Can unwanted software(like spyware) already present detect the user trying to install an antivirus software and go into hiding?

Question

Just wondering to make sure I completely clean up my device.

Answer 1

Yes, malware/spyware can indeed detect antivirus software and perform defensive mechanisms. This is a never-ending ‘arms race’ on how and where they hide code.

Fortunately, once a system is compromised there is no 100% accuracy on getting back to a clean slate without wiping the system back to a known good state.

In my enterprise environment, once we have any concerns, we blow the computer's data away and rebuild...

Best of luck!

Answer 2

It's conceivable, but it's more likely the malware will take steps to deactivate or otherwise sabotage the AV. Or, more typically, that the AV won't know how to completely remove one or more parts of the installed malware, leaving stealthy backdoors behind that will reinstall/update the software and/or install other malware.

You can't really be confident you've ever ‘cleaned up’ your machine following a compromise. Given how ineffective most AV software is, it's less and less likely. As they say: nuke it from orbit—wipe the drive, reinstall the OS—it's the only way to be sure.

Answer 3

It is absolutely not only possible that malware can play keepaway games with AV software and other cleaners, but in the malware arms race, such techniques have been a key component of the black hats' arsenal for many years now.

You don't have to search very hard to find near-infinite examples of complaints that take the form, "I cleaned my Windows PC yesterday with ______. It removed a virus, and the re-scan afterwards said my computer was totally clean. But I ran another scan today, and it says it the same virus came back again!"

While it's not impossible that some malware detects AV activity and responds by attempting to protect itself, that very response can often be detected by the AV software as malicious activity, and actually give away the malware to the AV system. So, if techniques like that are out in the wild, I suspect they're not employed by particularly advanced malware.

Typically, from what I've seen, the really advanced, actively malignant infections will employ one of two techniques, both of which bobince mentioned in their answer:

1. The malware will attempt to sabotage the AV system's protection so it won't even be monitoring for the malware it's supposed to be protecting you from.

   There's a reason every worthwhile AV suite has a system tray status icon that actively signals its protection status, and there's a reason my policy for every machine I'm responsible for was that the AV status icon must always be set permanently visible, so that Windows would never hide it in the "overflow" area of the tray. If I'm ever using one of those Windows systems and that icon isn't present and showing "protected" status, I can pretty much assume that it's probably already infected.

2. The malware's primary infection will make itself readily visible to the AV system, doing absolutely nothing to disguise itself or to interfere with removal. It will go quietly and without protest the moment it's discovered.

   The reason some malware infections are so readily cleaned up, sometimes even going so far as to be listed in and uninstallable from the Programs & Features control panel just like any other application software, is because that part of the infection is just a façade. It's a sacrificial lamb, intended to be captured and "easily" cleaned up so that your AV software will give a big, green "No Infections Found!" seal of approval after removing it.

   Meanwhile, the real infection is lurking somewhere deep in the system, in a location protected from the AV scanner, even. The next time the computer is restarted (which is one of the last recommended steps in most malware-removal processes), the "easily-removed" malware will be reinstalled again by the time the OS even gets as far as the login screen.

It's possible to clean out these "hidden" infections, of course, for someone who's pretty savvy about both the OS internals and the techniques used by malware authors. But even then it can take quite a lot of time-consuming forensic examination of the running process table, the loaded drivers and DLLs, the system folders, the Windows registry, and even things like the Recovery environment or the System Restore contents, in worst-case scenarios.

Honestly, every time I've undertaken that kind of manual cleanup, even when I was successful it took far too much time and effort to justify doing, and the smart call would've just been to wipe the system and reinstall. But I've never been smart, which is probably why I've always been poor.