gHacks Technology News | Latest Tech News, Software And Tutorials » malware protection

Analyse Software In A Remote Secure Environment

Martin Brinkmann — Sun, 29 Mar 2009 13:01:30 +0000

Several remote services are available to analyze submitted software programs or files for malicious contents like computer viruses or trojans. Among them are Virus Total which uses more than a dozen different antivirus engines to scan submitted files. All of them have one thing in common: They scan and analyze the files using signature databases and maybe heuristic methods which means that they might miss malicious code. The benefit of a security scan in a remote secure environment is that the uploaded files or computer software programs get executed and analyzed.

CW Sandbox is a web service with a similar looking frontend like all the other online virus scanners. What sets it apart is the remote secure environment that it uses to execute and analyze the files that get uploaded. It uses a sandbox to execute the file and will log all system activity that is connected to the file launch. The file analysis contains a summary but also detailed changes to the file system, the Windows Registry and network activity plus a technical summary with additional information.

Each report is divided into different categories. The File Changes for example contains categories that list newly created, opened and deleted files and a summary that lists all file operations in chronological order. The network activity analysis will detail connections that have been established including host names, IP addresses and if data has been posted to one of those addresses.

The submit form on the website of the project accepts files with a maximum size of 16 Megabytes. Zip files with up to 50 files can be uploaded to the service as well if the password is set to “infected”. A link to the file analysis will be send to the email address that the user enters when submitting the files.

CW Sandbox is an excellent online service that provides an in depth analysis of submitted files. The only drawbacks are the 16 Megabyte file size limit and that the reports are send to an email address with an undefined wait time. A ticket system on the website directly detailing the place in queue and the estimated wait time would be really helpful for users who are submitting files to the service.

Free A-Squared Anti-Malware

Martin Brinkmann — Sat, 02 Aug 2008 08:53:55 +0000

The Giveaway of the Day website is offering some very nice software packages from time to time. Today’s offer is A-Squared Anti-Malware in version 3.5 from Emsisoft which can be freely downloaded and installed from the website. The software developers can spread their software to a wide variety of users and gain some free marketing from websites like mine who write about it.

The offer is good for another day which means you have enough time to download and install the software package. The usual retail price for the software is $39.95.

A-Squared Anti-Malware tries to be the ultimate solution in the fight against malicious software, it protects the computer against all kinds like trojans, keyloggers and rootkits meaning it is more than just an antivirus software.

It’s a great PC software especially for the price. It’s especially of interest for those users who missed the A-Squared Anti-Malware offer the last time.

Free A-Squared Anti-Malware One Year License

Martin Brinkmann — Mon, 10 Mar 2008 16:51:40 +0000

Seems to really be a special time in that we are living, free good software popping up every week that is good for at least one year. Raymond seems to be especially good at finding those gems because this new one is coming right from his blog. A-squared Anti-Malware is, as the name suggests, an anti-malware scanner, which retails for $39.95.

All you need to do is to visit the website of the developers Emsisoft and create a new user account which is absolutely free and easy. Just enter your name and email and you are ready to go. An email will be dispatched that contains the password for that account, the username being your email address.

Login into the Customer Center once you have received the email and click on the Manage Licenses entry in the left menu. This will load all valid licenses with the option to extend them or add new ones using coupons.

Use the Convert a coupon code and enter nanova5736 as the coupon code. This will give you a valid one year license for A-Squared Anti-Malware starting at the day you have entered the coupon code.

Download A-Squared Anti-Malware afterwards and enter the same account credentials that you have used to register the account with. The license information will be automatically picked up from the database.

Once you login it will show you that you have a full license.

Runscanner

Martin Brinkmann — Sat, 29 Dec 2007 10:52:30 +0000

Runscanner is a security scanner much like Hijack This but aims to be helpful for all kinds of users. It has three different modes depending on the experience level of the user, they are called Beginner, Classic and Expert Mode. The Beginner Mode scans the system and writes the results in a log file that can be given to security experts in various forums that are mentioned on the Runscanner homepage.

It is aimed at novice users who suspect that something is wrong with their computer but do not have the knowledge to interpretate and fix the issues by themselves. The Classic Mode is giving the user more information and a way to quickly fix common problems. It does not provide full information like the Expert Mode that displays lots of information.

Users of all three modes can always use a service called Online Malware Analysis which can be of great help. It compares the MD5 hash of the scanned files on the user’s system with those in the Runscanner database. MD5 hashes have to be the same if the same unaltered program version is used.

The Online Malware Analysis uses green, purple and red icons to rate the item. Green items are checked and safe, purple items are not yet checked and red items are not safe.

This is a great way of getting more information about current services, programs and processes on your system without having to consult another person.

Runscanner has several features that make it stand out even more. It offers right-click options to compare the MD5 hash with authority websites like Castle Cops and File Advisor, perform a Google search on the item, upload the file to Virus Total and open the file folder and Registry location.

Another aspect that is worth mentioning are so called Run files. As I said earlier novice users can create a log file that they can send to experts who analyze it. These experts can create a so called Fun file specifically designed to be run in Runscanner. The novice user can load the run file and execute the fixes that the expert has authorized.

Oh, it is free of course and portable. You can run it from any location on your computer.

Firefox 3 Alpha 8 is out

Martin Brinkmann — Sat, 22 Sep 2007 07:21:30 +0000

A new alpha version, to be precise Alpha 8, of the upcoming Mozilla Firefox 3 browser has been released two days ago which introduced several new features such as a build in malware protection which can be tested on a publicly available test environment on the Mozilla website.

Add-ons have to use a secure method for auto-updating from now on which means that they either have to be delivered using SSL or digital signatures. The real progress can be seen when you look at the list of bugfixes from alpha 7 to the current version. More than 1100 bugs have been fixed in that time which is quite an achievement.

Several bugs prevail on the other hand. One for instance prevents that Firefox 3 is starting in Windows Vista if parental controls are enabled. If you have been using prior alpha versions of Firefox 3 you should definitely download the new one and replace the old alpha with it.