Hiding a directory through the FAT table

Posted by hennobal on Super User See other posts from Super User or by hennobal
Published on 2012-10-13T13:04:11Z Indexed on 2012/10/13 15:43 UTC
Read the original article Hit count: 200

Filed under:

filesystems

|

malware

|

fat

I've looked into the FAT file system, trying to find a way to make a directory hidden from view of the user.

This has been done with malware previously, so it should be possible. The SpyEye trojan hid inside a directory C:\cleansweep.exe\ which was only reachable through the command line.

I know deletion is possible by substituting the first character of the directory in the FAT table with 0xE5, but then it will not be accessible. Any ideas on how the scenario from SpyEye can be recreated? Any filesystem is interesting, but ideally FAT or NTFS.

© Super User or respective owner

Related posts about filesystems

Question regarding filesystems true or false?

as seen on Super User - Search for 'Super User'
Hello all, though I'm familiar with stackoverflow , and loving it , i've actually got a couple of questions myself about something other then programming. Here are my question Is it true that in FAT filesystems the maximum number of files per filesystem equals the number of entries in the FAT table… >>> More
Filesystems for webserver with SATA and Solid State disk,

as seen on Server Fault - Search for 'Server Fault'
We have just ordered a new webserver with 120 Gb solid state disk and a SATA disk. I am trying to plan ahead what sort of filesystem to use. This system will be running Linux, Apache/Tomcat to host java services. The main service is a system where people can upload reasonably large files (in the… >>> More
To see virtual filesystems in Ubuntu

as seen on Super User - Search for 'Super User'
How can you see the virtual filesystems at root? They should be /proc and /dev. >>> More
How do filesystems handle concurrent read/write?

as seen on Stack Overflow - Search for 'Stack Overflow'
User A asks the system to read file foo and at the same time user B wants to save his or her data onto the same file. How is this situation handled on the filesystem level? >>> More
Strange ZFS hidden filesystem problem

as seen on Server Fault - Search for 'Server Fault'
Half of my ZFS filesystems are hidden in ZFS-fuse. Here's my story: So, I love ZFS. I used it for about six months on FreeBSD, but due to it crashing the kernel during heavy inter-filesystem IO load, I tried switching to Solaris 5.10. That was good, but when I attempted to do an import of my Version… >>> More

Related posts about malware

Open dns still detects malware activity after having scanned and removed malware

as seen on Super User - Search for 'Super User'
I'm using open dns to block unwanted sites. Everytime I go to the dashboard I always see this malware activity in all of the networks that I have in open dns. What do I do?I'm using avast free, spybot, and sas. And used them all to full scan the system. And they have removed the malware. But I still… >>> More
HTG Explains: Do Non-Windows Platforms Like Mac, Android, iOS, and Linux Get Viruses?

as seen on How to geek - Search for 'How to geek'
Viruses and other types of malware seem largely confined to Windows in the real world. Even on a Windows 8 PC, you can still get infected with malware. But how vulnerable are other operating systems to malware? When we say “viruses,” we’re actually talking about malware in general… >>> More
How to Use An Antivirus Boot Disc or USB Drive to Ensure Your Computer is Clean

as seen on How to geek - Search for 'How to geek'
If your computer is infected with malware, running an antivirus within Windows may not be enough to remove it. If your computer has a rootkit, the malware may be able to hide itself from your antivirus software. This is where bootable antivirus solutions come in. They can clean malware from outside… >>> More
Not All “Viruses” Are Viruses: 10 Malware Terms Explained

as seen on How to geek - Search for 'How to geek'
Most people seem to call every type of malware a “virus”, but that isn’t technically accurate. You’ve probably heard of many more terms beyond virus: malware, worm, Trojan, rootkit, keylogger, spyware, and more. But what do all these terms mean? These terms aren’t just… >>> More
Keep Malware Off Your PC With Sandboxie

as seen on Internet.com - Search for 'Internet.com'
Malware can infect your PC from anywhere on the Web. Sandboxie, a free application, blocks it. >>> More