Tips for manually analyzing virus samples in Linux

In Linux, it is quite convenient to analyze virus samples. Let's take a look at how:

Principle: Compare files with different md5 values.

Operation Background:

1. XP installation CD;

2. virus sample;

3. USB flash drive;

4. Ubuntu 7.10 LiveCD

5. Comparison between md5 and programs that convert the binary file format

Procedure:

1. Complete formatting and install Windows at the same time (you can also use ghost to go back, but be sure to pay attention to the possible virus infection of other disks)

2. Export the Registry in Windows. Put the exported file in the root directory of the C drive. Here I name it 1.reg

3. Go to the Ubuntu system. Note: select the Simplified Chinese mode before entering f2.

4. Attach disk C:

Mkdir/mnt/hdd1 (Production System C disk mount point)

Mount-t ntfs-o iocharset = cp936/dev/hdd1/mnt/hdd1 (mount the system drive C to/mnt/hdd1, note that the file format and device number depend on the actual situation)

5. Mount the USB flash drive:

Mkdir/mnt/usb (create a usb disk mount point)

Mount-t vfat/dev/sda1/mnt/usb (mount the usb flash drive to/mnt/usb, also pay attention to the file format and device number)

6. Add the exported registry information to the USB flash drive:

Assume that the test directory already exists on the USB flash drive and three programs, parse. sh, parseWinReg, and ShowList, are included in the test directory.

Cp/mnt/hdd1/1.reg/mnt/usb/test (copy the export registry to the/mnt/usb/test directory)

Cd/mnt/usb/test (enter the usb disk test directory)

./ParseWinReg 1.reg origreg (convert the exported registry to generate origreg)

7. Calculate the md5 value of all files on drive C:

Rm/mnt/hdd1/pagefile. sys (this file is too large to affect the computing speed, delete)

/Mnt/usb/test/parse. sh/mnt/hdd1/>/mnt/usb/origfile (calculate the md5 value of the disk file and export the result to origfile under the usb disk test directory)

8. re-enter Windows and run the virus file again.

Note: first put the virus file into the disk, unplug the USB flash drive, unplug the network cable, and then activate it!

9. Repeat steps 3, 4, 5, 6, and 7.

Mkdir/mnt/hdd1

Mount-t ntfs-o iocharset = cp936/dev/hdd1/mnt/hdd1

Mkdir/mnt/usb

Mount-t vfat/dev/sda1/mnt/usb

Cp/mnt/hdd1/2.reg/mnt/usb/test (assume that the exported registry is 2.reg)

Cd/mnt/usb/test

./ParseWinReg 2.reg newreg

Rm/mnt/hdd1/pagefile. sys

/Mnt/usb/test/parse. sh/mnt/hdd1/>/mnt/usb/newfile

10. Now, we have obtained the original system information: origreg, origfile, and the information following the virus: newreg, newfile

11. Compare file differences: diff-Nur origfile newfile> filediff

12. Compare registry differences: diff-Nur origreg newreg> regdiff

13. Analyze filediff and regdiff, and draw a conclusion.

Tips for analysis: In general, the virus is released first, which is changed (infected). If the md5 value is paired (one and one -), that line is generally not. If there is no mark above, it means no. We will delete useless files, leaving only one or only one-. It is best to see the file path, that is, to get a virus file or infected file.