+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: Where does malware hide on infected computers? (/showthread.php?tid=6293883)
Where does malware hide on infected computers? - Dex37 - Mar 8, 2025
Hi everyone,
Malware is just another file on a computer, and it needs a place to hide and store itself. Some common places are %appdata%, %temp%, Local, Roaming, etc.
But are there other, less commonly used locations that are also suitable for malware storage?
Actually, the path where the malware is stored on a system is important for its success, or it can be stored anywhere as long as it is somewhat hidden?
And is a good practice store the malware on shell:startup so it runs every time the user turns on the computer?
RE: Where does malware hide on infected computers? - DramaKing - Mar 8, 2025
Technically, malware can hide pretty much anywhere, though the type of malware may matter, like DLLs. Just don't specify the path to the Startup folder as shell:startup.
RE: Where does malware hide on infected computers? - Novo - Mar 8, 2025
Many places, DLLs, Scheduled Tasks, Registry Keys, Filesystem, the question is, where can it not hide?
RE: Where does malware hide on infected computers? - Tha Sneak - Mar 9, 2025
I feel like this question has more of a blackhat sense to it than a whitehat sense, but this is a HackForum. I'm not gonna tell you every single registry key malware can hide, but I'll give you some if you're more specific.
RE: Where does malware hide on infected computers? - JosProud - Mar 14, 2025
The answer to where malware can hide is in those locations where the user running it has write permissions.
You can get a quick view of these locations using AccessChk from Sysinternals.
Idea: What if we block execution in these directories with AppLocker?
RE: Where does malware hide on infected computers? - SpiffyGraffiti - Apr 12, 2025
some malware like to hide in the startup folder. Always check for hidden folders. The startup folder will make the malware run when the computer is started.
Good luck removing the malware.
RE: Where does malware hide on infected computers? - Viskow - May 14, 2025
It can be hidden anywhere, but especially in files that you won't necessarily think to look at.
RE: Where does malware hide on infected computers? - Phantom-Phreak - May 15, 2025
Whenever I am manually checking for malware I usually just look for places that would help with it's persistence. Some areas I would check: Auto Run Registry subkeys for both machine and user keys, and services set to automatic, task manager automatic tasks, etc.