[Dex37]

Hi everyone,
Malware is just another file on a computer, and it needs a place to hide and store itself. Some common places are %appdata%, %temp%, Local, Roaming, etc.
But are there other, less commonly used locations that are also suitable for malware storage?
Actually, the path where the malware is stored on a system is important for its success, or it can be stored anywhere as long as it is somewhat hidden?
And is a good practice store the malware on shell:startup so it runs every time the user turns on the computer?

[DramaKing]

Technically, malware can hide pretty much anywhere, though the type of malware may matter, like DLLs. Just don't specify the path to the Startup folder as shell:startup.

[Novo]

Many places, DLLs, Scheduled Tasks, Registry Keys, Filesystem, the question is, where can it not hide?

[Tha Sneak]

I feel like this question has more of a blackhat sense to it than a whitehat sense, but this is a HackForum. I'm not gonna tell you every single registry key malware can hide, but I'll give you some if you're more specific.

[JosProud]

The answer to where malware can hide is in those locations where the user running it has write permissions.
You can get a quick view of these locations using AccessChk from Sysinternals.
Idea: What if we block execution in these directories with AppLocker?

[SpiffyGraffiti]

some malware like to hide in the startup folder. Always check for hidden folders. The startup folder will make the malware run when the computer is started.

Good luck removing the malware.

[Viskow]

It can be hidden anywhere, but especially in files that you won't necessarily think to look at.

[Phantom-Phreak]

Whenever I am manually checking for malware I usually just look for places that would help with it's persistence. Some areas I would check: Auto Run Registry subkeys for both machine and user keys, and services set to automatic, task manager automatic tasks, etc.