Re: Honeypot and AntiVirus

[Devilscrow Sr <devilscrow () gawab com>]

Hi J,

Comments inline......
J Bailes wrote:

> 1) Can I set my AV to prevent this without risking compromise to my host OS where the analysis will be performed?
>  
If i have understood the question..... your av cleans the logs when you 
access the binary files (i am asuming). the i guess the simplest 
solution to this would be to store the binary file in a directory and 
then configure the av to exempt that directory from scans. or else you 
could dynamically log to a different system or to the native os of 
vmware..... i dont know if i did answer your question.

> 2) Can an analysis be performed with mitigated risk of compromise to the machine running the analysis?
>  
It works best when the analysis, logging system are physically differnt 
machines. You can easily get rid of these small teething problems......

Hope i got it right ?? write back.

-dev