文件和进程隐藏与检测

This article is the continue of the previously posted article HideDriver. Initially the first article was an experiment and the result of it exceeded all my expectations. I want to thank all readers who left comments and wrote emails, your opinions were really important for me! I hope that we will continue working together. Like the first article this one doesn't pretend to be full and original. The main purpose of it is to represent the complicated info in some more popular way. The method of hiding described in the previous article is very simple and widely known. Now I pretend to describe the method of detection of such hidden files and processes in simple and easy to understand way. This method is accompanied by the code developed to illustrate the words. I plan to develop this topic by describing more complicated methods of hiding and detection in the new articles. I want to make each of the methods described as clear as possible - so if you have some questions or something is hard to understand then contact me and I'll update the corresponding article with the additional info. There are a lot of code fragments in this article because I believe that it's better to see once than to hear for 100 times.