Virus Analyzer

There are many virus spreads on internet and grow up everyday, therefore many antivirus provider like McAffee, Norton, Kaspersky and others competing to make a very powerful antivirus. The making of antivirus absolutely will need to identify the virus firstly before they launch the anti-virus. We must analyze how it works, what it can do by a virus in it, what are infected and so on.
To perform the analysis of a virus usually requires tools that can analyze  a virus in detail and quick. Here are some tools you can use to analyze a virus.

1. Malcode Analysis Pack
(http://labs.idefense.com/software/download/?downloadID=8)
This tool consists of a variety of applications that can help you analyze a malcode.
i.e : ShellExt, socketTool, fakeDNS, Sheilcode2Exe and others.

2. Autorun For Windows
(http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx)
This application is used to determine the location of auto-starting of the startup screen in windows.
This application will show the programs that run during the system bootup or login.

3. RegMon for Windows
(http://technet.microsoft.com/en-us/sysinternals/bb896652.aspx)
This tool can show which applications are running to access the system registry on your computer.
All will be displayed in real-time

4. FileMon for Windows
(http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx)
This tool will display the system activity of a file in the operating system in real-time.

5. Multipot (http://labs.idefense.com/software/download/?downloadID=9)
This application is designed to collect a lot of malicious code found on the internet.

6. Process Explorer for Windows
(http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx)
This tool handles dal find out information about DLL’s processes that are currently open.
This application will show a list of processes that are active at that time.

7. Resource Hacker (http://www.angusj.com/resourcehacker/)
Tools that can be used to change the resource on win32 executables and resource files to another.

8. Rootkit Unhooker (http://www.antirootkit.com/software/RootKit-Unhooker.htm)
Applications to detect rootkits.
Some of the features offered include Ultimate Drivers Detection, Hidden Files Detection and so on.

9. SysAnalyzer (http://labs.idefense.com/software/download/?downloadID=15)
This tool is able to analyze malcode automatically run time to monitor what is being done by the system and running processes.

10. PE iDentifier (http://www.peid.info/)
This application is used to detect packers, cryptors.
This tool is able to detect more than 600 different signatures of the PE file.

11. VB Decompiler Lite (http://www.vb-decompiler.org/download.htm)
A program decompiler for programs that have an EXE, DLL and OCX extension.

12. MiTec EXE Explorer (http://www.mitec.cz/exe.html)
This tool was created as an executable reader.
This application is able to read and displays executable file properties and structure of a file that is analyzed.

Incoming search terms:

Computer Virus and Antivirus

Most of us may have a problem from Computer Viruses. They will never end, as we will see there are alot of new viruses every day. But we don’t have to worry about that since there are many Antiviruses we can use to prevent them.

But, did you know, why the virus existence will never end in the digital world?, Why the virus makers never give up to generate a new virus again and again?, what do they want?. Of course that questions will need a logic answer.

I wrote this article just because i have detected a possibility of conspiracy caused of symbiosis which was have a mutually beneficial between the virus makers and the antivirus makers, so that the virus and antivirus industries still exists untill now.

Conspiracy
In an example case, if there is a new virus launched then some of the antivirus vendors will quickly recognize and clean the computer from this new virus while the other antivirus vendor so confused and slow to recognize this new virus.

From the above cases, may be one of the antivirus vendor’s employees make a contact/cooperation with the virus maker, and they give an order to create a new virus with the criteria that have been set before it, in the sense of order of creating a virus. So that, those antivirus vendor will known as the antivirus vendors which can quickly detect and clean the ‘virus order’.

Thought appear above because I observed that the virus maker is rarely seems consistent with the results of his work, a scene in the beginning but disappeared some time casually.

The conspiracy’s theory above is just my observation only and untill now this theory was never proven.

Commercialization antivirus
In other cases, When we got a virus in our Computer as we know that we have an antivirus over there, but the antivirus cannot recognize the new virus in our Computer even to running the antivirus. We will confused to face to this situation.

From the illustration above, we need to know why our antivirus which was installed in computer unable to recognize even to clean the new virus?.

In fact the problem is that antivirus is updated regularly will be more powerful in providing protection than antivirus which is never been updated. That’s why we need to update the antivirus regularly.

For this one I got the idea from one of the forum on the internet to update the antivirus must be regularly performed and why antivirus vendor can survive / thrive.

Generally, the commercial antivirus is currently working with ‘blacklist’ method, as like as the following explanation steps :

1. New virus has been founded.
2. The virus signature will be identified and will be stored to the ‘blacklist’ database.
3. The Antivirus will scanning any files in the computer and will compare it to the ‘blacklist’ database. If the result is match, then the antivirus will take any action of that files.

Such was the approach that is used by antivirus vendors, but there are 2 major problems in project using the approach as it:

1. We will have a dependence to the antivirus vendor continuously, to update the ‘blacklist’ database. We will still have a possibility to be infected with a new virus which where the antivirus vendor still not find the virus signature to protect our computer. We will never have a fully protection from the new virus as the virus signature will only available to create until someone got infected from that new virus.
2. Due to thousands of new viruses spread every year then ‘blacklist’ database will growing. This means that antivirus software will consume more computer resources (cpu time, hard drive space) which will affect to the performance of computer. The increase in cpu speed, memory and hard drive space will alleviate the problem (of origin do not try to run the latest version of Norton on the old computer). The fact that if we really have to run antivirus software, the computer will be more slow.

The biggest problem is that the user will always be tied to the antivirus software because it must continue to renew the existing ‘blacklist’ database. That’s why the antivirus vendors can continue to survive and develop.

The point of the ‘blacklist’ method is to say “No” to something that should not have in our computer. However, there is another method which is called the ‘greenlist’ method, will keep something which should have in our computer.

If the ‘Greenlist’ method applied by antivirus vendor, certainly the end-user will have more benefit rather than using the ‘blacklist’ method. Which is mean, the end-user will not need to update or tied to antivirus vendor, and it will makes the antivirus vendor cannot survive their existence in this digital world.  source : howtoarchives.com

Incoming search terms:

Malware Prevention

Sometime we do not have time to manage our files in our Computer, or maybe we have forgotten to protect our document in our computer and later we got some files have been infected from a virus, and your anti virus do not have enough ability to restore that important document files. That would be a nightmare story if you didn’t any prevention to protect your files. Therefore we need some methods to prevent this problem. The following methods may help you to prevent your computer infected or being hacked.

1. If your computer connected through internet then you should Use a router for any internet connection (other than dialup). Be sure to keep updated the firmware on your router to the latest from the manufacturer. A router uses something called NAT (Network Address Translation) that works fairly similar to a firewall – however this is more like a firewall. NAT in most cases will not allow ports to be scanned & forwarded behind it. Also, the router will be your external IP address leaving your computer on an internal IP address. If ports on your router are not forwarded to your internal IP addresses (usually 192.168.*.* type of address) then a hacker on the internet will have a lot of difficulty scanning your computer. They will merely scan a router which in most cases is rather “stupid” and very hard to attack.
2. Keep your computer operating system updated. For Windows, Mac, Linux, and Unix users, always install the latest updates of security patch.
3. Use an Anti virus that have an Internet Security feature. This would be considered a firewall on the system you use. This is where you computer is basically asking you permission to install certain pieces of software along with asking if you want to allow certain connections on your computer. Again, a router will help you avoid a ton of mischief from hackers. This is more or less fail safe. Also make sure your Antivirus is updated frequently.
4. Make all of your passwords HARD, with letters, numbers and symbols. Make them at least 20 characters long. Do not include the names of your kids, dogs. Never make them just common words.
5. If you run a wireless network, always use WPA or WPA2 security. Again, make your password at least 20 characters including letters, numbers, and symbols. DO NOT SKIMP on wifi passwords.
6. Using web access email is always the safest. Free email accounts such as Yahoo, Gmail, or Hotmail always keep high levels of security on their sites. Also, always be very weary of any email you get that tells you to click links (Paypal for example). Hackers can make very good copies of websites like Paypal (including logos & design) and spam you. You click thinking you are at Paypal, put in your user name and password, and the hacker then has your user name & password. If you get an email from sources like your bank account, Paypal, Ebay etc., open a clean browser go directly to the site, and log in.
7. Do not keep entire hard drives open to sharing especially on networks that have several people. If its a simple home network where everybody is trusted, it’s great to just have a folder available to share just in case you are compromised from the outside.

Incoming search terms:

virus and antivirus behind the scene

Nowadays, we have found too many viruses spreads on internet, also there many NEW anti-virus over there, sometime i have a little bit question about it. Why they are exists, i mean a virus vs antivirus.

After searching to internet, I just  found a good articles that was explained about my question. It’s about Virus and Antivirus Behind The Scene , you can read it here as i just copied from a cyber and technology reference information .

Most of us may have a problem from Computer Viruses. They will never end, as we will see there are alot of new viruses every day. But we don’t have to worry about that since there are many Antiviruses we can use to prevent them.

But, did you know, why the virus existence will never end in the digital world?, Why the virus makers never give up to generate a new virus again and again?, what do they want?. Of course that questions will need a logic answer.

I wrote this article just because i have detected a possibility of conspiracy caused of symbiosis which was have a mutually beneficial betweenthe virus makers and the antivirus makers, so that the virus and antivirus industries still exists untill now.

Conspiracy

In an example case, if there is a new virus launched then some of the antivirus vendors will quickly recognize and clean the computer from this new virus while the other antivirus vendor so confused and slow to recognize this new virus.

From the above cases, may be one of the antivirus vendor’s amployees make a contact/cooperation with the virus maker, and they give an order to create a new virus with the criteria that have been set before it, in the sense of order of creating a virus. So that, those antivirus vendor will known as the antivirus vendors which can quickly detect and clean the ‘virus order’.

Thought appear above because I observed that the virus maker is rarely seems consistent with the results of his work, a scene in the beginning but disappeared some time casually.

The conspiracy’s theory above is just my observation only and untill now this theory was never proven.

Commercialization antivirus

In other cases, When we got a virus in our Computer as we know that we have an antivirus over there, but the antivirus cannot recognize the new virus in our Computer even to running the antivirus. We will confused to face to this situation.

From the illustration above, we need to know why our antivirus which was installed in computer unable to recognize even to clean the new virus?.

In fact the problem is that antivirus is updated regularly will be more powerful in providing protection than antivirus which is never been updated. That’s why we need to update the antivirus regularly.

For this one I got the idea from one of the forum on the internet to update the antivirus must be regularly performed and why antivirus vendor can survive / thrive.

Generally, the commercial antivirus is currently working with ‘blacklist’ method, as like as the following explanation steps :

1. New virus has been founded.

2. The virus signature will be identified and will be stored to the ‘blacklist’ database.

3. The Antivirus will scanning any files in the computer and will compare it to the ‘blacklist’ database. If the result is match, then the antivirus will take any action of that files.

Such was the approach that is used by antivirus vendors, but there are 2 major problems in project using the approach as it:

1. We will have a dependence to the antivirus vendor continuously, to update the ‘blacklist’ database. We will still have a possibility to be infected with a new virus which where the antivirus vendor still not find the virus signature to protect our computer. We will never have a fully protection from the new virus as the virus signature will only available to create untill someone got infected from that new virus.

2. Due to thousands of new viruses spread every year then ‘blacklist’ database will growing. This means that antivirus software will consume more computer resources (cpu time, hard drive space) which will affect to the performance of computer. The increase in cpu speed, memory and hard drive space will alleviate the problem (of origin do not try to run the latest version of Norton on the old computer). The fact that if we really have to runantivirus software, the computer will be more slow.

The biggest problem is that the user will always be tied to the antivirus software because it must continue to renew the existing ‘blacklist’ database. That’s why the antivirus vendors can continue to survive and develop.

The point of the ‘blacklist’ method is to say “No” to something that should not have in our computer. However, there is another method which is called the ‘greenlist’ method, will keep something which should have in our computer.

If the ‘Greenlist’ method applied by antivirus vendor, certainly the end-user will have more benefit rather than using the ‘blacklist’ method. Which is mean, the end-user will not need to update or tied toantivirus vendor, and it will makes the antivirus vendor cannot survive their existence in this digital world.

Incoming search terms: