Purposely infecting a VM

Hey guys, first post on this acct. Used to be active, even had a good number of AP, but alas, I cannot remember the login I used to use =P

Anyways, I am looking for some sites where I can purposely download malware, stuff like Vundo and Antivirus360. I have a virtual machine I'm setting up so I can infect it and use Sysinternals PE and Procmon to figure out what exactly gets modified and best practices for removing it with having to find a Windows repair disk.

Sometimes malwarebytes just isn't enough. Thanks in advance.

Heh. I was doing this same thing last night. I went to crack sites, free downloads etc. Couldn't get the darn thing infected. I actually named the VM 'Infect-Me!'. I don't understand how my mother-in-law can get AV2009 once a month, and I can't get it when I am trying. :D

AT YOUR OWN RISK :xbones:

This might be a good place to start, but it is a Cult of the Dead Cow affiliate site so be careful.

I think the password is infected.

http://www.offensivecomputing.net/

Cool, thanks nihil. That should do just fine. If all else fails, I'll just visit anything .ru

There are some links down the left hand side of the main page of the offensive computing site that might also be of interest.

The problem with just cruising dodgy sites in the hope of getting infected is that you never know exactly what it is you have got, and what the quality is.

If you are just starting out it is a lot easier if you have the source as well as the executable. Disassembling badly written code can be rather confusing unless you are very good, which I am afraid I am not. :)

EDIT:

If you fancy playing with rootkits, try here:

http://www.rootkit.com/

There are quite a few places you can look...

While this may not help with infecting your VM, there's some interesting stuff at the virus source code database (http://vscdb.totallygeek.com/).

It is also possible to pay to get access to Jotti.org (or at least had been in the past).

You could also run nepenthes. That would give you plenty of real world examples.

I need to update my nepenthes install (it doesn't yet have the MS08-067 plugin) but there are a few interesting things that float by it daily.

[2009-03-01T04:35:05] 60.166.XXX.XX -> <nepenthes> http://60.166.XXX.XX:XXXX/x.exe 7f60162c2c0bd2cc7531e51328e98290 just showed up yesterday.

There's an analysis here from an automated submission of it -- http://nepenthes.carnivore.it/analys...31e51328e98290

PM if you want access (the remainder of the URL or a separate download link).

I managed to get AV360. I searched for XP Keygen, and clicked ahead to page 9 or so, one of the first pages I clicked on told me that I was infected and needed to install a 'viruses scan program'. :)

Thanks for the links, that should provide some more specific infections... :D