4 ms·
> Tell me how the virus manages to stay out of Sysinternals Autoruns, and I will panic with you. There's a whole category of malware that does just that: https
by thirsteh 13y ago
> Tell me how the virus manages to stay out of Sysinternals Autoruns, and I will panic with you.
There's a whole category of malware that does just that: https://en.wikipedia.org/wiki/Rootkit https://en.wikipedia.org/wiki/Rootkit
The most common (and basic) way is to run as a child process inside svchost.exe.
> Otherwise, no antivirus is really necessary.
You don't care what happens in all the time that elapses from you're infected with something until you realize you are, if you realize it?
- Shorel 13y agoThe Sysinternals Autoruns utility shows a full set of things that run at startup, it is not just the start menu and some 'run' reg keys. It shows all services with their signature, all device drivers with their signature, etc. It validates the signatures too. I'm sure I only run signed services and drivers. Also, there's a rootkit detector Sysinternals utility. The page you linked describes how Mark Russinovich one of the writers of the Sysinternals utilities, discovered the Sony Rootkit. > You don't care what happens in all the time that elapses from you're infected with something until you realize you are, if you realize it? Of course I do, that's why I have the Sysinternals utilities at hand.
- thirsteh 13y agoI think you're missing my point. You don't care what happens from the point you get affected until you find it in whatever utility--be it 5 seconds, 10 minutes, or 3 days? No matter how vigilantly you stare at procexp, you're not going to stop it from running.