you can also include: InstallRite to monitor
file/registry changes, tools from sysinternals.com,
binary string tools (BinText,BiTes), and dont forget
to download some unpackers, coz mostly of viruses
today are packed/compressed w/ modified headers. for
this you can use some generic unpacker tools or winhex
to dump program in memory, pe rebuilder may also help.
for advance virus analysis, use debuggers (ollydbg,
idapro, s-ice) to check every detail of the virus.
ofcourse dont forget to isolate your testing
machine/network.. =)
-CyCl0ne
--- Ismael Briones <ismak@inkatel.com> wrote:
Dou you know InCtrl5?
http://www.pcmag.com/article2/0,1759,25214,00.asp
http://www.pcmag.com/article2/0,4149,9882,00.asp
Castigliola, Angelo wrote:
VMWare is a really good idea. Filemon and Regmon is
a must along with your favorite packet sniffer.
Angelo Castigliola III
Operations Technical Analyst I
UnumProvident IT Services
207.575.3820
-----Original Message-----
From: Altheide, Cory B. (IARC)
[mailto:AltheideC@nv.doe.gov]
Sent: Tuesday, August 10, 2004 3:14 PM
To: 'Cedric Foll'; focus-virus@securityfocus.com
Subject: RE: Playing with Viruses on windows
-----Original Message-----
From: Cedric Foll [mailto:cedric.foll@ac-rouen.fr]
Sent: Tuesday, August 10, 2004 7:56 AM
To: focus-virus@securityfocus.com
Subject: Playing with Viruses on windows
Hi,
I would like to now if anyone knows good tools to
play with
w32 viruses. The idea would be to run it in a
sandbox and
trace all action the virus try to do and can say
'yes' or
'no'. Something like 'The program try to write XXX
in the
registry, are you agree ?', 'It open a socket, is
it ok ?',
'it tries to open this file with W access'. I can
do
something quite similar with VMWARE and Kerio but
I would
like to have something with more information (like
a (x)trace
on Unix) and more interactive.
Regards.
--
Cedric Foll
Ingénieur réseaux et sécurité
Rectorat de Rouen
http://home.t-online.de/home/Ollydbg/
-- Cory
________________________________________________________________________
Yahoo! Messenger - Communicate instantly..."Ping"
your friends today! Download Messenger Now
http://uk.messenger.yahoo.com/download/index.html
