Malware checks Win32_Fan WMI class to detect CPU fan presence and avoid running in virtual machines.
Windows WMI reads SMBIOS type 27 (Cooling Device) for fan info and also requires SMBIOS type 28 (Temperature Probe) defined.
Xen needs a patch to override types 27 and 28 and requires prepending 32-bit size headers in smbios_firmware files.
QEMU/KVM supports custom SMBIOS via the -smbios option without size headers and can use the host’s DMI data directly.
Get notified when new stories are published for "🇺🇸 Hacker News English"