Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was just wondering if it was possible for malware to hide itself in this way.

share|improve this question

closed as too broad by Ƭᴇcʜιᴇ007, gronostaj, Mokubai, Breakthrough, Dave M Jul 31 '13 at 15:55

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Related: superuser.com/questions/268232/… –  Ƭᴇcʜιᴇ007 Jul 28 '13 at 2:30
1  

1 Answer 1

Yes, it is possible for malware to hide itself from view to the OS itself, via a number of mechanisms, including filtering the output from the API calls that show processes in Task Manager.

This class of malware is usually called a rootkit, and is designed primarily to allow an adversary to keep access to a system long-term (called an advanced persistent threat, or APT) by hiding their actions and allowing the adversary to recover access if (partially) discovered. They act as a platform for further attacks on the system like installing keyloggers, spyware, sabotaging system software, or whatever else tickles the attackers fancy.

Rootkits must operate at a very low level in the OS architecture in order to do what they do, so malignant drivers and maliciously patched kernel libraries are generally involved in the better ones.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.