🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: borland.public.cppbuilder.nativeapi
Article #283

Re: hide instance in the task manager

#283
From: Mike Collins
Date: Wed, 28 May 2008 01:50
45 lines
2894 bytes
First off, I'm only saying this because EVERYONE on the Microsoft forums 
always say it to me so...

Generally hiding your application would be considered as the sort of thing 
that malware does and thus a bad practise.  There ends the lecture :-)

But in saying that, there are several hacks that are floating around that 
would allow you to hide your application.  Most are not reliable and easily 
circumvented using other process monitors.  For example, i've seen some 
systems that register themselves as a service at run-time using 
RegisterServiceProcess, but i suspect that this is not possible in Vista as 
it has totally isolated service so they run in session 0 and have not direct 
access to the user desktop.

I would say that it really depends on what you are trying to do and why.  If 
your trying to write some malware'esk application then I'll leave you to it. 
If you have a legitimate reason to hide you application, like you want to 
prevent a user from terminating or messing around with it, then you'd 
probably be better off creating a service which is better form background 
style monitoring or processing and easier to prevent users from messing 
with.

You can use lower level native API hooks and injection to hide the 
application and I have successfully done that but it's generally a bad 
practice and has a lot of additional maintainance.  If you want some 
informaiton on this, then feel free to e-mail me directly at mike (at) 
kid-safe (dot) co (dot) uk.

If you want to use a prescribed architectural feature of Windows then you 
would need to look at something like a File system driver.

HTH

Mike

"sa" <shaikakbar250281@yahoo.co.in> wrote in message 
news:483c5222@newsgroups.borland.com...
> Hello all
>
> Can anybody give me some pointers, to hide the program instance in the 
> Windows Task Manager - Application Tab.
>
> Kind Regards
> SA
> 
Technical Details
Message-ID: <483ca9b5@newsgroups.borland.com>
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!eweka.nl!lightspeed.eweka.nl!195.114.231.69.MISMATCH!feeder.news-service.com!newsfeed00.sul.t-online.de!newsfeed01.sul.t-online.de!t-online.de!newsgroups.borland.com!not-for-mail
References: <483c5222@newsgroups.borland.com>

Show Full Headers
Complete Article Headers
X-Google-Thread: 10cc67,6f34393805a07a54
X-Google-Attributes: gid10cc67,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
From: "Mike Collins" <its@TheBottomOfThePost>
Newsgroups: borland.public.cppbuilder.nativeapi
References: <483c5222@newsgroups.borland.com>
Subject: Re: hide instance in the task manager
Date: Wed, 28 May 2008 01:50:42 -0000
Lines: 47
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.3790.3959
X-RFC2646: Format=Flowed; Response
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4133
NNTP-Posting-Host: 78.148.58.161
Message-ID: <483ca9b5@newsgroups.borland.com>
X-Trace: newsgroups.borland.com 1211935157 78.148.58.161 (27 May 2008 17:39:17 -0700)
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!eweka.nl!lightspeed.eweka.nl!195.114.231.69.MISMATCH!feeder.news-service.com!newsfeed00.sul.t-online.de!newsfeed01.sul.t-online.de!t-online.de!newsgroups.borland.com!not-for-mail