Does anyone know of a good resource on how AV software go about performing a memory scan ? I would like to find out how they enumerate all running processes and whether kernel objects are scanned ? ;D
I’d say the focus of most AVs (well, I probably shouldn’t speak for other products, but it is the case of avast!) is scanning files.
After all, when the malware is in memory, it’s already too late…
Anyway, you could use KillSwitch (Comodo) to scan all the process in memory on demand.