I have a requirement to hide a process in Task Manager. It is for Intranet scenario. So, everything is legitimate. 🙂
Please feel free to share any code you have (preferably in C#) or any other techniques or any issues in going with this route.
Update1: Most of the users have admin privileges in order to run some legacy apps. So, one of the suggestion was to hide it in task manager. If there are other approaches to prevent users from killing the process, that would be great.
Update2: Removing the reference to rootkit. Somehow made this post look negative.
There is no supported way to accomplish this. The process list can be read at any privilege level. If you were hoping to hide a process from even Administrators, then this is doubly unsupported.
To get this to work, you would need to write a kernel mode rootkit to intercept calls to NtQuerySystemInformation so that the SystemProcessInformation info class fails to list your hidden process.
Intercepting system calls is very difficult to do safely, and the 64 bit Windows kernels go out of their way to prevent this from being possible: trying to modify the syscall table results in an instant blue screen. It’s going to be very difficult on those platforms
This Sony DRM software is an example of a rootkit that tries to do something similar (and has several serious problems).