(Apr 10, 2014 12:14 AM)Madara-Uchiha Wrote:  There are differnent methods ofc.
One is to loop through all processes running, and compare byte pattern, so you can identify malware by a specific bytearray/string.
The other way would to use heuristic detection methods.
Check if the file is saved in suspicous locations like AppData, it uses reflection and maybe also has a startupkey. Then you can tell with a pretty good chance that this is a keylogger/trojan whatever.

(Apr 10, 2014 03:57 AM)FFace Wrote:  Most people loop trough the process list and check if it matches one in the blacklist. Or they check process' modules to see anything sketchy.

(Apr 10, 2014 04:02 AM)Matthewbmx™ Wrote:  Do you have a code to show on how this works?

(Apr 10, 2014 04:20 AM)FFace Wrote:  I'm not in love with spoonfeeding but anyway:

This is how you kill it if it has a blacklisted process name

Code

For each proc as process in process.getprocesses
If proc.processname = "blacklisted" then proc.kill
next

This is how you kill it if it has a blacklisted modulename

Code

For each proc as process in process.getprocesses
For i as integer = 0 to proc.modules.count - 1
If modules(i).ModuleName = "blacklisted" then proc.kill
next

The code was not written in a IDE so there might be errors.

(Apr 10, 2014 04:33 AM)Matthewbmx™ Wrote:  So technically it finds a selected process name and kills it? what happens if they place a random virus name like gaegaegageieanoe.exe?