RE: (pacsec bonus) Re: VMWare Detection?

["M. Shirk" <shirkdog_linux () hotmail com>]

It would be upsetting if the next ScanOfTheMonth had a binary with this 
capability. No one could get the malware to execute because it would 
shutdown after detecting the VMWare environment. :-)

Shirkdog
http://www.shirkdog.us

-----Original Message-----
From: Christopher.Croad () rl af mil [mailto:Christopher.Croad () rl af mil]
Sent: Friday, November 19, 2004 9:20 AM
To: honeypots () securityfocus com
Subject: RE: (pacsec bonus) Re: VMWare Detection?
Importance: Low


A little off the honeypot topic, but wouldn't the bigger problem with
VMWare detection be to those of us doing Malware analysis?  I almost
exclusively use a laptop system with multiple VMWare Guests running to
analyze a suspect piece of Malware.  I have found some workarounds to VMWare
detections (i.e the code looks for VMWare tools, so delete it...it looks for
Mac Addresses, so change them), but I don't know how to address the
detection given in this thread.

Is my nice, compact, portable (not to mention powerhouse) analysis
laptop/lab about to be replaced by desks full of actual computers to do
analysis? Ugh!

Chris