How to hide the fact that a system is virtual machine from malware

Question

I've read that many types of malware scan a system for various clues regarding virtualization software, in order to stifle forensics. Is there any way to hide the fact that a computer is a virtual machine from malware?

Answer 1

You usually cannot hide anything from malware well coded. There are lots and lots of ways to detect a virtual machine, and some of them cannot be faked.

Simpler malwares may look on a few places, so maybe you could fool some, but sophisticated ones will look at lots of places, in a lot of points of the code. You could run it through a debugger and analyze the code while it runs, and maybe you could get all (or some) detection points.

I believe it's cheaper and faster to use a physical computer dedicated to it. Install OS, any applications, put dummy user files (pictures, music, movies, documents), navigate on a couple sites, and take a disk image. Run the malware, take another image, and work on this one.