device driver for the HD that
reported incorrect info back.

Steve
 
A

Adahn

Alright, now that the spam barrage has abated, we may get to the issue at
hand, but I'd rather move the discussion to the Security forums, which is
where the original post should've been in the first place :( my bad!
 
S

Steve Drake

I have been coding for years, from writing DOS app in C/C++, Win 3 apps in
C/C++, Win32 Apps in C++ and now managed code, and a little VB :)

I really don't think you can create an invisible process, you can create a
invisible program (eg no window handle), but that completely different. As I
said before, you could hide in another process, with RUNDLL.

please, someone prove me wrong, I would love to see that could that would
make this happen.

Steve
 
A

Adahn

I really don't think you can create an invisible process, you can create a
invisible program (eg no window handle), but that completely different. As
I said before, you could hide in another process, with RUNDLL.

please, someone prove me wrong, I would love to see that could that would
make this happen.
Click to expand...

Check the game mentioned in the original post.

I wouldn't have noticed it myself until it crashed to desktop for some
reason, and said that an instance was already running when I tried to
restart it :x

of course, no such instance was visible under Task Manager or tasklist, and
Process Explorer (www.sysinternals.com) couldn't even start; it just froze
up

Now, this game makes it very clear that it's not going to let you have
anything to do with it outside of the game itself heh but the real question
is, how many other apps must be doing the same, hiding not just their
processes but any network connections they might make as well..?

Please respond in the identically named thread on the
microsoft.public.windows.vista.security forums :)
 
S

Steve Drake

Just been reading up, you can write Kernel mode root kit that can hijack the
internal API that give process lists / count.

Interesting stuff :)

You can also download it root tool kit tool, this will try to findout if you
have any root kits.

Ta
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Is there a Maple story version for Vista??? 3
^^^^^^^^^^^^^^^^^^^^^^buy cheap maple story mesos^^^^^^^^^^^^^^^^^^^^^^ 1
About Maple Story 1
Is there a maple story version for vista??? 1
"The system administrator has set policies to prevent this installation." 0
WMPlayer.exe process at startup 2
secure vista business 1
Linux gaming hasn’t just improved, it’s evolved. 10

Top