Major Update 1.27.2014 Rev: 17
Alright guys, after another backbreaking night of coding and testing i am most happy to announce the full beta version of FMA Intel-Secure Forensic Malware & Intrusion Analysis program.
I have personally tested it to a point where i found myself sleeping behind the computer, so right now the program is working and rock solid.
The only thing that bugs the living crap out of me is the fact that some antivirus companies do flag the included executable sub programs as a virus.
I have mailed all of those who did list the files as virus & suspicious so now time will tell how long its going to take for them to certify the software as clean.
That being said lets start talking happy things, what features do does the program have?
Function list:
Deep level system data and security audits (FMA1System):
- Auto Browser and system junkfiles removal
- Harddisk volume and serial logging
- Installed system software list
- Active and hidden processes scan and logging
- Advanced process handler scan and logging
- Legit windows services and rogue services scan and logging
- Extended services status scan and logging
- Advanced start-up scan and logging
- Driver audit and signature scan and logging
- Windows bootmanager scan and logging
- Kernel Transaction scan and logging
- System Policy scan and logging
- Group Policy scan and logging
- ALL above cross reference scan and logging
FMA1System is the first module out of 3 modules to scan and log the system, the logfile generated by FMA1System is just amazing and 100% accurate. If there are malware & intrusion or malicious data traces FMA1System will list them and a system admin will be able to navigate to the files and remove them by hand as the module will tell everything there is to be known about your data.
The scans are deep and very accurate and data cannot be hidden from it.
Advanced network and security audits (FMA2Network):
- Valid and rogue connections scan and logging
- IP routing table scan and logging
- All active listening TCP and UDP connections scan and logging
- Active TCP connections and (PID) logging
- Logging statistics TCP, UDP, ICMP, and IP protocols
- Bytes and packets sent and received statistic logging
- scan and log components for all executables
The FMA2Network module will scan you entire network and list every bit of data and will cross reference the data with module 1 FMA1System in order to detect and log intrusion and malware traces.
If the pc in question as been hacked there is no way FMA1Network is not going to see it, because it will read out every single module a pc has to establish a connection in the first place. And because it cross references connections to their parent files the log almost spits out a home address and phone number lol (Yes its that accurate)
Advanced firewall audits and internet connection repair (FMA3Internet):
- Advanced internet connection repair and logging
- DNS scan, logging,repair, cleaning
- ARP tables scan, logging, repair, cleaning
- Full IP INT scan and reset capability
- Advanced firewall audit and repair
- Firewall helpers scan, logging and repair
- Logging of all allowed programs
- Logging of current profiles and repair
- Deep level firewall configuration analysis and repair
- Deep level ICMP configuration scan, logging and repair
- Full Inspection firewall services and dependencies (Logging and repair)
- Firewall state inspection and logging
- Full firewall extended logging
- Advanced MCB scan, logging and repair
- Advanced open ports scanning, logging and repair
- Advanced firewall rule inspection, repair and logging
- History logging for historical firewall notifications
- Extended firewall OP mode scan and repair
- Advanced winsock readout, logging and repair
- Past and present full route information readout & logging
- Advanced full reset and repair of Windows firewall, profiles, policies, rules, ports and dependencies
The final module FMA3Internet is a hackers worse nightmare it works with modules 1 and 2 and totally track back ANY malicious actions to a point where you can eyeball and in real time change and intercept problems, not trying to be funny and i am not trying to claim things the program cannot deliver, but if you think that module 1 and 2 are impressive then you should see the fireworks generated by the FMA3Internet module.
For any hacker reading this if you come across FMA then you know you hacked the wrong PC as very soon you will hear that classic: DING DONG or KNOCK KNOCK at your door because this is the moment the Cops will end your internet fantasies. Seriously the program is specifically written to see ALL data past and present and spit it out in a log which can be examined by a forensic expert or by a system administrator and they will have the ability to pin point issues and deal with them on the spot.
Additionally the program comes with Kaspersky TDSSkiller and Norton NPE to give some emergency stand-off against detected root-kits (Yes the log can see them to^^) and if you see a file that does not fit a legit file description or it does not seem clean anymore then you just can copy past the address and put it into a virus total scanner which will tell you if its clean.
Keep in mind the program has NO antivirus capability, but if viruses are present or old traces of them the logbook will show it and you can remove it by hand, next to that the program does cross reference all data with their dependencies, services, executables, drivers, internet settings, the register, user and group policies + processes and internal process PID + CPU and Memory PIDs + sub processes.
So reading the log will allow you to be a human antivirus a human firewall and a digital swat team.
And these are just a few functions that the program can do as during the scans it does a whole lot more.
As mentioned above i have done a major update, so lets list them:
- Logbook cannot be corrupted when a scan is running (File in use protection)
- Fixed GUI icons and added some information
- Major GUI overhaul and smoothing
- Fixed memory usage (less then 15mb)
- Compiled the batch files into executables to avoid source corruption
- Re-Compiled the whole core, installer and uninstaller
- Added over 100 tweaks to make the program even better
- total source code overhaul and clean up
- Added future upgrade capacity and upgrade features (not enabled atm)
* Note the program does not have self defense capability yet we are working on this but its going to take some time to properly get it to work, it was planned to be released with this update but i have taken it out because it did not perform in the way i want it to perform.
* This program does focus on Windows core and windows Firewall the very reason for this is simple, 99.9% of all the hacks, infections and alterations of the windows core and its modules is always being listed within the logbooks, if you know where to look.
Windows firewall has a questionable reputation in terms of protection however its internal logging and its internal modules are utilized by third party products in order to make the product work in the first place.
This is thanks to MS because MS likes to log your computer habits and such, so even when you install products like Comodo, Outpost or Zonealarm they still indirectly will work with Windows Advanced Firewall core modules, and its exactly these core modules that are being scanned.
Keep in mind a third party product, regardless how good they are still are bound to using windows internal modules.
So the program does not focus on logging third party tools (While in some cases it does list notable events) it does focus pure and alone on windows integrity related modules, which provides first hand and 100% accurate info.
So as you can see i have been busy.
Now how do you use the program?
1: Install your pc and update it.
(MUST BE 32-Bit Windows 7)
2: Install the program (prefer be installed on clean system for best clean log generation).
3: Run the program (FMA.exe)
4: Work your way trough the steps start with button 1 and work your way up
(DO NOT MIX and do NOT run multiple tasks at ones), just hit the correct button and the program does the rest just sitback and relax
5: Read the log (button 4 will bring it up after scans are done)
6: Move the log to a usb stick (you can find it: C:/FMA/securitylog.txt)
7: Ones copied to the USB stick rename it to: securitylogclean.txt)
8: Remove the old copy from the pc itself.
9: Close the program and unplug the USB.
Now when does the program shows its capability?
Scenario: 1 month after you fresh installed your pc you suddenly get hacked or infected and your traditional AV did fail you and your firewall is busted.
You can run FMA.exe again and generate a NEW log and when the scans are ready you can start comparing the log on your USB and the log generated on your dirty system and eyeball the changes and handpick /correct them.
And take the actions you need to take to stop and repair the malicious code.
Extra advise:
* Programs like Sourcegear Diffmerge
http://www.sourcegear.com/ (FREE)
and Beyondcompare
http://www.scootersoftware.com/ (PAID)
Are instrumental in log comparison just point them to the logfile and they will highlight the exact changes with no hassle.
Just point, compare = result.
In the near future we will add a comparison tool ourself.
If you did not make a cleaninstall scan and you have to run the program on a infected system then you can as the log generated will be just as good BUT it will be a bit harder to spot problems as you have no reference so this will require extensive know how.
* Note you need to have advanced knowledge about your PC and hardware & software and you need Advanced Know how about windows and how windows works this is not Comodo or any tweakable product and this is not your average joe program, my point here is (No disrespect to Comodo or other brands that allow tweaking) You cannot tweak, you shall not tweak and NO you cannot play around with it seriously!!!!!! The program has a build in crash module when you use it in the wrong way it will shut down because i rather see posts it about the program saying it did shut down, then seeing posts: I tweaked the program and now my pc is busted.
Keep in mind the log is raw data and while it does have some structure it is not a easy book to read, so again let me say this one more time: You need some serious PC skills both on Hardware, Software, Windows core functions and you need advanced understanding about Networks.
The program has been made to make it as simple as possible and it really is however the moment your eyes read the log you will exactly know why i gave you the warning <evil grins> Hence why i gave some extra advise above to download a third party log comparison software.
Anyway the moment my domain is fully online (Its bought and it takes up to 72 hours to activate over the net)
And i will make the program itself available exclusive for MalwareTips approved members. (As it was never designed for "home" use)
If you come across bugs, problems or you have ideas, please contact me and provide detailed info, screenshots and if possible the log you generated and i will do what i can to fix it)
The more info i have the more future potential this program will have, because at this stage any idea's (If possible) are most welcome.
Did i forgot anything to mention? I am pretty sure i did... But first i am going to get myself a cold beer and then i am going to take a serious sleep as it was a VERY long night (18 hours)
PS
(Those who have offered to test the program please contact me for a new version)
Kind Regards Nico