Can a Trojan horse hide its activity from TCPView?
I've done a little research before asking, but I still can't find the answer for this.
I know that a Trojan horse can hide from the Windows Task Manager through various methods. Also, less frequently, it can hide its activity from the
netstat command (mostly replacing the program with their own version). I guess is less frequently because (I expect) any non-compromised antivirus protect and alert for changes in system files (not sure if I'm being naive).
Even though, If the Trojan uses a Windows process (not it's own name) to connect to the Internet, many times you can identify what isn't an expected connection to some random IP address.
Many websites recommend using TCPView to check for unusual connections, and I wonder if a Trojan can hide its activity from TCPView. I'm not sure if TCPView is just a graphic interface using the netstat program. In that case, if there's any method to hide from
netstat, it will be hidden from TCPView of course.
I don't think that a Trojan horse would be specifically coded to hide from TCPView (or it is TCPView so popular that this happens?), but maybe there's a method to hide its activity from any program trying to check the current Internet connections (even Wireshark) and to hide what programs or Windows processes (even
svchost or system) are establishing those connections as well.
If you know specific methods used to hide from TCPView could you mention them?
I want to know this, because I'm not sure that using TCPView or Wireshark to check for unusual connections is a bulletproof test to confirm that activity.