+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Coders Lounge (https://hackforums.net/forumdisplay.php?fid=5)
+---- Thread: hide, protect, kill process in windows task manager (/showthread.php?tid=4629376)
hide, protect, kill process in windows task manager - nikau6 - Jan 10, 2015
Hi everybody. English is not my first language so sorry for the errors I could make. Don't know too if I'm in the good rubric. My question is about windows API.
I have three questions :
1 : How to hide a process in the task manager ?
2 : How to protect a process in the task manager, as the anti-virus do ?
3 : How to kill a protected process in the task manager ?
I'm not asking you to tell me exactly how to do but to give me indices, to tell me where to start, where to search.
Thanks
* - Sakuto - Jan 11, 2015
You should probably post in the hacking section, you will get more answer.
* - nikau6 - Jan 11, 2015
Ok, I'll do that. Thanks for your answer.
* - Mr. Dr. Prof. Patrick - Jan 11, 2015
Google rootkit, read a few of the sources and you will realize that the topic is much more complicated than you thought, especially if you want anti-virus level persistence
* - nikau6 - Jan 12, 2015
Thanks. I'm going to start by simply hide a process in task manager. After a search on google, It seems that it can be done by hooking the partially unreferenced 'NtQuerySystemInformation' function.
It seems too that you can hide a process with 'PsLookupProcessByProcessId' by deleting your process struct from the linked list it retreives. Doesn't seem really hard. Going to try like that first.