which is the best way to run a suspicious file?

Re: wich is the best way to run a suspicious file?

Running the file in Sandboxie gives your AV a chance to scan it if the AV can not unpack the file. You can also look at what the program does to the sandbox and there is a way to check the registry entries by loading the hive into regedit.

Another method is to run the program in a VM with a HIPS enabled and see what kind of warnings the HIPS throws off.

Both of these take some technical knowledge to separate ordinary software from malware.

 

Re: wich is the best way to run a suspicious file?

Behavior blockers are a good layer but not exceptional for foolproof protection. I still recommend an ISR program and defensewall and if not that then at least a sandbox type app like sandboxie http://www.sandboxie.com/ or bufferzone http://www.trustware.com/ . Not much after that I would recommend for what you are trying to do in my opinion. Yes you could use a vm but they have their flaws to and take more time than what I mentioned above. Also you have to remember no everything can run in defensewall or sandboxie/bufferzone. So the ISR will have you covered in the case save for very very rare malware.

Thanks,

Chris

 

Re: wich is the best way to run a suspicious file?

Do an image backup of the system.
Run the suspect software.
Do a full auntie virus scan.
Restore the system from the image.

However, even if things seem to go OK, you have no way of knowing what dastardly acts have taken place, or seeds planted, that might bite you in the back rank, to use polite chess terminolgy, at a later time.

If you do not trust the software, then do not run the critter.

 

Re: wich is the best way to run a suspicious file?

Yes you could do that but depending on your used drive size it could be a while... Small used space not to long but much used space and get a lunch. Depending on what program you use to backup and restore maybe get dinner Not knocking howards suggestion just informing you of the negatives as well.

Thanks,

Chris

 

Re: wich is the best way to run a suspicious file?

thanks
I tought a program like Threatfire http://www.threatfire.com/

 

Re: wich is the best way to run a suspicious file?

yes thanks
i will do it , but i have everytime a service installed or sandboxies or defensewall i will use it one or twice at month

by the way defesewall seems the best

 

Re: wich is the best way to run a suspicious file?

Yes unfortunately but if you need the security...

Thanks,

Chris

 

Re: wich is the best way to run a suspicious file?

Peters idea will work if you have lots of time and you know what your looking at in your hips logs. Also as far as some stuff getting under some ISR software please search for these exploits which are not many actually they might all be POC's at this point. Now look for vmware security alerts. There are more and some have been used.

But remember nothing is perfect. It's possible you make a backup run the suspicious file it is malicious so you reload your image and it is corrupt. Now you have problems. Now you could make image try to restore image if it works install suspicious file then restore image again... getting tedious. Not saying you will have a corrupt image but it is possible.

Thanks,

Chris

 

Re: wich is the best way to run a suspicious file?

Almost everything that doesn't need a reboot, I use Sandboxie.

If it's something really, really suspicious that I've downloaded or a reboot is needed, I'll use VirtualBox. I like it, and for whatever reason I find it easier to use than VMware. So far, it's held up it's end and not failed me.

Both drove me nutty initially but when I finally gave up and read the instructions, things resolved themselves. VirtualBox just seems the friendlier of the two, in my case.

 

Re: wich is the best way to run a suspicious file?

Just take a look in the acronis forum and you can see that there can be an issue restoring images. If he can afford shadowprotect or already has it then this would probably be the better of the imaging apps.

As for the hips your right as in you shouldn't be relying on hips if your not sure what the alerts mean that's why I recommend using something a bit easier as the OP does not sound like he is may not be just learning the security game. Eventually maybe he can move up to hips.

Thanks,

Chris

 

Re: wich is the best way to run a suspicious file?

well i don't understand very well english
but thanks for your great tutorial
1) isr are not the best bet , right?
2)Behavior blockers/Sandboxes? which is the best?

 

Re: wich is the best way to run a suspicious file?

you know that the sandboxie service in auto gives me many issue

 

Re: wich is the best way to run a suspicious file?

We have given some opinions to help. I don't think there is much more that can be said. You are the only one that can make the choice on what runs good on your system and works best for you.

Thanks,

Chris

 

Re: wich is the best way to run a suspicious file?

yes , really tanks to all of you
really very appreciate it

this is the best forum

 

Re: wich is the best way to run a suspicious file?

i found a portable version of sandboxie and it works great

 

Re: wich is the best way to run a suspicious file?

I would recommend to first scan the suspicious file with your anti-malware scanning software. If nothing suspicious is reported by any of them, then upload the suspicious file if it's less than 10 MB to VirusTotal, which uses quite a number of anti-malware scanning engines. If nothing suspicious is reported by VirusTotal, I would recommend then uploading the suspicious file to Bit9 FileAdvisor to see if it's on their whitelist or blacklist. If it's not on their blacklist or whitelist, or if it's on their whitelist but you're still not comfortable, then I would recommend running the suspicious program in a virtual machine with ThreatFire and some anti-malware scanning engines installed. ThreatFire is a good choice because it alerts usually only when there really is a malware issue. I agree with a previous post, that if you're technically inclined, in the virtual machine also use a HIPS that detects single actions, such as Comodo Firewall 3. If nothing suspicious happens in the virtual machine, then I recommend also testing in your real machine, because some malware detects virtual machines and purposely won't behave badly in the presence of one. Run the suspicious program in your real machine with Returnil on (if the suspicious program requires no reboots to install), with ThreatFire installed, and, if you're technically inclined, a "single action" HIPS such as Comodo Firewall 3 installed. If the suspicious program requires a reboot, you could substitute Windows SteadyState disk protection for Returnil. If nothing suspicious happens in the real machine with disk protection on (by using Returnil, Windows SteadyState, or similar programs), then you can turn off the disk protection program and install and use the program normally.

Before you install in your real machine, make sure you have a recent system backup stored away from your hard drive(s); DriveImage XML on UBCD for Windows is a free program that can make system backups. There are free programs that let you upload to Bit9 FileAdvisor or VirusTotal from a context menu; see http://www.virustotal.com/metodos.html and http://fileadvisor.bit9.com/services/help.aspx?topic=fileadvisor.

 

Re: wich is the best way to run a suspicious file?

thanks for your great answer
well it's the first time is meet fileadvisor.bit9.com
Returnil is a virutal machine? but for sure is not free

 

Re: wich is the best way to run a suspicious file?

thanks
but i guess is not free for home right?

 

Re: wich is the best way to run a suspicious file?

Returnil is free for home use.

 

Re: wich is the best way to run a suspicious file?

WOW

ps why don't make a sticky topic with the best software and maybe the free home version

 

Re: wich is the best way to run a suspicious file?

You're welcome. All of the software mentioned in my post is free.

Returnil transparently redirects file writes to memory or free space on your hard drive, so when you reboot, any changes made to your system partition (only) are gone! The real files on your system partition are not changed when Returnil protection is on.

If you're unsure of how to use a virtual machine, you could skip that step and use Returnil instead, because Returnil might be easier for you. But beware, that if you do experience malicious behavior, Returnil protects just the partition with windows on it, and also any data that gets stolen out of your machine can't be undone by a reboot. That's why it's better to use a virtual machine first if you can. VirtualBox is free virtual machine software, although I haven't personally used it.