dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
share rss forum feed


Blackbird
Built for Speed
Premium
join:2005-01-14
Fort Wayne, IN
kudos:3
Reviews:
·Frontier Communi..

1 recommendation

reply to Name Game

Re: Can YOU Crack The Gauss Uber-Virus Encryption?

said by Name Game:

..."Both CrySys and Kaspersky sniff out Gauss by looking for a custom-built font, dubbed "Palida Narrow," that the malware adds to infected machines.

CrySys first posted a detection tool that relied on the Palida Narrow strategy; Kaspersky took the same approach, but simplified it by inserting an IFRAME element into a Web page. The IFRAME uses JavaScript to check for the presence of the font."

Puzzling. Why would a piece of malware go to such lengths of encryption and avoidance of certain specific AVs, but at the same time install a readily-detectable font (Palida Narrow) that immediately can betray its presence to any AV or the user? Although placing the font on an infected system probably makes the malware's presence more readily detectable remotely at infected websites run by the malware authors, it undercuts part of the point of the encryption. Something still doesn't seem to quite match up...
--
"Is life so dear, or peace so sweet, as to be purchased at the price of chains and slavery? Forbid it, Almighty God!" -- P.Henry, 1775