A novel malware for subversion of self-protection in anti-virus

Byungho Min, Vijay Varadharajan*

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

7 Citations (Scopus)


Major anti-virus solutions have introduced a feature known as 'self-protection' so that malware (and even users) cannot modify or disable the core functionality of their products. In this paper, we have investigated 12 anti-virus products from four vendors (AVG, Avira, McAfee and Symantec) and have discovered that they have certain security weaknesses that can be exploited by malware. We have then designed a novel malware, which makes use of the weaknesses in anti-virus software and embeds itself to become a part of the vulnerable anti-virus solution. It subverts the self-protection features of several anti-virus software solutions. This malware integrated anti-virus enjoys several advantages such as longevity (anti-virus is active while the system is running), improved stealthy behaviour, highest privilege and capability to bypass security measures. Then we propose an effective defence against such malware. We have also implemented the defensive measure and evaluated its effectiveness. Finally, we show how the proposed defence can be applied to the current versions of vulnerable anti-virus solutions without requiring signficant modifications.

Original languageEnglish
Pages (from-to)361-379
Number of pages19
JournalSoftware - Practice and Experience
Issue number3
Publication statusPublished - 1 Mar 2016


  • anti-virus
  • malware
  • security
  • self-protection
  • vulnerability


Dive into the research topics of 'A novel malware for subversion of self-protection in anti-virus'. Together they form a unique fingerprint.

Cite this