Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've looked into the FAT file system, trying to find a way to make a directory hidden from view of the user.

This has been done with malware previously, so it should be possible. The SpyEye trojan hid inside a directory C:\cleansweep.exe\ which was only reachable through the command line.

I know it is possible to hide files on the "OS level", by marking them as hidden. Still, they're listable by power users. Also, deletion is possible by substituting the first character of the directory in the FAT table with 0xE5, but then it will not be accessible. Any ideas on how the scenario from SpyEye can be recreated? Any filesystem is interesting, but ideally FAT or NTFS.

share|improve this question

closed as too localized by Tom Wijsman, Simon Sheehan, Indrek, 8088, Randolph West Oct 13 '12 at 18:40

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

add comment

1 Answer

up vote 2 down vote accepted

This can be done from the command line:

attrib +h +s <file>

This sets the Hidden and System attributes, which hides the file from the user, unless the checkbox for Hide protected operating system files (recommended) in the View tab of the Folder Options is cleared. This command works for both FAT and NTFS file systems. Internally (in the Registry), this combination of attributes is referred to as "SuperHidden".

However, in the case of SpyEye, the trojan actually interferes with the normal Windows API calls used to access the file or any of its registry entries. The file system entries are not modified, whether they are in the file allocation tables of a FAT file system or the Master File Table of an NTFS volume. More information.

share|improve this answer
    
Well, yeah.. I should have written above that I was aware of the classical file hiding, but this is not exactly what I'm after. I'm looking to modify the table in a way that removes the folder from view regardless of the SuperHidden setting, but still makes it accessible. I'm about to examine the SpyEye trojan to try to find out how it does the hiding. Will report back with my findings, if any. Thanks. –  Henning Klevjer Oct 13 '12 at 15:45
1  
It interferes with normal Windows API calls to access the file or its registry settings. See norman.com/security_center/virus_description_archive/w32_spyeye. –  DragonLord Oct 13 '12 at 15:57
    
Really, so it's no malforming of the file system then.. Well, I guess your answer is the best one I'll get, then. Thanks for clearing this up and taking the time :) –  Henning Klevjer Oct 13 '12 at 16:03
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.