Anti-reverse engineering: The code is scrambled with a technique that we call "spaghetti jumps." It's very difficult for a researcher to analyze the complete execution flow of the malicious programs. Moreover, the executables come with random ImageBase properties, random names, random appended data, and all the text strings are encrypted with an RC4 algorithm using random encryption keys.
 
Anti-VMware and Anti-debugging: Malicious samples don't run in VMware environments and (of course) they can detect the presence of popular debuggers like Softice, WinDbg, and Ollydbg by using INT41/INT3 tricks or by checking for the presence of debugger drivers.
 
Anti-monitoring: We already knew that Linkoptimizer does not like programs like Filemon, Regmon, and Ethereal, but the new variants will not run if they detect the presence of programs like Microsoft Visual Studio, ProcessGuard, CommView, Coreforce, or DriverStudio installed on the computer.
 
Anti-anti-rootkit: Is your favorite anti-rootkit tool not starting on your computer anymore? You’re probably infected with Trojan.Linkoptimizer! In fact, the Trojan removes the "SeDebugPrivilege" from administrators and keeps an updated list of popular rootkit programs that will be terminated immediately after they are executed. In addition, it may also block access to several security-related domains in order to prevent removal tools from being downloaded.
 
Anti-removal: Linkoptimizer raised a big challenge, making the removal of its components the hard part of the antivirus job. We had first seen the Trojan hiding itself inside alternate data streams, or by using EFS (encrypted file system) on computers with NTFS partitions.      On FAT32 systems, the Trojan copies itself using reserved MS-DOS names (for example: com, lpt, prn) and sets invalid file attributes to prevent the manual deletion of its files. Finally, the last variant analyzed uses rootkit techniques to both hide itself and also to run a malicious monitoring system that constantly checks the integrity of the Trojan installation. Every single remediation action performed by the user or by an antivirus program will be reverted by the monitoring thread that implements the "counter-countermeasure".