0

I need to catch a virus/malware on purpose on a VM and demonstrate the infection through windows logs analysis. I am using both syslog and eventlog analyzer, but no sign of events logged. I caught on purpose some low level malware (from toolbars installations and browsers hijacking tools). Do i need something more evil ?

Can you guys help me to figure out what do i need to do?

Improve this question
4
  • What version of Windows are you using and what antivirus or other software are you using to detect malware on the system?
    – moonpoint
    Jan 24, 2015 at 15:07
  • Windows 7 pro 32. I do not have any AV, also the firewall is disabled.
    – David Torreggiani
    Jan 24, 2015 at 15:27
  • If you don't have any antivirus software, what are you expecting to create a log entry that will provide evidence of the infection? Is there behavior specific to some piece of malware that you are expecting to be logged?
    – moonpoint
    Jan 24, 2015 at 15:58
  • I will install the AV to create log entries, thank you. Nothing specific, I'm trying to demonstrate an infection using lowest security settings on IE and a vulnerable version of adobe reader. Do you know any known infected websites?
    – David Torreggiani
    Jan 24, 2015 at 16:19

1 Answer 1

Reset to default
1

Generally, viruses/malware are specifically designed to do nothing the user can see including generating log files and/or events in the event viewer.

You would have to change the event viewer to log/monitor all registry,file, and network events and then you would have an even larger problem. Monitoring like this generates 100's of entries per second. Your program would then have to sift out of the stream of event the good events from the bad events.

If this were simple anti-virus companies would have beaten bad guys ages ago and they would have give up writing viruses, but it is very complex.

I have setup monitors like this to diagnose miss-behaving programs, but with in minutes you have 100,000+ events which you have to sift through manually.

Then there are rootkits which are specifically designed to thwart even this kind of monitoring.

Try this program, but be aware you will get 1,000,000 events fast. https://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .