Detecting hidden process

[pmclinn]

I have a couple spyware bots I loaded on a test machine. While I was
watching the spyware infect the system I noticed that it was launching
a process but it was not listed in my task Managaer under processes. I
know the process is running because the firewall is detecting it. Does
anyone have code to list these invisble processes?

-Peter

 

[Thomas Wenning]

I have a couple spyware bots I loaded on a test machine. While I was
watching the spyware infect the system I noticed that it was launching
a process but it was not listed in my task Managaer under processes. I
know the process is running because the firewall is detecting it. Does
anyone have code to list these invisble processes?

-Peter

Hi Peter,

look here http://www.sysinternals.com/Files/ProcessExplorerNt.zip
for process or system debugging. It`s a great tool.

Greeting

Thomas Wenning

 

[Ken Tucker [MVP]]

Hi,

You can use the process class to list all running processes.
The problem with spyware is it likes to use the same name as system
processes. Here is a link to an example that gets the processes and owners.
This will help you figure out which one is spyware.

http://www.windowsformsdatagridhelp.com/default.aspx?ID=af026486-62bf-4304-9dd8-a07917f8c3e4

Ken