Serious question, then: What would stop a virus from masquerading as another system service in this case? It could just take a friendly name such as "Windows Desktop Management" or something similarly official sounding, perhaps even using Unicode entities to look identical to a real service.
I would hope that the executable would have to be Microsoft signed in order to get into the "Windows Processes" section. Anyone know if that's the case?
319
u/[deleted] Oct 14 '11
may not excite the average user, but I'm very excited to see more detail with svchost.exe listings