I heard that alternative NTFS data streams can be used to hide the execution of executable files.
e.g. supporse I have an exe called hiddenProgram.exe on windows xp using calls cmd.exeor system(char*)in c,
type hiddenProgram.exe > c:\windows\system32\svchost.exe:hiddenProgram.exe
start c:\windows\system32\svchost.exe:hiddenProgram.exe
starts svchost and at the same time hiddenProgram.exe
but hiddenProgam.exe does not appear in the Windows task manager!
Unfortunately, svchost appears as svchost: hiddenProgram
Qn
how can I guarantee that hiddenProgram.exe is completely hidden in the task manager.
source
share