Cronk
join:2005-07-16
Denver, CO
| How malware runs on a computer?
I've always been under the impression that malware, once it is on your hard drive, must be executed (ie "clicked on") in order for it to run and execute. Now I've read that there are some types that will auto-execute themselves and propagate like that.
Can anyone confirm or deny this?
Thanks |
|
R_Kilroy
Premium,MVM
join:2002-11-21
Sterling Heights, MI
| With scripting all things are possible.
The main thing is how did the malware get on the machine in the first place. For example installing the infected drive in another machine won't cause infection if it is not the boot drive.
--
How hard does DRM have to bite before business abandon it? |
|
SnowyOne
Premium
join:2003-04-05
Kailua, HI | reply to Cronk
Putting itself in the startup folder of all users will have it run every time someone logs on. |
|
rcdailey
Dragoonfly
Premium
join:2005-03-29
Rialto, CA
| »blogs.zdnet.com/security/?p=908
A few months old now, but suggests how malware could be installed as a service, which would mean it would run without user intervention and also would not appear as a startup app. |
|
TonyKlein
join:2001-07-02
Netherlands
edit:
May 9th, @05:56PM
| reply to Cronk
There is a large, and in fact increasing number of possible autostart methods or launch points
Here's some reading:
»forum.gladiator-antivirus.com/in···ic=24610
--
Tony - CLSID List |
|
Cronk
join:2005-07-16
Denver, CO
edit:
May 9th, @07:02PM
| reply to Cronk
OK thanks to all for enlightening me.
If malware has been installed in any of these autostarting locations, or as a service that runs on boot, will an antivirus that has autoprotect features detect it when it runs? (assuming of course that the A/V has a signature to identify it).
Thanks |
|
Oleg
Bellsouth Fastaccess
Premium
join:2003-12-08
Birmingham, AL | Not all Anti-Virus are good at detecting new viruses and malware. |
|
R_Kilroy
Premium,MVM
join:2002-11-21
Sterling Heights, MI
| reply to Cronk
Once your machine has been infected you can no longer trust anything. The malware can turn off your AV, change pointers so you can't see it (root kit), and much more.
--
How hard does DRM have to bite before business abandon it? |
|
Cronk
join:2005-07-16
Denver, CO
| said by R_Kilroy  :Once your machine has been infected you can no longer trust anything. The malware can turn off your AV, change pointers so you can't see it (root kit), and much more. OK thanks. But assuming the malware is not that nasty and you have gotten new signatures to recognize it, will the autoprotect of the A/V detect malware that has been installed as a service or startup item? Or do you need to run manual scans to detect it?
Thanks |
|
