Description: Although I do not know what kind icesword enumerated services, it is estimated that by the end times calendar SCM internal ServiceRecordList to detect. Why? See below. The annex InjectDLL.exe put hideservice.dll injected into Ser vices.exe process after Alerter service will be hidden swap. Detection also used icesword not Alerter service. Code principle is very simple. Services.exe is in the process of finding ServiceRecordList table Hide will need the services disconnected from the chain on. Since icesword also can not be detected. it shows icesword calendar through the end times within the SCM ServiceRecordL ist to detect
- [hookProcess] - SSDT hidden processes linked to, I make
- [Irp-Files] - IRP operation documents directly realize
- [DetectHiddenProcess] - Detect Hidden Proce
- [IceSword] - The process of hiding the source code, m
- [hidedll] - these are two functions that can be used
- [ProcesID] - This is the kernel program made in the v
File list (Check if you may need any files):
hides.txt
Download