1

If I have malicious software running, and I can see it in the Task Manager, is an AV program expected to scan the processes running and test if they are a virus/malware?

Or, does AV have to:

  1. Detect the program on starting to see if it is a virus. In other words, a program is dormant, not running, no disk scan has been done by AV. The program starts AV detects it.

  2. Scan it on disk.

  3. (Original question) Can AV scan the currently running processes and detect which is a virus? Is that the same as scanning the memory?

Example, if software on a computer is sending out requests to "bad" sites, and I can see it with something like TCPView, should AV see that without scanning the entire disk to find it?

5

AV's wont continously scan for running processes as it is an expensive operation. It is better to use WMI for process launch notifications.

As far as in-memory detection is concerned, AVs usually hook most of the system APIs and determine the process beahviour to flag if its malicious. As far detecting sending out requests to bad sites is concerned, that depends on your AV, if it identifies it as malicious url, it will block the request but may not kill the process(unless its a known malicious process in which case it will be detected beforehand).

For example: If your file downloads another file into a temp directory and executes it, it is considered(flagged) as malicious. (You can create an exe which will download putty.exe and run it from temp and upload it on Virustotal). When AV is analyzing it , it will find API calls for downloading (WinHttpReadData) and launching process (CreateProcess). AVs create an api chain to determine if the file downloaded is the file being executed and if the process is launched from Temp directory.

Basically, there are many ways of detecting in-memory malicious behaviour.

2

This all depends on the AV implementation. Some software that broadly falls under the umbrella of anti-virus scans active memory. For some AV this ability is optional and set in the configs. Additionally, some AV is capable of checking certain properties of network traffic for malicious activity. These capabilities are fairly standard for software claiming to be "Next-Gen AV" but are hit-or-miss for traditional AV. Ask your vendor for details on your particular software.

  • I was told none of them can find currently running viruses. That it had to be scanned on disk or caught at execution. I thought programs like Sophos, Kaspsersky, etc., scanned open processes. Also, can you tell me if that is the same thing as scanning the memory? – johnny Feb 27 at 17:47
  • 1
    @johnny as I said, for information on a specific vendor please ask them (I don't work for any of the AV companies). But as a technology Anti-Virus software may have the capability to monitor running process in many ways including; scanning the active memory to detect signatures in the now "unpacked" state, looking for malicious activity such as attempts to access the memory of other processes, reaching out to malicious domains, making registry changes etc. etc. – DarkMatter Feb 27 at 17:51
  • Do you know of one that scans running processes? I'm not asking for a product recommendation. I am only trying to learn. – johnny Feb 27 at 17:52
  • 1
    @johnny at malware bytes blog they talk some about scanning active memory. blog.malwarebytes.com/cybercrime/2014/03/memory-scan – DarkMatter Feb 27 at 17:55
  • @johnny this is looking like an exercise in Google: google.com/search?q=av+scanning+processes+in+memory – schroeder Feb 27 at 19:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.