> Nope, you have to distinguish between a sandbox (code is run) to an AV
> scanner scanning code in a VM, when the av scanner scans the code, the
> code is not executed and cannot decide whether it is inside a VM =)
Wrong. This would be true only if the AV didn't have the parsing bug in
the firs...
> scanner scanning code in a VM, when the av scanner scans the code, the
> code is not executed and cannot decide whether it is inside a VM =)
Wrong. This would be true only if the AV didn't have the parsing bug in
the firs...
[ more ]