Tag Info

New answers tagged

1

Yes, at least a bootkit can do this, and now it cames out that its easy, John Loucaides and Andrew Furtaki just showed it with there bootkit Lighteater. They have given a speech on CanSecWest. Title how the speech was: 'How many million BIOSes would you like to infect?'. The only way to get rid of it is to flash your motherboard. Even the change of your ...


44

Yes. There are a number of ways: Directly patch Task Manager's process at runtime so that its enumeration code skips over your process. Run "processless", by loading a DLL into a process (e.g. via AppInit_DLLs) or injecting code into process memory and starting a thread (via VirtualAllocEx / WriteProcessMemory / CreateRemoteThread). Hook the Process32First ...


4

Certainly - there are several ways of hiding from the task manager. The simplest is to hide in plain sight with the process named something innocuous. Another option is to hide as a sub-process which then doesn't show up. It could also install as a service, again with an innocent name. It would show in the list of services but wouldn't be shown separately ...


0

I am neither prone to conspiracy theories nor particularly fearful of the NSA. However, I believe that the last three months have demonstrated that previous answers to this question were naive. Rootkits on computer controllers and/or BIOS/EFI boot code either already are or are about to become common. The most recent ...



Top 50 recent answers are included