2 ms·

Check the boot sector. If I need to spoon feed you, then you shouldn't be running code you don't understand, noob.

by zerp 17y ago

miles 17y ago
As I carefully explained, the boot sector was completely unchanged. However, I'm sure we would all deeply appreciate a link or two to your undoubtedly significant body of work on the web. The way you boldly buck mainstream orthodoxy by replacing the familiar "rootkit" with "root-kit", along with the vigorous application of name calling instead of salient facts, points to a mind unfettered by mere convention. Before tearing myself away from this enlightening discussion, a final word: having registered with this site a mere 4 hours ago, it is perhaps a tad imprudent of you to be wielding the "noob" monicker so injudiciously.
- asciilifeform 17y ago
  > the boot sector was completely unchanged perhaps it installs "blue pill."
  - miles 17y ago
    perhaps it installs "blue pill." Blue Pill doesn't run under Intel Celeron, older Pentium Dual-Core, or Pentium M processors (which lack the necessary VT technology), so if such a payload were included, it wouldn't load on my test system. For those who want to test it, here are some ideas on blocking and detecting Blue Pill-like infections: http://northsecuritylabs.blogspot.com/2008/06/catching-blue-pill.html http://northsecuritylabs.blogspot.com/2008/06/catching-blue-... More information: http://en.wikipedia.org/wiki/Blue_Pill_(malware) http://en.wikipedia.org/wiki/Blue_Pill_(malware) http://en.wikipedia.org/wiki/Intel_VT http://en.wikipedia.org/wiki/Intel_VT
    - asciilifeform 17y ago
      It is conceivable that a Blue Pill-like rootkit could be implemented purely in software, in a manner similar to the pre-hypervisor VMWare.
      - miles 17y ago
        It is conceivable that a Blue Pill-like rootkit could be implemented purely in software My only concern was searching for persistent infections.

2 ms·

Check the boot sector. If I need to spoon feed you, then you shouldn't be running code you don't understand, noob.

by zerp 17y ago

Check the boot sector. If I need to spoon feed you, then you shouldn't be running code you don't understand, noob.

miles 17y ago
As I carefully explained, the boot sector was completely unchanged. However, I'm sure we would all deeply appreciate a link or two to your undoubtedly significant body of work on the web. The way you boldly buck mainstream orthodoxy by replacing the familiar "rootkit" with "root-kit", along with the vigorous application of name calling instead of salient facts, points to a mind unfettered by mere convention. Before tearing myself away from this enlightening discussion, a final word: having registered with this site a mere 4 hours ago, it is perhaps a tad imprudent of you to be wielding the "noob" monicker so injudiciously.
- asciilifeform 17y ago
  > the boot sector was completely unchanged perhaps it installs "blue pill."
  - miles 17y ago
    perhaps it installs "blue pill." Blue Pill doesn't run under Intel Celeron, older Pentium Dual-Core, or Pentium M processors (which lack the necessary VT technology), so if such a payload were included, it wouldn't load on my test system. For those who want to test it, here are some ideas on blocking and detecting Blue Pill-like infections: http://northsecuritylabs.blogspot.com/2008/06/catching-blue-pill.html http://northsecuritylabs.blogspot.com/2008/06/catching-blue-... More information: http://en.wikipedia.org/wiki/Blue_Pill_(malware) http://en.wikipedia.org/wiki/Blue_Pill_(malware) http://en.wikipedia.org/wiki/Intel_VT http://en.wikipedia.org/wiki/Intel_VT
    - asciilifeform 17y ago
      It is conceivable that a Blue Pill-like rootkit could be implemented purely in software, in a manner similar to the pre-hypervisor VMWare.
      - miles 17y ago
        It is conceivable that a Blue Pill-like rootkit could be implemented purely in software My only concern was searching for persistent infections.