[Solved] Hide all traces of a program that is running [closed]


I am no expert but I think most techniques that deals with process hiding uses CreateRemoteThread.
http://msdn.microsoft.com/en-us/library/windows/desktop/ms682437(v=vs.85).aspx

It is pretty tough to get right, but there are maaany blogs about it, eg:
http://resources.infosecinstitute.com/using-createremotethread-for-dll-injection-on-windows/

This works by picking some victim process that is already running, like say svchost.exe and add your thread into this.

Also while speaking of svchost, you can also very legally register a service and be hosted by this windows process, your clients may see the running game by calling the listing command:

 tasklist /svc /fi "imagename eq svchost.exe"

or:
http://www.howtogeek.com/80082/svchost-viewer-shows-exactly-what-each-svchost-exe-instance-is-doing/

This is a tad more hidden than directly appearing as a task, while remainging more gentle to the user than the CreateRemoteThread. Also less crash prone, and also, anti viruses usually hook CreateRemoteThread to block calls to it.

solved Hide all traces of a program that is running [closed]