Reply to thread

Message

<blockquote data-quote="Winter Soldier" data-source="post: 660903" data-attributes="member: 59377">Some malware (fileless for ex ) inject their own code into the system&#039;s process &quot;svchost.exe&quot; by deleting the main binary file, and remaining active only in memory. These malware also attempt to delete other traces of the infection by erasing event logs and other information that can show the files created and executed on the machine.The process &quot;svchost.exe&quot; containing the malicious code, executes the main function of the malware by infecting the system.If you check for the memory activity, you don&#039;t see strange processes, but only &quot;svchost.exe&quot; that is a system file, but infected in this case.That&#039;s why I say that often if you do not see malicious and strange active processes, this doesn&#039;t mean that your antivirus has fully resolved the infection and your system is really clean.I agree with you, If your AV detects the malware code, its activity and this code injection...you&#039;re fine,&nbsp; but like I said, if you just see that the sample doesn&#039;t appear in memory, it is not a good indicator that your system is clean.</blockquote>

[QUOTE="Winter Soldier, post: 660903, member: 59377"] Some malware (fileless for ex ) inject their own code into the system's process "svchost.exe" by deleting the main binary file, and remaining active only in memory. These malware also attempt to delete other traces of the infection by erasing event logs and other information that can show the files created and executed on the machine. The process "svchost.exe" containing the malicious code, executes the main function of the malware by infecting the system. If you check for the memory activity, you don't see strange processes, but only "svchost.exe" that is a system file, but infected in this case. That's why I say that often if you do not see malicious and strange active processes, this doesn't mean that your antivirus has fully resolved the infection and your system is really clean. I agree with you, If your AV detects the malware code, its activity and this code injection...you're fine, but like I said, if you just see that the sample doesn't appear in memory, it is not a good indicator that your system is clean. [/QUOTE]

Verification