views:

1976

answers:

7

Is there any way to hide a C# program from the Windows Task Manager?

EDIT: Thanks for the overwhelming response! Well I didn't intend to do something spooky. Just wanted to win a bet with my friend that I can do it without him noticing. And I'm not a geek myself to be able to write a rootkit, as someone suggested though I'd love to know how to do it.

+21  A: 

Not that I'm aware of - and there shouldn't be. The point of the task manager is to allow users to examine processes etc.

If the user should be able to do that, they should be able to find your program. If they shouldn't be poking around in Task Manager, group policy should prevent that - not your program.

Jon Skeet
fully agree. I don't see any reason why a program should achieve.
Juri
Yes, over-achieving programs are just so annoying.
Jeff Yates
They certainly are if what they're "achieving" is spamming, wiping your hard disk etc... it's perfectly reasonable to put restrictions on what programs can do.
Jon Skeet
+3  A: 

I don't know if there are solutions specific to C#. Anyway, look at this "hack": http://www.codeproject.com/KB/system/Hack_Windows_Task_Manager.aspx

Vijay Mathew
+2  A: 

You shouldn't hide it, but you could prevent the user from killing the process.

See Chris Smith's answer to this question.

Winston Smith
+10  A: 

You could make your program a service and then it would appear as "svchost". There's a little more to it than that, but that should give you a hint to go in the right direction.

samoz
+1  A: 

So you wanna write a rootkit? C# is not a way to go. Let's try ASM :D

instcode
Doesn't have to be a rootkit... Viruses and spyware might want to too :-P
samoz
+6  A: 

I'm not aware of any way to hide it from the task manager, but you could just disguise it by making it show up as "svchost.exe". It'll get lumped in with all the others (there's usually several), and will become indistinguishable.

Mike Trpcic
Not really - you can still see the path of the executable in Task Manager.
frou
@frou: Yeah, but if you just name it svchost.exe and drop it somewhere underneath c:/Windows, most people would just think it's a regular windows application.
Mike Trpcic
Blah - simply calling it svchost.exe is a messier/less-effective version of what samoz suggests :)
frou
+1 - I think this is one of the more common techniques for obfuscating malware.
Mayo
A: 

the only way its to hide your application

ahmed