Tips for manually analyzing virus samples in Linux

Principle: Compare files with different md5 values.
Operation Background:
1. XP installation CD;
2. virus sample;
3. USB flash drive;
4. Ubuntu 7.10 LiveCD
5. Comparison between md5 and programs that convert the binary file format
Procedure:
1. Complete formatting and install Windows at the same time (you can also use ghost to go back, but be sure to pay attention to the possible virus infection of other disks)
2. Export the Registry in Windows. Put the exported file in the root directory of the C drive. Here I name it 1.reg
3. Go to the Ubuntu system. Note: select the Simplified Chinese mode before entering f2.
4. Attach disk C:
Mkdir/mnt/hdd1 (Production System C disk mount point)
Mount-t ntfs-o iocharset = cp936/dev/hdd1/mnt/hdd1 (mount the system drive C to/mnt/hdd1, note that the file format and device number depend on the actual situation)
5. Mount the USB flash drive:
Mkdir/mnt/usb (create a usb disk mount point)
Mount-t vfat/dev/sda1/mnt/usb (mount the usb flash drive to/mnt/usb, also pay attention to the file format and device number)
6. Add the exported registry information to the USB flash drive:
Assume that the test directory already exists on the USB flash drive and three programs, parse. sh, parseWinReg, and ShowList, are included in the test directory.
Cp/mnt/hdd1/1.reg/mnt/usb/test (copy the export registry to the/mnt/usb/test directory)
Cd/mnt/usb/test (enter the usb disk test directory)
./ParseWinReg 1.reg origreg (convert the exported registry to generate origreg)
7. Calculate the md5 value of all files on drive C:
Rm/mnt/hdd1/pagefile. sys (this file is too large to affect the computing speed, delete)
/Mnt/usb/test/parse. sh/mnt/hdd1/