Hiding from CAD - By LiFEwiRE

Just a little example to hide your w32 app. in w9x from ctrl+alt+del by registering it as a service process. Not very new but maybe usefull.

Compile with TASM & PEWRSEC.

.386p
.model flat
locals
jumps

        extrn ExitProcess:PROC;
        extrn GetCurrentProcessId:PROC;
        extrn RegisterServiceProcess:PROC;
        extrn MessageBoxA:PROC;

MB_ICONASTERISK equ 40h

;----------------------------------------------------------------------------;
_CODE segment dword use32 public 'CODE'

start:
        push MB_ICONASTERISK ;
        push offset vistitle ;Tell the user we are visible
        push offset vismsg ;
        push 0h ;
        call MessageBoxA ;

        call GetCurrentProcessId ;get the current process's ID

        push 1 ;1 = Register as SystemService
        push eax ;process ID
        call RegisterServiceProcess ;...

        push 10h ;
        push offset hiddentitle ;And tell we are hidden (from
        push offset hiddenmsg ;ctrlAltDel, you can still see
        push 0h ;us with some utils)
        call MessageBoxA ;

        Push 0
        Call ExitProcess

vistitle db "You'll see this title",0h
vismsg db "...when you press ctrl+alt+del...",0h

hiddentitle db "But you won't see this",0h
hiddenmsg db "...try it!",0h

_CODE ends
;----------------------------------------------------------------------------;

;----------------------------------------------------------------------------;
_DATA segment dword use32 public 'DATA'
fill db ?
_DATA ends
;----------------------------------------------------------------------------;

end start
end