Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am running Windows XP in a VM. I want to download a few applications and install the one by one and check if they potentially can be a virus. I assume virus would need to add something to the startup folder, or the application in the startup section in the registry or add a service. What else might it do to become active?

Anyway, how can I check to see if a program may be a virus? I use hijack this to get a list of processes and I simply compare it from before I installed to after and see if there's anything different. Is this good enough? My main OS is Windows 7 but I do not have that in a VM and don't see a reason to test with that.

share|improve this question
4  
Bear in mind that determining whether a program is or is not a virus is essentially equal to the halting problem: you can solve it in special cases, and you can get pretty confident in many more cases, but it's generally not possible to be certain. –  David Thornley Feb 15 '10 at 14:53

4 Answers 4

up vote 5 down vote accepted

It's not easy to deal with suspicious files, the first thing to advise it's to rather use an alternative secure source.

However if you want to test the file in a VM, here are some good tools:

All-In-One System Explorer:

Other usefull tools:

But finally, the only way to be sure is to disassemble the software and understand the asm code, a very fastidious task. So return to the first advice...

share|improve this answer

Monitoring processes alone is not enough. Malicious programs can attach themselves to running processes so you wouldn't notice a difference.

Maybe install an antivirus in the VM? Avira has a free version which should be up to the task. If you don't feel like installing anything, maybe an online scanner would be more suitable.

share|improve this answer
    
I am worried that an antivirus wont recognize it as a virus. –  acidzombie24 Feb 14 '10 at 9:41
    
AV's that use heuristics are generally better at this. They try to pick up on suspicious behavior rather than only using a virus database to compare against. I believe avira uses heuristics. If you're really scared you can run such programs in a sandbox with sandboxie ( sandboxie.com ). –  John T Feb 14 '10 at 9:49
    
@acidzombie24 If antivirus doesn't recognize it, why would you? –  ceejayoz Feb 14 '10 at 19:33
    
@ceejayoz because he's smarter than a piece of software –  fluxtendu Feb 15 '10 at 0:00
    
@fluxtendu And yet, brute forcing beats Gary Kasparov in chess. Same is true with viruses, generally - there are so many varieties, doing so many things, using so many sneaky techniques, that antivirus is likely to be far better at catching them. –  ceejayoz Feb 15 '10 at 12:27

Post-detection is not really useful; a virus is likely to mess with your system immediately and you don't want to get to that point of having a rampant problem (excessively duplicating processes, stripped icons on .exe files, repeated system errors with no apparant reason, busy internet connection ....)

The best security is prevention: avoid untrustworthy sources such as public peer-2-peer, free download hosts (rapidshare, etc.), direct blog links and e-mail attachments. Although some software search sites are legit, some are definitely not - if you find something interesting, seek the author's website and download from there instead!

Try a sandbox software to run the application without the ability to do unwanted changes. A test VM with no write access to your main drives remains a reliable way to test something without having to mess with rights - you can really let it in the wild.

Finally, a good old virus/spyware scan never hurts...

share|improve this answer
    
Thats what i have been doing except using VMware as my VM instead of sandboxie. Right now theres are apps i want to use on my main machine, so this question is to find out how i can check before moving. So you recommend just using a antivirus? I guess i'll get some and just scan them in my VM so my main system doesnt get slow. –  acidzombie24 Feb 14 '10 at 14:12

How do i check if a program can potentially be a virus?

If you don't have any resident protection software installed, there are other methods to scan files, e.g. with A-squared's excellent Command Line Scanner, which is free (for personal use) and portable.

Also, many download sources do provide checksum or hash sum information so the integrity of a file can be verified.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.