Thread: preventing suspend

Originally Posted by maxorator

Many debuggers have built-in antiantidebuggers, so it doesn't usually need experienced people to get bypassed...

Well that would just be a lack of cleverness.

Here is a link to a botnet tracking white paper. About halfway down the paper is a link to some source code examples illustrating how botnets detect the presence of a debugger.