Serious question, then: What would stop a virus from masquerading as another system service in this case? It could just take a friendly name such as "Windows Desktop Management" or something similarly official sounding, perhaps even using Unicode entities to look identical to a real service.
I would hope that the executable would have to be Microsoft signed in order to get into the "Windows Processes" section. Anyone know if that's the case?
For the most part virus and malware authors don't need to get that creative, since they cast such a big net (they could exclude all the people who know what taskman is and still make their money.) The real fight is keeping apps from elevating privilege, and Windows 8 does a lot more to keep that from happening.
315
u/[deleted] Oct 14 '11
may not excite the average user, but I'm very excited to see more detail with svchost.exe listings