Re: [PEN-TEST] Suspect .EXE Trojan

[Yonatan Bokovza <Yonatan () XPERT COM>]

> -----Original Message-----
> From: Ruso, Anthony [mailto:aruso () POSITRON QC CA]
> Sent: Thursday, December 14, 2000 8:59 PM
> To: PEN-TEST () SECURITYFOCUS COM
> Subject: [PEN-TEST] Suspect .EXE Trojan
>
>
> Hi,
>
> I have a suspect executable that I think may be a Trojan. A
> search on the
> .exe doesn't return any result with any virus vendor. Are
> there any tools
> that would allow me to execute the file in isolation and
> actually see what's
> going on.
If i remember correctly, eSafe had, long long time ago, some
sandbox capabilities. I don't know where does it stands today.

> The file was already executed on two workstations
> and it killed
> Outlook in both cases. I know I can use tripwire and similar
> products to see
> what files it makes changes to but I don't want to risk
> killing outlook
> again.
How about disassembling it? Or atleast searching for strings
in it.

> Thanks
>
> Anthony Ruso

Best Regards,

Yonatan Bokovza
IT Security Consultant.
yonatan () xpert com
Xpert Trusted Systems
972-9-9522361
Shenkar 1, Herzlia Pituach
Israel.