We can spoof processes, rename malware to svchost, but what about faking file location?

It’s a pretty well-known trick that a malware can name itself svchost and be disguised among the dozens of legit svchosts. However, the solution is to right click on a process -> Open file location, and if the svchost isn’t in System32, then it’s likely a problem. My question is if the open file location will always lead to the truth. Would it be possible for a malicious “svchost” that’s NOT located in System32 open that System32 folder (instead of where the malware actually is) when clicked on open file location?

submitted by /u/MysteriousShadow__
[link] [comments]

July 30, 2023
Read More >>

Houston ISD parents attend community meetings

In our continuing coverage of the state takeover of Houston ISD, and changes coming to the district, the new superintendent concluded his community meetings to answer questions parents may have ahead of the school 2023-24 school year. FOX 26’s Sherman …

July 30, 2023
Read More >>