I guess everyone here knows those commercially available stealth PC monitoring software.

I'm surprised that those trojans are hardly detected by virus scanners.

All surveillance makers recommend in their FAQs one should add their program to the virus scanner's exception list. After some quick tests in various virtual machines, I was surprised that this is not necessary in most cases. Even the Avast pre-boot scan didn't find the virus.

11 / 60 virus total's scanners recognized the trojan. It was a free, public trial version! No modifications! All 11 hits were "generic". One of those malware programmers offers all surveillance methods you can think of, but not keylogger. To avoid Antivirus detection.

What's the easiest way to find these malware?

Malwarebytes, for example, says they had proprietary methods that were better than the other scanners, but at least in the affected, running Windows, they didn't find more of those viruses.

  • 1
    You'll generally have to write your own spyware if you want it to go undetected (and 11 out of 60 is a really bad score for malware, meaning it's not very stealthy at all). "Commercial spyware" is usually either a scam or horribly overpriced. – forest Jun 8 '18 at 6:34
  • 2
    @forest I think OP is asking the opposite question - these programs are freely available, so why isn't the hit rate 100%? – Someone Somewhere Jun 8 '18 at 9:03
  • Primarily because it is detected using heuristics, which each vendor may implement differently. But even for well-known malware, the hit rate is unlikely to ever be 100%. AV is crappy in general. – forest Jun 8 '18 at 9:09
  • 1
    The problem is that they are not malware but PUPs (potentially unwanted programs). You, if you are not expecting them, might consider them malware, but their functions may be no different from any number of remote admin programs. That's the problem. – schroeder Jun 9 '18 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.