Is there a possibility for a skilled programmer to make an undetectable non viral trojan? infecting one system at a time, meaning that it'll never have it's signature be known by anti-malware makers, thus bypassing all security programs?

I have windows 10 and KIS 2017, i share my USB key very often, and i have some doubts.

  • All you need to do is Google "Antivirus evasion techniques" and you'll have your answer :) – DKNUCKLES Apr 29 '17 at 21:48

Yes, and it doesn't even require much skill.

I tried this once. As a purely academic exercise with no intention to make any use of it, I wrote the most simple trojan imaginable in C++: Simply launch a new background process which opens a TCP server socket and forwards everything that comes in to system. I did not even try to obfuscate what it was doing in any way. This is all pretty basic stuff which I would expect any junior programmer to cobble together in a few hours, even if they haven't done anything like that before. To be fair, this would not have been that dangerous, because it didn't try to survive a system reboot, it wouldn't have worked on most consumer networks because it would have required port forwarding if behind NAT and it wouldn't have worked on a properly hardened server because the port would have been blocked by a firewall, but I wanted to keep things as simple as possible

Then I submitted it to VirusTotal. I assumed it would get a heuristic hit from most AV engines.

To my surprise, only two engines got a hit, and both mistook it for some known malware which weren't even trojans (in other words, false positives). Virus scanners are very good at catching known malware samples by their signatures, but when it comes to detecting unknown malware, they are extremely unreliable (despite what their marketing claims). The reason for this is that it is actually very difficult to write a program which can determine what an arbitrary other program will do when executed without actually executing it.

That means you can not assume that a malware scanner will protect you from any malware until it reached the labs of the developer.

  • Now this is terrorising, i i guess it's time to format everything . – Vlad Uskar Apr 30 '17 at 12:55
  • @VladUskar When this answered your question, please accept it by clicking the checkmark-icon next to it. – Philipp May 7 '17 at 2:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.