📎 AI Summary:
The thread discusses whether malware can inject malicious DLLs into legitimate Windows processes without creating additional processes, enabling it to perform malicious activities independently. The original poster asks for clarification on this possibility, while a respondent suggests that viruses can inject code into existing executables, potentially running stealthily within legitimate processes. Another contributor emphasizes that malware can be highly invasive and recommends using antivirus and anti-malware tools to prevent and detect infections. Overall, the discussion highlights concerns about sophisticated malware behaviors and the importance of security measures.
P

Prenum

New Member
Member details
Joined
Nov 27, 2009
Messages
4
Thread Author #1
(This pertains to windows 7)

As title really, is it possible for a threat loaded from something like a web page or something else, to inject malicious dll's into existing legitimate windows processes ? And when i say existing processes i mean the processes and type of stuff that most people always have running in the background like: csrss, explorer, lsass, lsm, services, sidebar, smss, svchost, taskhost, wininit, winlogon, wmiprvse etc etc. And then for that threat to be totally self sufficient, eg it is able to do what ever malicious actions it wants to, like keylogging or web redirection, or denial of access to the system or whatever, just solely buy using the dll''s it has injected into the legitimate processes, and not have to rely on any extra secondary none legitimate process ? (eg it can go about it's business without relying on a extra process that needs to be created via something like a startup entry in windows.) Or is it the case that all viruses, trojans etc always need a stand alone process running in the background in order to execute their actions/monitor the system ?

Cheers.
 

Last edited:
Solution
patcooke
There's virtually nothing that they can't infest - that's how they work. And they don't need any permissions or external support to do their thing, they just get on with it. That's why you need antivirus software running to try and block anything from getting in to start with and also regular runs of something like malwarebytes to sweep up anything which manages to get past your first line defenses.
Sort by date Sort by votes
A

alberto

New Member
Member details
Joined
May 31, 2012
Messages
248
#2
I'm no security expert here, but I am reasonably sure viruses can inject code into existing exe files and thus basically you'd be running the virus along with any program you're starting. I am not sure but I think I remember something like this happening to me a few years back.
I am not claiming to be an expert, so please correct me if I'm wrong!
 
Upvote 0 Downvote
patcooke

patcooke

Microsoft MVP
Microsoft MVP
Member details
Joined
May 16, 2010
Messages
5,688
#3
There's virtually nothing that they can't infest - that's how they work. And they don't need any permissions or external support to do their thing, they just get on with it. That's why you need antivirus software running to try and block anything from getting in to start with and also regular runs of something like malwarebytes to sweep up anything which manages to get past your first line defenses.
 
Last edited:
Upvote 1 Downvote
Solution
You must log in or register to reply here.