Re: [PEN-TEST] Suspect .EXE Trojan

[Ken Pfeil <kpfeil () MIRADIANT COM>]

You can usually ascertain details from opening it up with a Hex Editor.
WinHex comes to mind. http://www.winhex.com

Regards,
Ken

Ken Pfeil
Chief Information Security Officer
Miradiant Global Network, Inc
kpfeil at miradiant.com
http://www.miradiant.com
15 Broad Street, 17th Fl.
New York, NY 10005
(P) 212-235-2338
(F) 212-235-1658
(C) 914-805-3141
PGP Lookup:
http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x3011C88A
"Of course my password is the same as my pet's name.
My dog's name was Q47pY!3$H9x, but I change it every 90 days."


-----Original Message-----
From: Ruso, Anthony [mailto:aruso () POSITRON QC CA]
Sent: Thursday, December 14, 2000 1:59 PM
To: PEN-TEST () SECURITYFOCUS COM
Subject: [PEN-TEST] Suspect .EXE Trojan


Hi,

I have a suspect executable that I think may be a Trojan. A search on the
.exe doesn't return any result with any virus vendor. Are there any tools
that would allow me to execute the file in isolation and actually see what's
going on. The file was already executed on two workstations and it killed
Outlook in both cases. I know I can use tripwire and similar products to see
what files it makes changes to but I don't want to risk killing outlook
again.

Thanks

Anthony Ruso