Over the years, malware virus developers and cybersecurity experts have been in an open war trying to override each other. Recently, the virus and malware development community has created a new strategy that evades detection in a very simple way: checking what resolution you have your screen set to and acting accordingly.
Running malware, viruses, or suspicious software on a virtual machine instead of on your own PC can make sense in order to develop remedies against them, or simply to check for software vulnerabilities. But now viruses and malware are able to detect whether you are in a virtual machine or on the local PC simply by checking the screen resolution.
Why Viruses and Malware Care About Your Screen Resolution
To find the main reason why virus and malware developers have made their “programs” take into account screen resolution, we have to take a look at their worst enemies: virtual machines.
Virtual machines are very useful elements for cybersecurity experts. They act like a PC inside a PC, so you can install other operating systems or test potentially dangerous software without fear of affecting your local machine. For example, if you have a Windows 10 PC but want to try Linux, you can create a Linux operating system virtual machine on your Windows 10 PC. It will act like a Linux PC, but it will show up in a mere window inside your PC with Windows.
If you have a file with a virus, it will start by infecting the virtual machine and there it will stay, since a virtual machine behaves like a PC and the virus or malware will think that it is infecting a normal local PC. As such, it will only damage and infect the virtual machine, which you can always delete completely and create another, leaving your local PC protected and safe, and that is why cybersecurity experts use them to develop countermeasures against these harmful viruses.
However, there is a flaw in this method of testing applications. When creating a virtual machine to investigate malware or viruses, the investigator is usually not interested in the additional features of the virtual machine and does not install the management software for the machine. This software enables additional functions, such as being able to change the screen resolution; If you don’t use it, the VM (Virtual Machine) normally locks the window in two possible resolutions: 800 x 600 and 1024 x 768 pixels.
These two resolutions are important to malware and virus developers, as they are so old that no local PC (not even laptops) uses them, and then the virus knows that it is not running on a local PC.
How malware do to avoid detection
Now comes the interesting thing … we have already seen that malware and viruses can detect the screen resolution to know if they are being executed on a local PC or in a virtual machine, but what is that for? If the virus operates under these conditions, it is quite likely that it is being investigated by a cyber security expert and therefore activates a self-destruct mechanism. Literally, the virus or malware does nothing and removes itself from the system, with the aim of not revealing its secrets to the investigator.
From the perspective of an investigator, the program has been executed and has not infected the computer, so it must be benign, and it will assign a “false negative” report, which allows that the malware is not later detected by antivirus and anti malware programs.
Of course, this does not mean that if you use 800 x 600 or 1024 x 768 resolutions on your PC that you are going to be safe from viruses or malware (well, this type of malware actually does), it simply means that when experts In cybersecurity they study a program to determine if it is safe or not. This tactic can create a false negative and make an infected program pass as safe, avoiding being detected by antivirus of all kinds.
The best thing you can do is, of course, have your protection system against viruses and malware always updated , since although initially these programs may give false negatives in antivirus and pass as benign programs, as soon as they realize the error they will solve it as soon as possible.