dslreports logo
 
    All Forums Hot Topics Gallery
spc
uniqs
15

Name Game
Premium Member
join:2002-07-07
Grand Rapids, MI

Name Game to FF4m3

Premium Member

to FF4m3

Re: Can YOU Crack The Gauss Uber-Virus Encryption?

To detect Gauss on you system just go to these sites in the first link below...it is easy to dectect....and the sites will let you know immediately since...

"Both CrySys and Kaspersky sniff out Gauss by looking for a custom-built font, dubbed "Palida Narrow," that the malware adds to infected machines.

CrySys first posted a detection tool that relied on the Palida Narrow strategy; Kaspersky took the same approach, but simplified it by inserting an IFRAME element into a Web page. The IFRAME uses JavaScript to check for the presence of the font."

http://www.computerworld.com/s/article/9230170/Security_experts_push_free_Gauss_detection_tools

And for removal..Bit Defender has a good tool and there are others out there...

http://www.bitdefender.com/news/gauss-removal-tool-powered-by-bitdefender-2556.html

Blackbird
Built for Speed
Premium Member
join:2005-01-14
Fort Wayne, IN

1 recommendation

Blackbird

Premium Member

said by Name Game:

..."Both CrySys and Kaspersky sniff out Gauss by looking for a custom-built font, dubbed "Palida Narrow," that the malware adds to infected machines.

CrySys first posted a detection tool that relied on the Palida Narrow strategy; Kaspersky took the same approach, but simplified it by inserting an IFRAME element into a Web page. The IFRAME uses JavaScript to check for the presence of the font."

Puzzling. Why would a piece of malware go to such lengths of encryption and avoidance of certain specific AVs, but at the same time install a readily-detectable font (Palida Narrow) that immediately can betray its presence to any AV or the user? Although placing the font on an infected system probably makes the malware's presence more readily detectable remotely at infected websites run by the malware authors, it undercuts part of the point of the encryption. Something still doesn't seem to quite match up...