3 ms·
perhaps it installs "blue pill." Blue Pill doesn't run under Intel Celeron, older Pentium Dual-Core, or Pentium M processors (which lack the necessary VT techn
by miles 17y ago
perhaps it installs "blue pill."
Blue Pill doesn't run under Intel Celeron, older Pentium Dual-Core, or Pentium M processors (which lack the necessary VT technology), so if such a payload were included, it wouldn't load on my test system.
For those who want to test it, here are some ideas on blocking and detecting Blue Pill-like infections:
http://northsecuritylabs.blogspot.com/2008/06/catching-blue-pill.html http://northsecuritylabs.blogspot.com/2008/06/catching-blue-...
More information:
http://en.wikipedia.org/wiki/Blue_Pill_(malware) http://en.wikipedia.org/wiki/Blue_Pill_(malware)
http://en.wikipedia.org/wiki/Intel_VT http://en.wikipedia.org/wiki/Intel_VT
- asciilifeform 17y agoIt is conceivable that a Blue Pill-like rootkit could be implemented purely in software, in a manner similar to the pre-hypervisor VMWare.
- miles 17y agoIt is conceivable that a Blue Pill-like rootkit could be implemented purely in software My only concern was searching for persistent infections.