Pi1otguy
En-Route
At my job I'm the lowly local tech they call on after tech support in India and a guy in Canada can't resolve a problem remotely. Anyway, I get quite a few requests from corporate to reformat a computer they believe is infected with a virus/malware/etc because the logs show the AV failed to delete or clean an infected file in the near past.
Often, the next log event is a successful removal of the offending file. But it must still be reimaged due to concerns over viruses that may run Windows under a virtual machine and become undetectable as they do their damage. Basically the "Blue Pill".
So I guess I'm asking:
1. Are a lot of newer virus using the "blue pill" method?
2. Are virtual machines that undetectable? I've seen one viruses try this, but the inability to access the hard drive and performance issues was a dead giveaway.
3. How do virus/malware install on non-admin users? I've seen one incompletely install itself but was missing typical registry entries.
Often, the next log event is a successful removal of the offending file. But it must still be reimaged due to concerns over viruses that may run Windows under a virtual machine and become undetectable as they do their damage. Basically the "Blue Pill".
So I guess I'm asking:
1. Are a lot of newer virus using the "blue pill" method?
2. Are virtual machines that undetectable? I've seen one viruses try this, but the inability to access the hard drive and performance issues was a dead giveaway.
3. How do virus/malware install on non-admin users? I've seen one incompletely install itself but was missing typical registry entries.
