If the malware is simply keying off the names of executables, for instance, the user could simply rename the tools. It’s a game I can’t win so I leave it to the ingenuity of the user to figure out a workaround. The fact that any small unique attribute is all that’s needed is the reason I haven’t bothered implementing mechanisms aimed at preventing identification. For example, it can use the hash of the software’s executables, look for specific text in the executable images, or scan process memory for keywords.

Malware can use numerous techniques to identify software that it wants to disable. Process Monitor had the same behavior and at this point he became convinced the malware was responsible. Resulted in a brief flash of the Process Explorer UI followed by the termination of the Process Explorer process, however. The user, familiar with Sysinternals, tried following the malware cleaning recipe I presented in my They also hadn’t spotted anything in Task Manager. (MSE) scan, but the scan would never complete. The friend, already suspecting that malware might be the cause, had tried to run a This case began when the user’s friend asked if he’d take a look at his computer, which had begun taking an unusually long times to boot and logon. More and more often, malware authors target antivirus products and Sysinternals utilities in an effort to maintain their grip on a conquered system. , this post describes one submitted to me by a user that took a unique approach to cleaning an infection when faced with the apparent inability to run ) as a lead up to the publication on March 15 of my novel First published on TechNet on Mar 06, 2011Ĭontinuing the theme of focusing on malware-related cases (last week I posted

Sysinternals suite by ms