Hide exectables using ADS (alternate data streams)

I heard that alternative NTFS data streams can be used to hide the execution of executable files.
e.g. supporse I have an exe called hiddenProgram.exe on windows xp using calls cmd.exeor system(char*)in c,

type hiddenProgram.exe > c:\windows\system32\svchost.exe:hiddenProgram.exe

start c:\windows\system32\svchost.exe:hiddenProgram.exe

starts svchost and at the same time hiddenProgram.exe
but hiddenProgam.exe does not appear in the Windows task manager! Unfortunately, svchost appears as svchost: hiddenProgram

Qn how can I guarantee that hiddenProgram.exe is completely hidden in the task manager.

+3
source share
2 answers

NTFS , . , , , (ADS).

svchost hiddenProgram.exe

, , : svchost:hiddenProgram

, hiddenProgram.exe

. . . @joveha.

+2

. .

, 64- , Microsoft, Win64 .

+2

Source: https://habr.com/ru/post/1739188/


All Articles