> On Thursday 16 Oct 2003 16:45 pm, Jochem van Dieten wrote:
>>Mark W. Breneman wrote:
>>
>>>True it probably would show in the task or process lists, but if I were
>>>to write a worm/Trojan, I would make it show up in the task list as
>>>SVCHOST.exe, the generic name of a DLL process.
>>
>>1. You know how many of those you have on your server.
>>2. tlist will show the application names behind svchost.exe
>
> If I was writing a worm/Trojan, I'd have it patch the relavent system calls
> and therefore hide from the Tasklist.
No account, not even LocalSystem, should have permission to patch
core OS files.
Jochem
[Todays Threads] [This Message] [Subscription] [Fast Unsubscribe] [User Settings]
