If I download a virus and save to a floppy....how can I open it safely to see what it is made of? Can anyone give me a safe way to look at the inner workings of virii w/out getting infected? :confused:
Printable View
If I download a virus and save to a floppy....how can I open it safely to see what it is made of? Can anyone give me a safe way to look at the inner workings of virii w/out getting infected? :confused:
open it in an edditor...
and to be safe make that a unix editor...
If you have a Tux box with Gnome or KDE you already have an editor. If you have WinNT, 2000 Pro or XP. Get this handy little program. Emacs port for Windows.
http://www.tardis.ed.ac.uk/~skx/win/...#Download19346
Just be careful, and I don't recomend playing with any .vbs scripts on a Win 98 box. Unless you are very sure as to what you are doing. As far as otheer virii, rip em' apart and see what makes them tick. Also if you are going to do this on a Win32 platform. Don't enable single click to open files or active desktop. As well uncheck the hide known file extentions in file properties. Clicking on stuff in Winblows with reckless abandon is dangerous territory.
Hope this helps.
This is also a very good one. It ports to about any OS.
http://www.vim.org/
be carefull...i i remmeber when i tried fiddeling with that ****...made a mistake and ran it....learned NEVER to do that one again
It all depends on how you have downloaded the virus and in what format.
If you have the assembly code (as a .asm file), then you can open it in any text editor (e.g. notepad or VI). It's impossible for an asm file to infect your computer because it can't be executed properly.
Take more care with .vbs files, merely double clicking on these in windows can infect your system. Either be very careful or look at them in Unix/Linux instead - that way they can't infect your machine.
Finally, if you get hold of a virus in it's binary version (usually as a .exe file), then I would recommend that you disassemble the executable file to get the assembly source code. This is the only real way that you can examine this type of virus without infecting your system.
To get a disassembler, look on Google and see which ones pick your fancy.
Good luck! :)
i gave ya some greenies...cause that was an actual relevant..non-idiotic lame assed kiddie question...unlike soooooo many others....
and my hint...if your really serious, i'd dedicate a box to messin about (learning that is...)...you can probably find a PII at a used computer store for less than a 100 bucks...(or if you're like me you have 4 or 5 retired systems sitting around cause they don't do windows2k...)...dl a copy of linux and go to town...
this way you're not risking anything important and if something does get out of hand..(altho...being linux your wouldn't be at risk for 9x% of viruses anyways...) .a reformat won't be a huge prob...
you can also make it a dual boot win9x linux system...take apart the viruses on linux...and them run em to see what they do on win9x...hehe...just keep this configuration disconnected from the net...there are too many badtrans, majistr and klez et.al running loose already...
Caution is the main word here - decompile the code and take a per but don't double click could be a painfull mistake ;)
great post thanks the replys where great as well. Keep me updated on how is goes.
Kindred69
if your running windows, remove the file's extension to be safe. then when you double click on the file a box will apear letting you chose which program do you want to use the file. pick an editor like notepad and view the thing in extended ascii code which chances are you wont understand (i dont either). or you could use the ms-dos text editor. the command is EDIT
if you are running *nix read the other posts.
that's one good idea blackh0le.. rename the .exe or .com or .vbs or whatever file to .virus or something... I usualy rename files I'm working on to .tmp it's your choice
And you might need a hex editor...
a good free one for windows is winhex.. http://www.winhex.com/
some files don't like to be txt edited (one space can make a difference)..
so I usualy use a hexeditor
if you really want a newbie tutorial on how virii work, there is actually a file in the downloads section of this website called "codebreakers" i doubt unless you know asm that you can decompile a irus and understand how it works on certain OS's. i would just use "w32DASM" otherwise called "winDASM," you can find it anywhere. just make a copy of your virus with a .tmp.
"Don't double-click it" Ah that takes me back. Nothing more irritating than pulling apart a virus and rebooting to find:
Unable to read drive C:
Abort, Retry, Fail
Just another word of warning, making sure its burned in your head.
On another note anybody remember Jr_HaXoR he was on this site a long while ago. Seemed smart I read a few of his posts. A little bit evil though.
backups are for newbies... just kidding
preferable use a dummy box for ripping appart virii...
Not a mission critical one... Neither your parrents puter they write their letters and other important things on...
one good lesson learned..
you still have to be careful because you can accidentally open the wrong thing and then your computer could go bye bye