ZeuS trojan won't infect low-end systems

A new version of the keylogging ZeuS trojan will not infect low-end computer systems, according to anti-virus software firm F-Secure.

The picky malware refuses to install on systems with a processor below 2GHz, not because it thinks the owners are clearly too poor to rob via online banking, but because it thinks the low speeds are part of a virus testing environment.

As part of a protection mechanism built into the malware it will terminate without infecting a computer if it believes it is being subjected to virus analysis. Part of this analysis may include slowing down computer speeds via a debugger.

An F-Secure malware analyst discovered that if less than 232 timer updates occur during a two second program pause, the trojan will think that a debugger is being run and will simply terminate in order to prevent analysts from learning too much about it.

What this means for the wider world is that any processor with a clock speed of less than 2GHz will be seen by the malware as a test environment, making that machine effectively immune to infection from this particular trojan.

To prove the theory F-Secure exposed an IBM T42 laptop with a 1.86GHz processor to the malware and it failed to become infected. Time to downgrade then.