0

My AV solution detected a program as a virus. Can someone point me in the right direction to learn more about the following points?

1) What exactly about the program was determined as the triggering factor? If a classification is given, such as "Trojan.something", do any AV solutions say exactly what the triggering factor was to place it in that category?

2) I know some people sandbox malware and learn what it's impact would have been. What is the best way to go about this? I assume there are better methods than simply making a trash VM with a debugger installed?

3
  • If you have the name of the virus, some of the AV program locations will give an in-depth analisis of the method of operation , file effect and registry change (of the virus itself). Names (plural) can be aquired from an upload to VirusTotal, then using a search engine. Then skipping all the (more or less) fraud locations that list anything to SEO and sell thier program. You may find most of the stuff already analised , or a very close variation of.
    – Psycogeek
    Jun 19, 2015 at 15:24
  • 1. I think you will find that all AV companies keep their detection algorithms secret (to prevent virus authors working out how to bypass detection). 2. Best left to the experts ;)
    – DavidPostill
    Jun 19, 2015 at 15:24
  • 1
    1) Yes, there are some sites that can tell you more about malware, how it works and what it does. For example see SecureList. 2) Probably the best way is using virtual machines. Take HDD snapshot before and after running malware, compare and get what was changed.
    – Jet
    Jun 19, 2015 at 15:28

0

You must log in to answer this question.

Browse other questions tagged .