Re: [PEN-TEST] Suspect .EXE Trojan

[Mark Curphey <mark () CURPHEY COM>]

May want to look at this review before you buy !

http://www.cigital.com/hostile-applets/index.html

I've linked to the main page so you can also follow the other links
regarding Finjan.

-----Original Message-----
From: Penetration Testers [mailto:PEN-TEST () SECURITYFOCUS COM]On Behalf
Of Dom De Vitto
Sent: Thursday, December 14, 2000 3:09 PM
To: PEN-TEST () SECURITYFOCUS COM
Subject: Re: [PEN-TEST] Suspect .EXE Trojan


Maybe, maybe not.

Surfinshield is great for sandboxing, but it's a little porr on the
reporting side.

I do however recommend it, simply because it'll save you from bad stuff from
https sites, which other products don't.

(Quite how I'm going to roll out the new corp. version, I dunno yet)

Dom

 | -----Original Message-----
 | From: Penetration Testers [mailto:PEN-TEST () SECURITYFOCUS COM]On Behalf
 | Of WernerC
 | Sent: 14 December 2000 20:37
 | To: PEN-TEST () SECURITYFOCUS COM
 | Subject: Re: [PEN-TEST] Suspect .EXE Trojan
 |
 |
 | There's a commercial product by finjan called SurfinShield that
 | purports to
 | create a "sandbox" to isolate unknown malicious code.   Here's a
 | blurb from
 | the product description:
 |
 | "Behavior Monitoring of active content in real-time in SurfinShield's
 | sandbox including Executables, ActiveX controls, Java applets,
 | Scrap files
 | (.shs), and all Windows scripting host files (e.g., .VBS, .JS,
 | .WSH, etc.)"
 |
 | The website (finjan.com) doesn't have pricing, but there is an option to
 | download an evaluation copy.  Don't know if it will help you or not.
 |
 | --Carol Werner
 |
 | -----Original Message-----
 | From: Ruso, Anthony [mailto:aruso () POSITRON QC CA]
 | Sent: Thursday, December 14, 2000 1:59 PM
 | To: PEN-TEST () SECURITYFOCUS COM
 | Subject: [PEN-TEST] Suspect .EXE Trojan
 |
 |
 | Hi,
 |
 | I have a suspect executable that I think may be a Trojan. A search on the
 | .exe doesn't return any result with any virus vendor. Are there any tools
 | that would allow me to execute the file in isolation and
 | actually see what's
 | going on. The file was already executed on two workstations and it killed
 | Outlook in both cases. I know I can use tripwire and similar
 | products to see
 | what files it makes changes to but I don't want to risk killing outlook
 | again.
 |
 | Thanks
 |
 | Anthony Ruso