Why is it that when malware or adware is installed it's extremely difficult to remove? You can't go into your programs list to uninstall it and usually need a special program to remove it. What do the makers of the malware do to make it so difficult to remove?
-
1The reason you can easily uninstall any legitimate program from the control panel is because the kind people who wrote the program also programmed the uninstaller that knows where all the parts that needs to be removed are. Simply not providing an uninstaller (why would a malware writer do that?) goes a long way, hiding files in obscure locations and other kinds of obfuscation also helps.– AndersFeb 5, 2016 at 20:10
Add a comment
|
4 Answers
Malware is not made to be easy to remove. That's the point. You should not even be able to tell that your computer was infected.
The malware authors employs several techniques to make their software almost impossible to remove: encrypted code, multi-part software, self-healing components, and rootkit behavior.
If you could just go to programs' list and remove them, they would not profit. Hiding it as much as they can, they can keep profiting on your computer.
answered Feb 5, 2016 at 19:48
-
1That's the why. I believe the crux of this question is the how. Feb 5, 2016 at 20:28
There's no requirement in the Windows operating system to properly register all the components that the program is going to install, or to provide a means to uninstall. Largely this is a "gentleman's agreement", which is in the interests of legitimate software companies to follow, and they generally do.
Malware authors have no interest, (and no requirement from the OS) to do this. Essentially if the malware can get executed, it can run roughshod on your Windows install and install itself however it likes, and certainly wouldn't create a way to get rid of it.
This is partially because of legacy reasons where Microsoft has only recently included standards for installing software in the OS (MSI files). Until then, it was, (and I believe still is) common for installation to take place via a vendor crafted executable. The executable is allowed to write wherever the user has access to write to. Malicious executables obviously can take advantage of this.
answered Feb 5, 2016 at 20:52
Malware isn't installed as a "program" like a game or a web browser. Malware can replace an existing program that gets executed when the computer is booted, so you'd never see anything was wrong, or hides in RAM, or many other options.
answered Feb 5, 2016 at 19:44
That depends a lot on which privileges the malware has on your PC. Since the initial malware was started as a process on your computer, it will run with the privileges of the respective account - if you are logged in as administrator, it will run with admin privileges. If not, it might still escalate to get those. And usually the first thing malware does after compromising your PC is downloading more malware which stays there.
And then, the sky is the limit. You can integrate the malware into the operating system just like any other program and - even better - hide it in another benign program, or disguise it as a system service. The most sneaky malware just installs a bootkit which compromises your boot sector so even when you uninstall your OS and reinstall a new one, you will still be infected.
