Re: Playing with Viruses on windows

In-Reply-To: <4118E1F7.3020902@ac-rouen.fr>

> I would like to now if anyone knows good tools to play with w32 viruses.
> The idea would be to run it in a sandbox and trace all action the virus
> try to do and can say 'yes' or 'no'.
> Something like 'The program try to write XXX in the registry, are you
> agree ?', 'It open a socket, is it ok ?', 'it tries to open this file
> with W access'.
> I can do something quite similar with VMWARE and Kerio but I would like
> to have something with more information (like a (x)trace on Unix) and
> more interactive.

Well, I'd go w/ the VMWare option to begin with, making a snapshot of the 
target platform once you've got it set up.  From there, I'd add tools like 
RegMon and FileMon to trace system activity while the system is being infected. 
 Bindview's RAZOR team has an strace for NT utility you might want to look 
at...though I don't know how applicable it is under XP and 2K3.  I'd throw 
SysInternal's Process Explorer 8.41 in there along with TDIMon, as well.  

Hhhmm...I'd say that SysInternals has a pretty impressive suite of tools for 
monitoring activity on a Win32 system.

Hope that helps...