Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What technique is used to hide a process from Task Manager? I'm currently researching ways I can do this in C++. Is this process called hooking?


The book I am self-studying from: RootKits: Subverting the Windows Kernel

share|improve this question

closed as too broad by Xander, tylerl, Steve, Adi, Terry Chia Jan 7 '14 at 3:32

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs. If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

The rootkit replaces the legitimate call to EnumProcesses() with the address of its own implementation. Its implementation calls the original, but before it returns the list, it removes any mention of the processes it has been told to hide.

While the behavior and outcome are similar, I consider hooking to be slightly different, because it can be done legitimately. Hooking is generally done through an officially supported API, and the OS tracks all such hooks so it can undo them when the hooking process is terminated. Malware instead often directly modifies the memory without notifying the OS.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.