Can a rat be hidden from the running process list?

I heard a rsps was ratted that had i downloaded before. I ran malware bytes, rootkit detector, and nod32 antivirus and they havent detected anything. I am looking at running processes through task manager and dont see anything unfamiliar. I also looked at the startup processes and dont see anything either.

My question is can a rat hide from those lists? And the process not even show up? I know they can fake the process name as window related.

 

Malware bytes is usually really good. RAT's usually do show on processes list, however.


http://forum.tip.it/topic/312515-rats-remote-access-tools/

Have a read of the above for more info.

 

Upon further looking i still cant find anything so im not sure if the rsps was even ratted as people say or i downloaded it before it got ratted.

 

http://www.tomshardware.com/answers/id-1731894/put-rat.html

I do not believe there is a way to hide applications from showing up on processes without using a 3rd party program (I.E. Hocus Pocus)

If you're afraid of having a RAT on your PC i would suggest doing a system restore or just reformatting to be safe.

Some RATs will not be detected by common Antiviruses like malware bytes... You'd need someone who knows what they're looking for to go through your OTL (similar to HiJackThis) logs

Btw, change your passwords from a safe computer or a mobile phone. If you're ratted they have your passwords already.

 

Most of this is true, but you don't have to be a wizzkid to surpass a virusscan, anti-malware program or a firewall. It's also not that hard to keep it out of the procces list if you have the methods/software for it. Most amateurs don't know shit about this though so checking proces list thorough should detect it easily. Just don't download random stuff only from verified companies etc and re-install your windows atleast once a year imo.

 

a RAT can be hidden from process list. all it has to do is, with the aid of a rootkit such as HxDef, merge it's PID with the PID of a commonly running process i.e explorer.exe)

Altough antivirus software detect the vast majority of viruses/root kit /etc. what they won't detect is the new variations of a virus. it will take some time before these virus are caught too.

The same way principle applies in sport's drug test, the test will only detect the already known drugs, whereas it won't detect a new "branch" of the same drug.

I don't know if i'm being clear. hope that helped!