A new approach in virus threads has been detected: viruses may not infect computers with lower clock rates than approximately 2 GHz. In a test a laptop having a 1.86 GHz processor from IBM the system has not been affected. [1, 2]

As Heise.de [1] reported the virus code in assembler has been analyzed. The virus processes a pause of two seconds: if the timer has been updated for less than 2^32 times the virus suggests to quit itself.

The reason for that is not a performance-intensive code or the problem with slow bots. The reason for that possible viruses are analyzed by virus scanners. If a virus scanner analyzes a virus it runs it in debug mode. Debug mode, like in programming, is far slower because of more information given to the OS. If the virus seems to be analyzed it rather wants to not infect that system to preserve it’s own surviving. So these viruses can be potentially far more dangerous – if you have an up-to-date system running.

According to F-Secure the risk to be infected is not zero if you have less than 2 GHz clock rate – the risks is just decreasing with any clock rate more under 2 GHz. [3] It is still not clear whether the code is meant not to work on 2- GHz systems or it was a developers “fault” due to “fuzzy” coding.

[1] http://www.heise.de/newsticker/meldung/Trojaner-verschmaeht-lahme-Rechner-Update-1142162.html
[2] http://www.f-secure.com/de/web/home_de/home
[3] http://www.f-secure.com/weblog/archives/00002067.html