Posts Tagged ‘AntiSpyware’

51 Free Tools To Stay Invisible On The Internet

Friday, October 14th, 2011

If you value your rapidly disappearing privacy while surfing the Internet you need to know about these tools. Whether you want to protect yourself from snoopers, want to spy on those out to get you, or want to be able to track trends that you know will lead to something big, then these tools will help you get the job done. The best part about them is they are FREE!

Link: The Survival Station

Malware Cookbook Tools Online

Sunday, April 24th, 2011

For all the folks who bought DVD-less Kindle versions of the cookbook, all the folks who received a DVD with their paper copy but want updates to the tools, and even for folks who just want to experiment with the tools without buying the book, please feel free to download with an SVN client here:

http://code.google.com/p/malwarecookbook/

In order by Chapter, here’s a quick description of what’s on the DVD. It also includes malware.py, the set of Volatility plugins for the upcoming 1.4 release, a bunch of sample memory dumps from malware infected systems, and full color images for screen shots in the book.

* torwget.py: Multi-platform TOR-enabled URL
* wwwhoney.tgz: CGI scripts to accept submissions from nepenthes and dionaea honeypots
* clamav_to_yara.py: Convert ClamAV antivirus signatures to YARA rules
* peid_to_yara.py: Convert PEiD packer signatures to YARA rules
* av_multiscan.py: Script to implement your own antivirus multi-scanner
* pescanner.py: Detect malicious PE file attributes
* ssdeep_procs.py: Detect self-mutating code on live Windows systems using ssdeep
* avsubmit.py: Command-line interface to VirusTotal, ThreatExpert, Jotti, and NoVirusThanks
* dbmgr.py: Malware artifacts database manager
* artifactscanner.py: Application to scan live Windows systems for artifacts (files, Registry keys, mutexes) left by malware
* mapper.py: Create static PNG images of IP addresses plotted on a map using GeoIP
* googlegeoip.py: Create dynamic/interactive geographical maps of IP addresses using Google charts
* sc_distorm.py: Script to produce disassemblies (via DiStorm) of shellcode and optionally apply an XOR mask
* vmauto.py: Python class for automating malware execution in VirtualBox and VMware guests
* mybox.py: Sample automation script for VirtualBox based on vmauto.py
* myvmware.py: Sample automation script for VMware based on vmauto.py
* analysis.py: Python class for building sandboxes with support for analyzing network traffic, packet captures, and memory
* RegFsNotify.exe: Tool to detect changes to the Registry and file system in real time (from user mode without API hooks)
* HandleDiff.exe: Tool to detect changes to the handle tables of all processes on a system (useful to analyze the side-effects of code injecting malware)
* Preservation.zip: Kernel driver for monitoring notification routines, preventing processes from terminating, preventing files from being deleted, and preventing other drivers from loading
* cmd.exe: Custom command shell (cmd.exe) for logging malware activity and backdoor activity
* tsk-xview.exe: Cross-view based rootkit detection tool based on The Sleuth Kit API and Microsoft’s Offline Registry API
* HTMLInjection Detector.exe: Detect HTML injection attacks on banking and financial websites
* routes.pl: RegRipper plug-in for printing a computer’s routing table
* pendingdelete.pl: RegRipper plug-in for printing files that are pending deletion
* disallowrun.pl: RegRipper plug-in for printing processes that malware prevents from running
* shellexecutehooks.pl: RegRipper plug-in for printing ShellExecute hooks (a method of DLL injection)
* dumpcerts.pl: Parse::Win32Registry module to extract and examine cryptography certificates stored in Registry hives
* somethingelse.pl: Parse::Win32Registry module for finding hidden binary data in the Registry
* scloader.exe: Executable wrapper for launching shell code in a debugger
* scd.py: Immunity Debugger PyCommand for finding shellcode in arbitrary binary files
* findhooks.py: Immunity Debugger PyCommand for finding Inline-style user mode API hooks
* pymon.py: WinAppDbg plug-in for monitoring API calls, alerting on suspicious flags/parameters and producing an HTML report
* xortools.py: Python library for encoding/decoding XOR, including brute force methods and automated YARA signature generation
* trickimprec.py: Immunity Debugger PyCommand for assistance when rebuilding import tables with Import REconstructor
* kraken.py: Immunity Debugger PyCommand for cracking Kraken’s Domain Generation Algorithm (DGA)
* sbstrings.py: Immunity Debugger PyCommand for decrypting Silent Banker strings
* rundll32ex.exe: Extended version of rundll32.exe that allows you to run DLLs in other processes, call exported functions, and pass parameters
* install_svc.bat: Batch script for installing a service DLL (for dynamic analysis of the DLL)
* install_svc.py: Python script for installing a service DLL and supplying optional arguments to the service
* dll2exe.py: Python script for converting a DLL into a standalone executable
* DriverEntryFinder: Kernel driver to find the correct address in kernel memory to set breakpoints for catching new drivers as they load
* windbg_to_ida.py: Python script to convert WinDbg output into data that can be imported into IDA
* WinDbgNotify.txt: WinDbg script for identifying malicious notification routines

Link: MNIN Security

SSDownloader fetches popular antivirus, antimalware, and firewall apps

Wednesday, January 19th, 2011

If you’re constantly being called on by friends and family to provide tech support, troubleshooting, and computer advice, you’ve probably had to install security applications on other people’s computers more than once. Heck, you may do it just about every day. If so, you might want to grab SSDownloader — an open source app which makes downloading current versions of popular antivirus, antimalware, firewall, and utility software a snap.

When you launch the portable app, it automatically refreshes its database and presents an excellent selection of free security apps for Windows computers. Included are popular free apps like Avast!, Security Essentials, Malwarebytes, HiJack This, Comodo Firewall, CCleaner, AutoRuns, and Process Explorer — as well as loads more.

Trial versions of programs like Nortonare also provided in case you’re trying to appease someone who demands “name brand” protection (yes, there are still people like that — and they’re not all familiar with our go-to apps).

SSDownloader is an excellent way to make sure you’ve always got up-to-date installers at the ready. Need something with more options? Check out Anti-Malware Toolkit — or Ketarin, if you’d rather go the DIY route.

Link: DownloadSquad