[spook]

Is there some kind of tool capable of analyzing a file in a "safe virtual environment"

Norman AV has Sandbox, it emulates a real computer inside your computer. This is used to see how the file acts.

For Linux you have WINE to emulate win32 programs, so virusses as well right?

So basically what I'm looking for is some kind of tool to check the behaviour of win32 virusses (so with desktop and stuff.. everything like a normal windows)


Thanks,

spook

[FiNaLBeTa]

Didn't know that norman thing. but what I use is a virtual PC with restore disk, bit of work....

[belgther]

vmware or virtual pc are great programs that do this job. Just create a small HDD file, and back it up, then analyze your file there without harming your own computer...

[spook]

FiNaLBeTa, on May 24 2005, 12:40 PM, said:

Didn't know that norman thing.

<{POST_SNAPBACK}>

Here's some more information about it if you're interested:
hxxp://sandbox.norman.no/


I'll give VMware and Virtual PC a go tomorrow or so, thanks
Now to verify if I'm looking at the right sites:
hxxp://www.microsoft.com/windows/virtualpc/default.mspx
hxxp://www.vmware.com/products/desktop/ws_features.html


Correct?

Thanks for the help :)

[FiNaLBeTa]

yep, that is the software.
You could back up the virtual HD like belgther said, or you could use a restore partition.
That way every time you close the Virtual PC, it will ask you if you want to undo all changes made in the last session.

[SkitZZ]

i'd go for VMware Workstation has a nice snapshot feature

quote from the help file

Quote

With Workstation, you can take a snapshot of your virtual machine and preserve its state � including the data on its virtual disks � at a particular moment in time. You can continue working with the virtual machine and, if desired, return to the snapshot state at any time.

This is useful if you wish to undo changes you made to the virtual machine. You can take a snapshot of a virtual machine at any time and revert to that snapshot at any time, whether the virtual machine is powered on, powered off, or suspended.

SkitZZ

[genxweb]

I suggest vmware also but als o configure a seperate vlan for it so traffic that may get generated does not find its way onto your trusted network.

[FiNaLBeTa]

the two posts above count for virtual PC 2. When talking windows, I would probebly take virtual PC.

[sefe]

i tested both MS VPc and WMware. WMware is MUCH better, its fast, its stable and has a lot of options.

MSVPC is better for total begginers.