Hey @marg.
While I do agree with what @Cowpipe has said, this may be a False Positive like @Malware suggested above. I will try to explain best I can at why it may have detected it injecting etc, and doing things similar to Malware activity (hooking etc,.. injections,...) because you are not a developer, especially in Security software or in a Avast team and may not understand if I go into coding and explain it (so I'll stay text based this time
).
While I do agree with what @Cowpipe has said, this may be a False Positive like @Malware suggested above. I will try to explain best I can at why it may have detected it injecting etc, and doing things similar to Malware activity (hooking etc,.. injections,...) because you are not a developer, especially in Security software or in a Avast team and may not understand if I go into coding and explain it (so I'll stay text based this time
).Anti-virus/Anti-Malware products will use techniques such as code/injection, API hooking and other things like TerminateProcess(), pskill() etc to actually stop malware/viruses. Yes, those techniques may be used by malware/viruses themself, but to stop them you must also know how they are built, how they work, and be able to do the same things to stop them.
The injections to e.g. the browser could actually be done to prevent adware from doing browser redirections (extension/software based controlling), or to protect the users homepage from being tampered with. On the other hand, very bad Antivirus and is done incorrectly, it can cause the browser to crash (as in close or freeze) or leave things damaged. Then, with saying that, if it is also a bad antivirus and has very unethical ways of working, it could use that to a advantage to carry out malicious behaviour, not to stop threats but to be one. Like @Cowpipe suggested, about PUP software etc. It could use it's advantages to TAMPER the browser homepage or do URL redirection.
Another example of code injection could be to stop a process from using TerminateProcess() which is used to stop all threads etc and I/O etc and close a process (remove it from memory). Malware can use that as a advantage point to attack Anti-virus software, and with that close services etc, or the system files in general.
^ With that, they could do API hooking to detect this. The functions to allow this can be found in kernel32.dll and some others. I won't go further with accessing the functions and entry points to do this all.
The injections to e.g. the browser could actually be done to prevent adware from doing browser redirections (extension/software based controlling), or to protect the users homepage from being tampered with. On the other hand, very bad Antivirus and is done incorrectly, it can cause the browser to crash (as in close or freeze) or leave things damaged. Then, with saying that, if it is also a bad antivirus and has very unethical ways of working, it could use that to a advantage to carry out malicious behaviour, not to stop threats but to be one. Like @Cowpipe suggested, about PUP software etc. It could use it's advantages to TAMPER the browser homepage or do URL redirection.
Another example of code injection could be to stop a process from using TerminateProcess() which is used to stop all threads etc and I/O etc and close a process (remove it from memory). Malware can use that as a advantage point to attack Anti-virus software, and with that close services etc, or the system files in general.
^ With that, they could do API hooking to detect this. The functions to allow this can be found in kernel32.dll and some others. I won't go further with accessing the functions and entry points to do this all.
