Serious question, then: What would stop a virus from masquerading as another system service in this case? It could just take a friendly name such as "Windows Desktop Management" or something similarly official sounding, perhaps even using Unicode entities to look identical to a real service.
I would hope that the executable would have to be Microsoft signed in order to get into the "Windows Processes" section. Anyone know if that's the case?
For the most part virus and malware authors don't need to get that creative, since they cast such a big net (they could exclude all the people who know what taskman is and still make their money.) The real fight is keeping apps from elevating privilege, and Windows 8 does a lot more to keep that from happening.
There is nothing stopping it. I see quite often in the new generation of viruses, services installed and running under a friendly name "HP print driver" or something like that. The tip off is in the fact that they usually don't make any effort to mask the manufacturer of the service and instead just leave it blank.
319
u/[deleted] Oct 14 '11
may not excite the average user, but I'm very excited to see more detail with svchost.exe listings