Re: [PEN-TEST] Suspect .EXE Trojan

[Eric Fitzgerald <eric () AMNTV COM>]

Use an isiolated machine, not attached to any network (pull out the nic card
and/or modem).

Use tripwire to see any file modification's.

If you know how to read binary files, get yourself a nice hex editor and
diff any binary files to see the changes.

----- Original Message -----
From: "Ruso, Anthony" <aruso () POSITRON QC CA>
To: <PEN-TEST () SECURITYFOCUS COM>
Sent: Thursday, December 14, 2000 10:58 AM
Subject: [PEN-TEST] Suspect .EXE Trojan


> Hi,
>
> I have a suspect executable that I think may be a Trojan. A search on the
> .exe doesn't return any result with any virus vendor. Are there any tools
> that would allow me to execute the file in isolation and actually see
what's
> going on. The file was already executed on two workstations and it killed
> Outlook in both cases. I know I can use tripwire and similar products to
see
> what files it makes changes to but I don't want to risk killing outlook
> again.
>
> Thanks
>
> Anthony Ruso