Hide Process from Task Manager

Question

I'm doing a GameGuard for a game, but do not want people to be able to close it. I would like to make it disappear from the task manager.

I tried using:

Me.ShowInTaskbar = False

But it did not work. Since then, I have done much research on the internet and nothing shows an example or says something about how to do this.

People think it is hacker-like to hide processes, but in my case, I'm doing this for a game GameGuard.

I want it to be gone completely from the task manager.

Answer 1

AFAIK you can't hide a process from the Task Manager, and that's a good thing. Preventing a user from seeing and ending an active process is plain and simply wrong. Can you imagine being an administrator and yet not being able to end a process on your machine? :)

As for the ShowInTaskBar property, it only determines if the form is visible as a Taskbar button or not. Not related to Task Manager in any way.

ANSWER TO YOUR COMMENT BELOW:

If you are using Winforms then in your form's Closing event there's a CloseReason property that can inform you about the app being closed from the Task Manager. Unfortunately, you will find out that it ain't 100% reliable.

Answer 2

This is an overly asked question in here by a lot of people and the solution varies in terms of complexity of implementation to the necessity of such requirement. Here are your possible solutions:

• DLL Injection + DLL Hooking in Task Manager and hook APIs that deals with Enumeration of Process. There are a lot of questions and answers around here regarding these topics so before posting another new question go read it first.

• DKOM (Direct Kernel Object Manipulation) which requires you to write a legacy WDM driver and alter the EPROCESS of such process in question. I have exentensively explained it over here IRP_MJ_DEVICE_CONTROL to hide a process?

• Use SSDT which doesn't work outside the box on x64 and is not generic enough to remain working after updates as indexes changes from version to version and from one service pack to another. So I personally do not recommend the last one.