Penetration Testing: Re: Analize Virus

["Colin Copley" <colin.75 () btinternet com>]

> From: "Rafa Richart" <Rafa () ontinet com>
> To: <pen-test () securityfocus com>
> Sent: Tuesday, July 31, 2007 6:28 PM
> Subject: Analize Virus
>
> we're looking for some tools to analize the Malware behaivor, we've a Lab
under contrucción, but we need some advices of what tools we've to use.
tools to see what >have benn changin the registry, stat conexions etc...

Hi

You might want to try one of the malware/virus lists as well, but here's
some apps you'll
probably find useful:

A virtual machine environment:-
MS Virtual Machine and /or VMware

Dynamic analysis:-
Regmon & Filemon, from Sysinternals, now at MS Technet
(Strings, Process Explorer, Autoruns, & Rootkit Revealer are also useful to
have handy, also from Sysinternals)

Simple DOS scripts can help to create your baselines before running a virus.

You'll also need a selection of unpackers, decompilers, debuggers,
disassemblers and hex editors.
I've found these useful:

PEid
MewUnpacker
Hexplorer / Hiew
Softice
IDA
w32dasm

Just google for links, but handle the unpackers with care, some are trojans.

Kind Regards
Colin



------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------