  The perpetual opposition between antiviruses and malware leads both parties
to evolve continuously. On the one hand, antiviruses put in place solutions
that are more and more sophisticated and propose more complex detection
techniques in addition to the classic signature analysis. This sophistication
leads antiviruses to leave more traces of their presence on the machine they
protect. To remain undetected as long as possible, malware can avoid executing
within such environments by hunting down the modifications left by the
antiviruses. This paper aims at determining the possibilities for malware to
detect the antiviruses and then evaluating the efficiency of these techniques
on a panel of antiviruses that are the most used nowadays. We then collect
samples showing this kind of behavior and propose to evaluate a countermeasure
that creates false artifacts, thus forcing malware to evade.
