3 ms·

> the boot sector was completely unchanged perhaps it installs "blue pill."

• miles 17y ago
  perhaps it installs "blue pill." Blue Pill doesn't run under Intel Celeron, older Pentium Dual-Core, or Pentium M processors (which lack the necessary VT technology), so if such a payload were included, it wouldn't load on my test system. For those who want to test it, here are some ideas on blocking and detecting Blue Pill-like infections: http://northsecuritylabs.blogspot.com/2008/06/catching-blue-pill.html http://northsecuritylabs.blogspot.com/2008/06/catching-blue-... More information: http://en.wikipedia.org/wiki/Blue_Pill_(malware) http://en.wikipedia.org/wiki/Blue_Pill_(malware) http://en.wikipedia.org/wiki/Intel_VT http://en.wikipedia.org/wiki/Intel_VT
  • asciilifeform 17y ago
    It is conceivable that a Blue Pill-like rootkit could be implemented purely in software, in a manner similar to the pre-hypervisor VMWare.
    • miles 17y ago
      It is conceivable that a Blue Pill-like rootkit could be implemented purely in software My only concern was searching for persistent infections.