Re: Bow and question

2008-01-08 Thread Juan Carlos Montes Senra
Shachar Shemesh escribió: > But what good is a malware study tool if the malware can trivially > detect it's there? What if it doesn't infect the machine, but just run > differently? > > There are Windows tools that do similar things to what you need (check > out the sys-internals web site), whe

Re: Bow and question

2008-01-08 Thread Juan Carlos Montes
Shachar Shemesh escribió: > I think you should be aware that Wine is no replacement for a security > tool. If you run a malware using Wine, it is possible for this malware > to interact directly with your Linux machine, bypassing your protection. > > Shachar I know it, but we can control all ac

Re: Bow and question

2008-01-08 Thread Shachar Shemesh
Juan Carlos Montes wrote: > Shachar Shemesh escribió: > >> I think you should be aware that Wine is no replacement for a security >> tool. If you run a malware using Wine, it is possible for this malware >> to interact directly with your Linux machine, bypassing your protection. >> >> Shachar

Re: Bow and question

2008-01-06 Thread Shachar Shemesh
Juan Carlos Montes wrote: > Hi all, > > I am new in this list, so... Hello!!! > > Well, I work in a CERT and we are create a automatic malware detection tool > with > wine. > > I think you should be aware that Wine is no replacement for a security tool. If you run a malware using Wine, it is

Re: Bow and question

2008-01-03 Thread Juan Carlos Montes Senra
Dan Kegel escribió: > > So how well is Wine running the malware you're interested in? > > - Dan Thanks, I found a lot options in the web but didnt know DEFAULT_DEBUG_CHANNEL const, :) So, we only try a few malware, [ 3 files ], but all ran correctly. Two files was compiled in VisualC, and the l

Re: Bow and question

2008-01-03 Thread Juan Carlos Montes Senra
Dan Kegel escribió: > So how well is Wine running the malware you're interested in? > - Dan Thanks, I found a lot options in the web but didnt know DEFAULT_DEBUG_CHANNEL const, :) So, we only try a few malware, [ 3 files ], but all ran correctly. Two files was compiled in VisualC, and the last o

re: Bow and question

2008-01-03 Thread Dan Kegel
Juan wrote: > I want know where can i find the option to WINEDEBUG. > In this time, we are used trace+file, trace+reg. > Can trace the sockets?? When I need to figure out WINEDEBUG flags, I always use grep, e.g. [EMAIL PROTECTED]:~/wine-git/dlls$ grep DEFAULT_DEBUG ws*/*.c ws2_32/async.c:WINE_DEF

Bow and question

2008-01-03 Thread Juan Carlos Montes
Hi all, I am new in this list, so... Hello!!! Well, I work in a CERT and we are create a automatic malware detection tool with wine. On the first part the project we use the debug log to monitorize the file access, registry... I want know where can i find the option to WINEDEBUG. In this time,