- Jul 21, 2014
- 64
I've been browsing threads and post on here about "malware testing" and malware samples. Why do people test malware (and who does it)? Also, how do you do it?
What is the reason behind testing malware?
- Thread starter TechHelper
- Start date
They are mainly testing AV's ect for detection, but some test malware to learn it's behaviors, where it stores itself, how to eradicate it. As far as who, well experienced individuals do testing, and it should be maintained that way.
- Jan 9, 2013
- 1,457
Why?
Work related, I remove malwares from customers. To make my job easier I do collect samples and analyze them so the next instance I encountered a similar strain, removal would be easier and faster. I use my own tools aside from other great tools you can find in the web. Example I got an unknown worm sample let's say a vbs file (since it's the most abundant here) I can remove it manually, might take me 5-10 minutes but if I have a script, removal can be done in seconds
I no longer test the likes of sality or virut or rootkits since they have a different approach and specialized tools available for removal.
How?
I infect my PC sometimes in Sandboxie, if I need to create a script for it's removal, I do it "live" to make sure my procedure is effective. There is a program written by @n.nvt you can use it if you like, but since I'm stucked with Windows XP Home, I make before and after snapshots of my system then analyze the results and reversing the effect of the malware. Mostly I do this with the files and the registry as well if it is managable i.e. only a few keys are involved. If there are more I just rely on scanning with MBAM and other AV. No need to reinvent the wheel.
Work related, I remove malwares from customers. To make my job easier I do collect samples and analyze them so the next instance I encountered a similar strain, removal would be easier and faster. I use my own tools aside from other great tools you can find in the web. Example I got an unknown worm sample let's say a vbs file (since it's the most abundant here) I can remove it manually, might take me 5-10 minutes but if I have a script, removal can be done in seconds
I no longer test the likes of sality or virut or rootkits since they have a different approach and specialized tools available for removal.
How?
I infect my PC sometimes in Sandboxie, if I need to create a script for it's removal, I do it "live" to make sure my procedure is effective. There is a program written by @n.nvt you can use it if you like, but since I'm stucked with Windows XP Home, I make before and after snapshots of my system then analyze the results and reversing the effect of the malware. Mostly I do this with the files and the registry as well if it is managable i.e. only a few keys are involved. If there are more I just rely on scanning with MBAM and other AV. No need to reinvent the wheel.
- Jan 9, 2013
- 1,457
If you like I can provide a sample or two for you to test and remove. These will be low level worms that are easy to remove.
- Jul 21, 2014
- 64
Thank you for your very informative answer, I appreciate. Yes, that would be great. Would I need to install sandboxie?
- Jan 3, 2014
- 618
Look, at least for me is where I have to have greater experience and knowledge of how to behave such threats through behavior and detection of various antivirus software, as well as being a form of fun. For example, how a keylogger works, based on that I can protect myself, just to look and analyze I have a sense of how this works malware or clues, it helps you to know whether or not infected and prevent infections. Another reason and submit these samples for antivirus companies to have greater coverage of the threats. I love test and have so much fun 
Another question about how to do it: I do not recommend you do this kind of testing, we have many dangerous threats of extreme and irreversible behavior, which can result in loss of money, etc. data. Only for experienced and they know what users are doing. Should be done in a virtual environment (virtual machine with some settings) or an old computer, which nobody uses, with other measures. If you're interested, search for more
Another question about how to do it: I do not recommend you do this kind of testing, we have many dangerous threats of extreme and irreversible behavior, which can result in loss of money, etc. data. Only for experienced and they know what users are doing. Should be done in a virtual environment (virtual machine with some settings) or an old computer, which nobody uses, with other measures. If you're interested, search for more
- Jul 21, 2014
- 64
Look, at least for me is where I have to have greater experience and knowledge of how to behave such threats through behavior and detection of various antivirus software, as well as being a form of fun. For example, how a keylogger works, based on that I can protect myself, just to look and analyze I have a sense of how this works malware or clues, it helps you to know whether or not infected and prevent infections. Another reason and submit these samples for antivirus companies to have greater coverage of the threats. I love test and have so much fun
Another question about how to do it: I do not recommend you do this kind of testing, we have many dangerous threats of extreme and irreversible behavior, which can result in loss of money, etc. data. Only for experienced and they know what users are doing. Should be done in a virtual environment (virtual machine with some settings) or an old computer, which nobody uses, with other measures. If you're interested, search for more
Alright, I understand. If I shouldn't do it, I will search more on it. Thanks for the feedback.
- Jan 3, 2014
- 618
On the internet should have many articles as a virtual machine works and how to configure it. Here in MT we have many good reviews from testers that can help you too. Just be careful and start slowly if you have any questions, ask any of us, then yes you can test in a safe manner without risk, either for fun or to have greater knowledge
- Jan 9, 2013
- 1,457
To get you started, you can try my samples live, I can guide you step by step so no need to worry.
But about the other samples from MT, prudence dictates that you listen to this.
You can use the following VMWare, VirtualBox, Sandboxie, Shadow Defender, Deep Freeze, Quiet Zone etc. Never try this unless you believe you are comfortable enough.
- Jul 21, 2014
- 64
Alright, I read some info on virtual machines (plus how to install VirtualBox) and watched videos of people using them. I will take heed in the warning.
- Jan 9, 2013
- 1,457
Good we don't want you getting a full blown infection
- Jul 23, 2013
- 2,115
Also remember, even if you are in a virtual environment, malware can still steal passwords stored in a browser, IDs that are not encrypted, anything else laying about that it can read.
- Jun 22, 2014
- 905
- Apr 13, 2013
- 3,225
I find totally trashing a computer with malware to be relaxing.
Similar threads
-
- Sticky
