This paper provides practical information about the problems of memory scanning and
their possible solutions under Windows NT. Memory scanning is a must for all operating systems. Once
the virus is executed and active in memory it has the potential to hide itself from scanners by using
stealth techniques. Even if the virus does not use any stealth techniques, removing the virus from the
system becomes more difficult when the virus is active in memory since such a virus can infect the
already previously disinfected objects again and again.
