| View previous topic :: View next topic |
| Author |
Message |
Meriadoc
Cadet
Joined: Sep 12, 2006
Posts: 4
Location: Uk
|
 Posted: Tue Sep 12, 2006 9:14 am Post subject: svv |
|
|
Hi,
I've just come to the end of my current job so have some spare time to complete a project - information/unhooker/connections and scan for hidden objects tool.
I have also looked at various source and plan to use my own versions.
One I have looked at extensively is svv and plan to run with something from it, but have some problems that I'm wondering if anyone else have encountered, mainly in the results.
In a vm, xp playground I'm getting different results on a clean system. - System infection level = 0, nothing suspected was detected...as expected, to 5 - deepred  when scanning again.
Can anyone here, or mods, share any relevant experiences with svv, perhaps explaining the reasons why the results may vary.
vmworkstation, xppro.
|
|
| Back to top |
|
 |
PCBruiser
SRT Team Lead
Forums Admin
Joined: May 11, 2005
Posts: 11723
|
| Posted: Tue Sep 12, 2006 2:48 pm Post subject: |
|
|
In order to work, some types of software have to hook into the OS kernal. These typically are all firewalls, HIPS, some anti-virus and anti-malware software and virtual machines and sandboxes. So, it is scarcely surprising that SVV is finding the VM hooks. Having said that, I cannot explain why multiple scans are reporting differing results.
_________________
Don't read? Can't learn!
|
|
| Back to top |
|
|
Meriadoc
Cadet
Joined: Sep 12, 2006
Posts: 4
Location: Uk
|
| Posted: Wed Sep 13, 2006 9:06 am Post subject: |
|
|
| PCBruiser wrote: | | In order to work, some types of software have to hook into the OS kernal. These typically are all firewalls, HIPS, some anti-virus and anti-malware software and virtual machines and sandboxes. So, it is scarcely surprising that SVV is finding the VM hooks. Having said that, I cannot explain why multiple scans are reporting differing results. |
Hi,
thanks for replying PCBruiser. Yes, I always take note in whats hooking into the system especially after introducing something new, and as you have said legit entries will be in the results.
I did not presume to leave a log file, but if I may leave a paste of svv <check> without any details extension this will be short and show the two different results I've been experiencing.
If no one knows of a bug or known reason why this could happen with the information I have given I will just have a look at that system again, but at the moment I just cant see what is doing this.
Okay, maybe I will start over, but still investigate this incase I have found a problem with the scan but more than likely I'm over-looking something.
System Virginity Verifier 2.3, January 2006
written by Joanna Rutkowska
invisablethings.org
C:\>svv check
Important module ntoskrnl.exe not found
SYSTEM INFECTION LEVEL: 0
--> 0 - BLUE
1 - GREEN
2 - YELLOW
3 - ORANGE
4 - RED
5 - DEEPRED
Nothing suspected was detected.
----------------------------------------------------------------------------
C:\>svv check
Important module ntoskrnl.exe not found
ntdll.dll (7c900000 - 7c9b0000)... suspected! (verdict = 5).
kernel32.dll (7c800000 - 7c8f4000)... suspected! (verdict = 5).
ADVAPI32.dll (77dd0000 - 77e6b000)... innocent hooking (verdict = 2).
USER32.dll (77d40000 - 77dd0000)... suspected! (verdict = 5).
SYSTEM INFECTION LEVEL: 5
0 - BLUE
1 - GREEN
2 - YELLOW
3 - ORANGE
4 - RED
--> 5 - DEEPRED
SUSPECTED modifications detected. System is probably infected![/i]
|
|
| Back to top |
|
|
wng_z3r0
MRU Teacher
Joined: Mar 21, 2005
Posts: 1248
|
| Posted: Wed Sep 13, 2006 12:15 pm Post subject: |
|
|
svv chech /a /m
please
_________________
Proud member of Alliance of Security Analysis Professionals since 2005
Microsoft MVP-2006
|
|
| Back to top |
|
|
Meriadoc
Cadet
Joined: Sep 12, 2006
Posts: 4
Location: Uk
|
|
| Back to top |
|
|
wng_z3r0
MRU Teacher
Joined: Mar 21, 2005
Posts: 1248
|
| Posted: Thu Sep 14, 2006 9:46 pm Post subject: |
|
|
Anything else you need help with?
wng
_________________
Proud member of Alliance of Security Analysis Professionals since 2005
Microsoft MVP-2006
|
|
| Back to top |
|
|
Meriadoc
Cadet
Joined: Sep 12, 2006
Posts: 4
Location: Uk
|
|
| Back to top |
|
|
|
|
Forum FAQ
Search
Usergroups
Profile
Login to check your private messages
Login
