Eli5: How do unwanted programs prevent themselves from being uninstalled?
In: 8
I can think of a couple ways. Achieving a higher control level over the system (as in, gaining admin/root/kernel privileges). Or trickery like copying itself in many locations to evade detection and keep running unnoticed. Even linking itself to the boot process in such a way the OS doesn’t even know it’s there.
1.) They do not provide an uninstaller program.
2.) They replicate instances of themselves in areas of the operating system that make it difficult for the end user to spot/terminate.
3.) Even with application of anti-virus and anti-malware, some malware is persistent enough to reinstall after a total operating system restore even on a new hard disk. It can re-install itself from firmware on the motherboard.
4.) Some malware immediately uses exploits to give itself SYSTEM level access in Windows environments which is the highest authority in the land. When it does this, its impossible to terminate processes created by this malware unless you can find, take ownership and then terminate each instance.
Historically desktop operating systems relied entirely on cooperation from applications to install themselves in the proper places and uninstall themselves cleanly. Applications could just ignore requests to uninstall, and install themselves in system directories where they would be hard to find.
Over time, operating systems have gotten better about distrusting software like this, but there are still plenty of places for applications to stash instructions that the OS will follow that ensures the application comes back if it’s removed. These could include things like OS kernel extensions or drivers, or just a small startup script written to the right place.
More sophisticated malware may write these instructions to places hard to find, like the firmware of a device. Even more sophisticated malware can even deceive the operating system into not seeing its files. So you might browse your hard drive, but you’re seeing a filtered view of your hard drive rendering the malware invisible. You can’t remove something that you can’t see.
It’s basically a cat and mouse game, as devices and defenses get more complex, malware authors are finding increasingly clever ways of getting around those defenses.
Latest Answers