Re: Tools for examine a virus

On Mon, Dec 12, 2005 at 09:53:05PM +0100, Antonio P=E9rez Fern=E1ndez wro=
te:
> What kind of tools do you use to examine a virus. I'm a novice.
>=20
> In this moment i'm using w32dasm, regmon and filemon but i supose that =
there=20
> are a lot of tools.

Could you clarify the question a bit?  Are you talking about a specific t=
ype
of viruses - for example, the tools used to analyse a VBS script virus ar=
e
of course entirely different from those used when analysing a PalmOS viru=
s
or a Win32 virus.  Also, are you only talking about viruses, or about=20
malware in general?

Assuming that you are talking about general Win32 malware, the tools we
are primarily using are IDAPro, VAT (emulation-based virus-analysis tool)
and a simple tool (HackersView, I think it is called) which provides
hexdump and disassembly.

In the rare cases when we actually need to run the malware, there is a=20
series of monitoring tools, including regmon and filemon that you=20
mentioned.

--=20
Fridrik Skulason   Frisk Software International   phone: +354-540-7400
                   E-mail: [email protected]       fax:   +354-540-7401


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click