Malware Root Hunter

---
name: malware-root-hunter
description: Deep malware, spyware, and persistence hunting
---
# Malware & Spyware Root Hunter Protocol

This skill enables agents and sub-agents to perform deep security scans on Windows environments to discover hidden malware, monitoring software (spyware), rootkits, and persistence mechanisms, and eradicate them down to their root causes.

---

## 1. Activation Mandate (ط´ط±ط· ط§ظ„طھظپط¹ظٹظ„ ط§ظ„ط­طµط±ظٹ)

> [!IMPORTANT]
> **Activation Requirement**: This skill MUST be activated **ONLY** when the user's prompt explicitly includes the command `hunt-malware` or `/hunt-malware`.
> If the command is absent, do NOT activate deep scanning or remediation.

---

## 2. The Mandatory Confirmation Gate (ط¨ظˆط§ط¨ط© ط§ظ„طھط£ظƒظٹط¯ ط§ظ„ط¥ظ„ط²ط§ظ…ظٹط©)

> [!CAUTION]


### Scan & Eradication Lifecycle:
1. **Phase 1: Deep Scan (ظپط­طµ ط´ط§ظ…ظ„)**:
   - Run `deep_malware_scanner.py` to inspect:
     - Registry persistence keys (`Run`, `RunOnce`, `Winlogon`, `Image File Execution Options`).
     - Suspicious scheduled tasks (`schtasks`).
     - Abnormal background processes & network listeners (`Get-NetTCPConnection`).
     - Windows Defender threat log (`Get-MpThreat`).
2. **Phase 2: Findings Report & Warning (ط¹ط±ط¶ ط§ظ„طھظ‚ط±ظٹط± ظˆط§ظ„طھظ†ط¨ظٹظ‡)**:
   - Present a clear, structured list of all detected suspicious items, their file paths, and why they are flagged.
   - Explicitly ask the user:
     > *"طھظ… ط±طµط¯ ط§ظ„ط¹ظ†ط§طµط± ط§ظ„ظ…ط´ط¨ظˆظ‡ط© ط£ط¹ظ„ط§ظ‡. ظ‡ظ„ طھط±ط؛ط¨ ظپظٹ ط§ظ‚طھظ„ط§ط¹ظ‡ط§ ظˆط­ط°ظپظ‡ط§ ط¨ط§ظ„ظƒط§ظ…ظ„طں ط£ط±ط³ظ„ 'ظ†ظپط°' ط£ظˆ 'confirm' ظ„ظ„ظ…طھط§ط¨ط¹ط©."*
3. **Phase 3: Root Eradication (ط§ظ„ط§ظ‚طھظ„ط§ط¹ ط§ظ„ط¬ط°ط±ظٹ - ط¨ط¹ط¯ ط§ظ„طھط£ظƒظٹط¯ ظپظ‚ط·)**:
   - Terminate active malicious processes by PID.
   - Remove registry persistence entries.
   - Delete malicious scheduled tasks.
   - Delete the malicious files permanently from disk.
   - Trigger Windows Defender quick remediation: `Remove-MpThreat`.

---

## 3. Deep Scanner Script

Execute the scanner script to generate a structured JSON findings report:

```powershell
python "C:\Users\goldl\.gemini\config\skills\malware-root-hunter\scripts\deep_malware_scanner.py"
```

The script automatically collects:
- All Run/RunOnce registry values for `HKCU` and `HKLM`.
- Non-standard scheduled tasks.
- Unsigned or suspicious executables running from `%TEMP%` or `%APPDATA%`.
- Active listening ports.

---

## 4. User Account & Session Security (ط­ظ…ط§ظٹط© ط­ط³ط§ط¨ ط§ظ„ظ…ط³طھط®ط¯ظ… ظˆط­ط¸ط± ط§ظ„ظ…طھط·ظپظ„ظٹظ†)

> [!IMPORTANT]
> **Strict Self-Preservation**: The current active user (e.g. `goldl`) is **IMMUNE** from being deleted or modified.
> If an unauthorized local user account or active remote session is detected, the agent warns the user and requires explicit confirmation (`ظ†ظپط°`) before removing the unauthorized account.

Execute the account auditor script:
```powershell
python "C:\Users\goldl\.gemini\config\skills\malware-root-hunter\scripts\audit_user_accounts.py" --action audit
```

---

## 5. References

- [Windows Persistence Locations](file:///C:/Users/goldl/.gemini/config/skills/malware-root-hunter/references/windows_persistence_locations.md): Detailed registry keys and startup directories abused by malware.
- [Threat Eradication Protocol](file:///C:/Users/goldl/.gemini/config/skills/malware-root-hunter/references/threat_eradication_protocol.md): Step-by-step procedures for safely removing threats without destabilizing Windows.
- [User Account freedom Guide](file:///C:/Users/goldl/.gemini/config/skills/malware-root-hunter/references/user_account_freedom.md): Account classification, current user immunity, and safe removal of unauthorized accounts.