MoonPoint Support Logo

 

Shop Amazon Warehouse Deals - Deep Discounts on Open-box and Used ProductsAmazon Warehouse Deals



Advanced Search
April
Sun Mon Tue Wed Thu Fri Sat
       
13
 
2010
Months
Apr


Tue, Apr 13, 2010 8:35 pm

Online File Analysis

In performing PC support, by far the most common complaint I've had to deal with has been malware infections. For any files I download, I normally submit them to at least one and sometimes all of the following sites, which will scan a file you upload to the site with multiple antivirus programs:

Sometimes, a particular antivirus program won't yet recognize some new malware, but other such programs will recognize it. Of course, one also has to bear in mine that false positives do occur, so if only one antivirus program reports a program is infected it could be a false positive.

I also use Sunbelt Software's CWSandbox on-line malware analyzer. You can submit a file to that service and it will install the software within a sandbox on a Sunbelt system and then give you the results of the analysis of the file submitted, including files and registry entries created, network activity, and process details. For a sample of a report see the report created for the installation file for Totally Free Burner named TotallyFreeBurner.exe, which I submitted to the analysis service:

Malware Report for ID: 12057226

Note: Totally Free Burner doesn't contain malware; I just normally check all software before I install it on my system or someone else's system.

If you know the MD5 checksum for a file, which the virus scanning services I listed above provide, you can determine if there is an existing Sunbelt CWSandbox report for it by using a URL of the following form:

http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=<md5 checksum>

E.g., http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=dece7e4cbd0c3ca7d6523fc0b5ee95b1 for the 6.0 version of Totally Free Burner I downloaded from the developer's website and then uploaded to Sunbelt's CWSandbox service.

There are also a number of free tools that you can use to determine the MD5 checksum of a file. The MD5 checksum is determined by performing a mathematical calculation on the contents of a file and should be unique for a given file (there is a very slim possibility that may not be true, but for all practical purposes you can consider it unique).

FileAlyzer© from the developer of Spybot Search & Destroy will show you the MD5 checksum for a file, in addition to providing other information, as will digestIT 2004. Both are free.

[/security/antivirus] permanent link

Valid HTML 4.01 Transitional

Privacy Policy   Contact

Blosxom logo