Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am using my virtualbox to dump the API calls for malware by using a tool. I did saved a "clean/uncontaminated" state before I executed the malware.

However I did not find a way to revert back after I successfully executed the malware. Is there anyway by using menu or something.

Previously I saw a way by using vboxmanage command but I forgot the keyword to do that (revert back to the certain point of snapshot). Also, how many snapshots can we create by using VirtualBox?

I may consider other method too - creating clones. But if the number of malware is thousands.. that might not be a good idea as I have to do it manually if that's the case.

share|improve this question

migrated from stackoverflow.com Dec 29 '12 at 18:16

This question came from our site for professional and enthusiast programmers.

    
Just for you to consider: Are you aware that there are bits of malware out there which can detect when they are executed in a VM and behave differently? Are you further aware that there is also malware which is capable of breaking out of a virtual machine by exploiting security vulnerabilities in the hypervisor and execute malicious code on the host machine? –  Philipp Dec 29 '12 at 14:17
    
I'm sorry when this sounded berating, but I just want to make sure that you aren't relaxing in a state of false security and intentionally experiment with malware on the same physical machine where you have sensitive data. –  Philipp Dec 29 '12 at 14:29
    
Yes, I am aware of that. These calls (virtual machine detection) could also be detected in the API call hooking process. The host is Linux and the guest is Windows.. so AFAIK it is fairly safe. The same process actually being done by current sandboxes (Anubis, CWSandbox/GFI Sandbox) –  najmi Dec 29 '12 at 16:44
    
@najmi : I can't help on this but I can give you like to better tool: Ether: Malware Analysis via Hardware Virtualization Extensions –  Grijesh Chauhan Dec 29 '12 at 18:13
    
can this question being replicated to security.stackexchange.com? –  najmi Dec 30 '12 at 3:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.