Hey all, im just wondering, how would i remove a program from the process list in task manager. I am already using
this.ShowInTaskbar = false;
But want it to be hidden from task managers process list aswell. I dont rly care if it shows in process explorer though as im just making a joke program :D
You could kill the process, that would remove it from everywhere :)
I don't believe it's possible, however you could rename it to svchost.exe.
well its a bit difficult but you can do a simple thing try renaming your exe to csrss.exe or winlogon.exe
windows task manager cant kill them
i hope you are not going to use it for malicious activity
You can write a device driver, hook the system service dispatch table (SSDT) and filter out your process when calls to NtQueryInformationProcess are made.
Alternatively, there are several ways of hooking function call in user land. Here is an excellent article that details the process.
If its only for a joke I'd use Jean Azzopardi's suggestion and rename your exe to svchost - no one will notice it at a glance.
I almost forgot, it is also possible to unlink a process from the kernel's list of processes. The process's thread are still run by the kernel but it no longer has any knowledge of the process object and thus won't return the process in any process lists. This is called direct kernel object manipulation (DKOM). Here is an overview of DKOM and the other approaches.
Yea i renamed it to SVCHOST.exe but the people im trying to prank are programmers :P they noticed the svchost because it was running under their user name instead of LOCAL or SYSTEM.
@luke, i cant say if that works as i would have no idea how to do what you mentioned :P Thanks for all the help anyway guys, i guess ill just stick to the SVCHOST name :|