Virus Analysis Sites

In the Spring 2005 Computing News (http://cc.uoregon.edu/cnews/spring2005/virustotal.htm) we briefly explained how you could submit a suspicious attachment to VirusTotal (http://www.virustotal.com/) for scanning and identification by several antivirus products. Because of the interest in that article, we wanted to call attention to two other helpful virus information sites:

• Jotti's Malware Scan (similar to VirusTotal): http://virusscan.jotti.org/
• Norman's Sandbox Information Center (a more extensive detection system): http://sandbox.norman.no/

More on Norman's Sandbox: For those who may not be familiar with the concept of a "sandbox," it's a carefully isolated facility that allows you to test potentially dangerous programs in a controlled and well-equipped lab environment. By using a sandbox, you can learn what a virus might do in the wild without any possibility of its escaping and wreaking havoc on real systems or the Internet.

Norman's sandbox web interface allows you upload a suspicious file for examination and sends a report by return email with information about what it saw, including:

• identity of the virus found, if any
• any files created or modified by the virus
• any registry values created or modified by the virus
• any process startup information (e.g., "will automatically restart after boot," etc.)
• a listing of the host or hosts that the virus may be attempting to contact to register itself with its controller, download updates, receive denial of service targeting instructions, and so on

The sandbox site also allows you to search a database of samples that others have previously submitted. The Norman Sandbox website is a real resource, almost like having your own malware analyst on site.