Testing with Viruses - 2011

In many cases, the virus would not run. Sometimes a UAC prompt appeared asking for administrator access, which was denied.

In other cases, the malicious program ran with user privilege, and created files on disk, usually in %homepath%\AppData\Local or %homepath%\AppData\Roaming, e.g. C:\Users\username\AppData\Local. In many cases, an entry was created in the registry under HKEY_USERS\userid\Software\Microsoft\Windows\CurrentVersion\Run. This would allow the malware to be started when the user logged in.

In some cases, the malware performed some network activity, such as trying to contact a remote controller or update centre. One program sent itself via email to addresses found on the local disk. Many programs spawned subprocesses, and some deleted the original infected file. One spawned short-lived subprocesses that in turn spawned other processes, making them impossible to kill manually in task manager.

In all cases, the malicious software was stopped by logging off from the infected account, using ctrl-alt-delete then "log out".

Examples