1

I'm looking at Resource Monitor in Windows 7 and wondered whether a process could be hiding in plain sight by mimicking another process. For example I've renamed an executable file as chrome.exe and when I run it it shows up as chrome.exe under the Image column, the same as Chrome itself - but the Description is different (it also contains chrome.exe).

What I want to know is can the Description column be changed to make something look like something else? Where is this Description field set from?

3

The "Description" is set the from the Title of the application assembly. I'll give you an example in vb.net:

Screenshot

It's from the "File description" property which has as "Title" in Assembly information in Visual Studio 2010.

And yes, that could be easily changed as I changed it myself right now. I'd suggest for that you use Process Explorer from Sysinternals because it has a tab which displays if the process has a "Digital Signature" from a company like this:

Screenshot

which can be helpful.

  • 1
    Quick additional note: malicious software can always change things like these. It could send false data to any process requesting the process list (such as sysinternals' process explorer, task manager, or the resource manager). There is no way to be 100% sure that what you are looking at is right, if you suspect to have been compromised and the malware may have had admin or system permissions. – Luc Jan 5 '14 at 2:34
  • 1
    I'm not sure what's your point here, yes, exploits exist, malware that can hide themselves from even listing in there, but, on patched systems there isn't much possibility to do that, and even if you accomplish that, remember, messing with the windows kernel raises AV's detection. I don't disagree with you, we're never 100% safes with computers, i was just confirming your point? – SomeNickName Jan 5 '14 at 2:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.