Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

a Process hidden from the Process Monitor [closed]

Tags:

c++

mfc

I need to create an application which will be reading and writing to files(C++/MFC). but I need the process not to appear in process monitor (which comes with SysInternals).

From the reactions of others, I now confirm that this seems "illegal". but that is the request of the client I'm dealing with. so, I guess I just have to satisfy the client's request.

like image 423
Attilah Avatar asked Nov 26 '22 21:11

Attilah


1 Answers

One of the uses of Process Monitor is to find and remove malicious software that tries to hide from the user:

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.

I am not saying that what you want to do is impossible, rather that you are trying to do something that feels a bit dishonest.

That being said I would like you to consider the fact that you are trying to hide a process from a utility that was written to find anything and everything by folks that are a lot smarter than you and me.

like image 120
Andrew Hare Avatar answered Nov 29 '22 12:11

Andrew Hare