Viruses

[BD]Hobbit]

Hi,

I was wondering if i downloaded a virus from the security download section if it would infect my computer when i finished downloading it, or if it would only infect my pc if i opened it?

[blur]THANKS[/blur]


BD]Hobbit


Edit: Thanks to all you cool ppl who answer my annoying questions, sry, im only a newbie.

[DjM]

I would be very carefull. I believe someone posted once that some of the viruses were alive. Make sure you have a godd AV and it's up to date.


Cheers:

[jaguar291]

Depends what virus... most have minds of their own. And like DjM said... scan it with AV before taking any action... but because its from a security website I'd say when you open it.

[thehorse13]

I was wondering if i downloaded a virus from the security download section if it would infect my computer when i finished downloading it, or if it would only infect my pc if i opened it?

It depends but usually you have to do something in order to envoke a virus. Typically, I use notepad to open a suspected virus as notepad has no capability to execute code . Just a little tip for ya.

--TH13

[nihil]

Plese do not attempt to do this on your regular computer.....It is far too dangerous.

If you want to analyse viruses you need a "sacrificial goat"...some old corporate desktop box that you don't mind having to reformat and re-install the OS on regularly.

If your AV is any good it will kill the virus or deny access, if not, the virus will probably do one of those to you.

I would recommend visiting the major AV supplier sites and checking out their library facilities to get expert analyses. Build up a "feel" for the subject first.

You need to set youself up with the right analysis kit as well: UPX, compilers, disassemblers, decrypters etc. Rome was not built in a day, and it will take a little longer than that to get to grips with virus analysis.

BTW you have already been given some very sound advice. I would add that you should ONLY use wordpad, notepad or a program editing facility, DO NOT open zipped files, do not use Word, Write or Excel, and be sure that the sample is from a trusted source.

Good luck, and PLEASE be careful

[adjoe3]

hacker! on my computer and hes messing with me! if anyone has any info on how to get rid of him please tell me! thanks

[er0k]

dude, dont worry about your question, it was nicely phrased, but put in the wrong forum, next time put it in the Antivirus forum.

[noODle]

Well to answer the question (even though it has been posted some days ago) most downloads (atleast in the virus section) are the .ASM of the virus. This means that it is plain text and needs to be compiled before it can infect you.
Like stated earlier there are still some dangerous virusses in the section, dont test them on your working machine.
Cheers
noODle

Edit:
This only talks about the virus section of the downloads, I did not check the keylogger, trojan, exploit, etc sections. There may be some live virusses in there

[|The|Specialist]

BD]Hobbit that would deppend on how the virii presents itself. (Example) I've seen alot of sites that offer source code to macro virii so anyways one time I was checking out some scripts on this site but they didn't have it setup right... instead of showing the source as normal .txt in my browser they had left it all in its normal .html extention and the site it had opened up the page in my browser and then next thing I know VBS, WS, & javascripts were being droped and executed inside my computer. Another thing you might want to watchout for is things like auto-exe.bat files & readme files with weird file exstentions but asside from that as long as you don't open anything you should be fine. Anyways a old computer is great but the thing about 9x is when you press ctrl, alt, & del virii can hide a hell of alot easyier in 9x and when you press these keys together you usually don't get a list of proccesses like all these NT based systems such as what XP usually has which isn't really a big deal if you have a good AV or know what to look for around your registry and things.

Adjoe3, This is kinda off the topic of virii but uh... anyways... if you have FW logs of this guy then just use something like those Sam Spade searches then when you get a address, phone number, & (ect) belonging to the ISP then just cry & whine to those ISP guys intil they are forced to deal with whatever is going on. If he's doing something on a site/board/IRC then just do something like a DNS whois search and mail or call the host, the site author, or whoever is helping it run then tell 'em about whats going on so they can fix the problem.