[UMFRAGE] Welches Antivirenprogramm

Avenger77

hxxp://www.wilderssecurity.com/attachments/hmpa-version-comparison-png.246705/
--> Ist der Unterscheid zwischen den beiden Versionen.

Im wesentlichen also Schutz vor Ransomware-Viren, Abmilderung von hardwarebasierten Schwachstellen in der Software-Programmierung und Schutz gegen process unmapping.

Das folgende erklärt Hollow processes und process unmapping.
Wenn es gegen das CopyRight verstösst, nehme ich es auch gerne wieder raus!

Quelle ist der Developer von HMP.A auf wilderssecurity.com:

"In computer programming, code injection generally means that an attacker introduces its own code into a running legitimate application to alter the course of code execution, not intended by the software vendor. Typically, code injection also happens during an exploit attack, where only small parts of a running application is altered to gain control over the computer for arbitrary code execution.

Even though it seems similar, a hollow process involves code _unmapping_ of an application's process. The attacker starts a legitimate application but immediately after it was loaded in memory, the entire code of the legitimate process is unmapped and the attacker maps his malicious program in its place. After this, the legitimate process is now running a totally different program. In the Windows Task Manager the process is visible under the initially started application (process name) - with all the properties of the legitimate application - but the running contents are completely different. Not on disk, only in memory. So the legitimate process serves solely as a container to run hostile code. And to be able to do this the attacker already has a foothold on the computer.
This technique is often used by Remote Access Trojans (RAT) to hide itself for the user and many antivirus products."