Research Paper: When the hammer falls - Effects of successful widespread disinfection on malware development and direction

Research paper on the effects of MSRT on specific malware development and direction - presented at VB2008.
  • Note:There are multiple files available for this download.Once you click on the "Download" button, you will be prompted to select the files you need.


    File Name:



    Date Published:


    File Size:

    3.8 MB

    1.4 MB

      The arms race between the anti-virus industry and concerted malware developers continues to escalate. Microsoft’s Malicious Software Removal Tool (MSRT) is executed on over half a billion computers every month, giving it a huge execution base and an unparalleled view of malware operations. In their first month of targeting by MSRT, the Win32/Cutwail and Win32/Nuwar families yielded an infection spread of almost half a million distinct machines between them. MSRT’s monthly release provides a unique snapshot of the Windows ecosystem, and of the sledgehammer effect the tool has on the targeted families; an effect that can hardly be ignored by the malware’s authors. With so much money at stake, it appears that the malware developers do not go down without a fight.

      This paper couples analysis of the major malware families targeted by MSRT with the telemetry it gathers, in order to provide a perspective on how malware authors quickly respond to the massive impact on their networks after each release. Analyses of the techniques used to evade the MSRT are also presented. A look at the engineering evolution of each of these families with respect to MSRT releases is also explored.
  • Supported Operating System

    Windows 2000, Windows Vista, Windows XP

      • XPS Reader or Adobe Acrobat reader
    • Download the research paper in the file format of your choice. It is available as an XPS or PDF. In order to view the XPS document, you will need to install the reader (included in Windows Vista) or to view the PDF document, you will need to install Adobe Acrobat reader.
Site feedback

What category would you like to give web site feedback on?

Rate your level of satisfaction with this web page today: