For example, if a new rootkit starts spreading and reaches a malware honeypot, any skilled security specialist could get a memory dump of the system, find the malicious code and reverse engineer it, right? So what prevents known malware from being readily neutralized once they are launched?

  • @DKNUCKLES Yes, remember Stuxnet? :) Also small hacker(groups) use it to create botnets easily.
    – O'Niel
    Jul 12, 2016 at 14:23
  • @O'Niel valid point re: Stuxnet, though that was 6 years ago now and it used something like 4(?) 0days. The botnet is interesting though, I've not heard of that - thought they went the way of the dodo bird :)
    Jul 12, 2016 at 14:32
  • 4
    Are you asking how malware protects its intellectual property (what the title sounds like) or how AV systems work on malware (what the question sounds like)? Jul 12, 2016 at 15:28

2 Answers 2


I think the easiest way to answer your question is that most malware is coded using Polymorphic Code and the majority of Anti-Virus still uses signature based detection.

The reality is that a good chunk of the population does not keep their software up-to-date which means the original attack vector could potentially be re-exploited with a different payload. A lot of people put a lot of thought and effort into prevention, however not many put it into detection so once a box has been owned there's usually an avenue to re-exploit.


Step 1, malware use code masquerade technique.

Step 2, malware creator will use scan their morphed code through local Antivirus search engine. If detected, they will repeat step 1.

It is a constant arm race.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .