When I was trying to crack some certification software, I've noticed it is querying from VirtualBox and other string literals in WMI service. I suppose its not too difficult to spoof that, though I am sure there is certain feature detection techniques virus could use too.