Re[2]: Playing with Viruses on windows

Might try CoreRestore, a hardware solution, rather than VMware. Runs about 
$150US.

Their PR says,

Now, recovering from unauthorized or unintentional operating system or 
application changes is as quick and simple as a reboot. CoreRESTORE provides 
critical data security at the hardware level by providing an unparalleled 
protected environment that enables rapid recovery of OS, critical configuration 
files and principal applications caused by viruses, application corruption and 
user error. 

This functionality is made possible by CoreRestore's off motherboard 
microprocessor which redirects all data changes, whether malicious or 
accidental, to a temporary working area that is able to be wiped clean with a 
simple reboot. Mission-critical data such as operating systems, sensitive or 
proprietary applications, complex configurations and static digital data sets 
are retained in a protected area, secure from unauthorized modification.

www.coreprotect.com

----------
---Matthew
*********** REPLY SEPARATOR  ***********

On 8/12/2004 at 4:12 PM Pete Simpson wrote:

> Nick FitzGerald wrote:
>
> > And, of course, dynamic black-box analysis that such a setup as this 
> > affords can be insufficient.  What if the program you are trying to 
> > analyse detects it is running under VMWare and simply exits, 
> > or runs a 
> > "harmless" (or otherwise different) code branch than it runs when not 
> > in a VM??  
>
> From 29A zine #7
>
>