Home page logo
/

pen-test logo Penetration Testing mailing list archives

Hiding scheduled tasks in 2K/XP
From: "winter" <shonky_sec () hotpop com>
Date: Mon, 2 Jun 2003 17:10:40 +1000

Hey all,

Ive found that you can use attrib.exe on files in %windir%\tasks,
particularly with the +h attribute. "Attrib.exe +h *" will hide all
scheduled tasks from AT, Scheduled Tasks (both Control Panel + explorer) and
"dir %windir%\tasks" (unless you use dir /a or have it set as such in
%dircmd%).  Browsing %windir%\tasks on the cmd line with "dir /a" is the
only way ive been able to detect jobs that have been hidden this way. They
run as scheduled. Tested on 2000 SP3 & XP SP1.

winter



---------------------------------------------------------------------------
----------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault