A Windows XP help forum. PCbanter

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

Go Back   Home » PCbanter forum » Microsoft Windows XP » Security and Administration with Windows XP
Site Map Home Register Authors List Search Today's Posts Mark Forums Read Web Partners

Worm for Testing Purposes?



 
 
Thread Tools Display Modes
  #1  
Old August 29th 10, 04:50 AM posted to microsoft.public.windowsxp.security_admin
dubya[_2_]
external usenet poster
 
Posts: 5
Default Worm for Testing Purposes?

Hello\,

Does anyone know of a non-destructive, safe worm - one that doesn't do
anything but propagate and is easy to remove - that I can use for testing in
small networks?

Thanks!

Mike


Ads
  #2  
Old August 29th 10, 07:22 PM posted to microsoft.public.windowsxp.security_admin
Peter Foldes
external usenet poster
 
Posts: 2,444
Default Worm for Testing Purposes?

No. Why not create one yourself instead of asking here. Nobody in their right mind
will do this for you

--
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.
http://www.microsoft.com/protect

"dubya" wrote in message
...
Hello\,

Does anyone know of a non-destructive, safe worm - one that doesn't do anything
but propagate and is easy to remove - that I can use for testing in small
networks?

Thanks!

Mike


  #3  
Old August 29th 10, 08:22 PM posted to microsoft.public.windowsxp.security_admin
dubya[_2_]
external usenet poster
 
Posts: 5
Default Worm for Testing Purposes?

I didn't ask anyone to do anything, let alone create something.

You know, pal, most people in their right minds can read and actually do
read posts before replying.

"Peter Foldes" wrote in message
...
No. Why not create one yourself instead of asking here. Nobody in their
right mind will do this for you

--
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.
http://www.microsoft.com/protect

"dubya" wrote in message
...
Hello\,

Does anyone know of a non-destructive, safe worm - one that doesn't do
anything but propagate and is easy to remove - that I can use for testing
in small networks?

Thanks!

Mike




  #4  
Old August 29th 10, 08:57 PM posted to microsoft.public.windowsxp.security_admin
FromTheRafters[_3_]
external usenet poster
 
Posts: 102
Default Worm for Testing Purposes?

"dubya" wrote in message
...
Hello\,

Does anyone know of a non-destructive, safe worm - one that doesn't do
anything but propagate and is easy to remove - that I can use for
testing in small networks?


There's no such thing, but there are things that come close.

You probably need to find another way of accomplishing what you want,
but 'what you want' isn't exactly clear in your post

Are you intending to study the worm, or are you trying to test a
network?


  #5  
Old August 29th 10, 10:36 PM posted to microsoft.public.windowsxp.security_admin
Ǝиçεl
external usenet poster
 
Posts: 151
Default Worm for Testing Purposes?

dubya,

The EICAR group came up with a harmless file detected by antivirus products
so you can safely verify the product's working. If you haven't seen Windows
Defender detect something, visit
http://www.eicar.org/anti_virus_test_file.htm , download the 68 byte file
eicar.com.txt, and copy it to your startup folder. Your AV solution (that
you should be running in addition to Windows Defender) will also pick it up."
-=-

"dubya" wrote:

Hello\,

Does anyone know of a non-destructive, safe worm - one that doesn't do
anything but propagate and is easy to remove - that I can use for testing in
small networks?

Thanks!

Mike


.

  #6  
Old August 30th 10, 01:16 AM posted to microsoft.public.windowsxp.security_admin
Twayne[_3_]
external usenet poster
 
Posts: 1,073
Default Worm for Testing Purposes?

In ,
???l typed:
dubya,

The EICAR group came up with a harmless file detected by
antivirus products so you can safely verify the product's
working. If you haven't seen Windows Defender detect
something, visit
http://www.eicar.org/anti_virus_test_file.htm , download
the 68 byte file eicar.com.txt, and copy it to your startup
folder. Your AV solution (that you should be running in
addition to Windows Defender) will also pick it up." -=-

"dubya" wrote:

Hello\,

Does anyone know of a non-destructive, safe worm - one
that doesn't do anything but propagate and is easy to
remove - that I can use for testing in small networks?

Thanks!

Mike


.


Good response: Eicar is completely safe and won't cause any harm. It's old
but it at least shows that the signature it uses gets caught by
security-ware.

HTH,

Twayne`


  #7  
Old August 30th 10, 01:50 AM posted to microsoft.public.windowsxp.security_admin
FromTheRafters[_3_]
external usenet poster
 
Posts: 102
Default Worm for Testing Purposes?

"Twayne" wrote in message
...
In ,
???l typed:
dubya,

The EICAR group came up with a harmless file detected by
antivirus products so you can safely verify the product's
working. If you haven't seen Windows Defender detect
something, visit
http://www.eicar.org/anti_virus_test_file.htm , download
the 68 byte file eicar.com.txt, and copy it to your startup
folder. Your AV solution (that you should be running in
addition to Windows Defender) will also pick it up." -=-

"dubya" wrote:

Hello\,

Does anyone know of a non-destructive, safe worm - one
that doesn't do anything but propagate and is easy to
remove - that I can use for testing in small networks?

Thanks!

Mike


.


Good response: Eicar is completely safe and won't cause any harm. It's
old but it at least shows that the signature it uses gets caught by
security-ware.


It is not a worm, so how is that relevent to his query.

I am suspecting that the OP wants a *worm* (without a payload) to run
rampant on his network so that he can study worm behavior.

This is entirely unsafe - better would be to put restrictions on the
worm (such as requiring some registry value only found in the test
network's computers or requiring users' permission before replicating)
which violates the *other* request that the worm *only* propagte - and
do nothing else.

An impossibility.


  #8  
Old August 30th 10, 01:58 AM posted to microsoft.public.windowsxp.security_admin
FromTheRafters[_3_]
external usenet poster
 
Posts: 102
Default Worm for Testing Purposes?

....or just copy this

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

and paste it into notepad and save it as a batfile or comfile if your AV
doesn't alert on it when saved as a textfile.

....or see attached if it comes through.


"???l" wrote in message
...
dubya,

The EICAR group came up with a harmless file detected by antivirus
products
so you can safely verify the product's working. If you haven't seen
Windows
Defender detect something, visit
http://www.eicar.org/anti_virus_test_file.htm , download the 68
byte file
eicar.com.txt, and copy it to your startup folder. Your AV solution
(that
you should be running in addition to Windows Defender) will also pick
it up."
-=-

"dubya" wrote:

Hello\,

Does anyone know of a non-destructive, safe worm - one that doesn't
do
anything but propagate and is easy to remove - that I can use for
testing in
small networks?

Thanks!

Mike


.





  #9  
Old August 31st 10, 10:28 PM posted to microsoft.public.windowsxp.security_admin
dubya[_2_]
external usenet poster
 
Posts: 5
Default Worm for Testing Purposes?


"FromTheRafters" erratic @nomail.afraid.org wrote in message
...
"dubya" wrote in message
...
Hello\,

Does anyone know of a non-destructive, safe worm - one that doesn't do
anything but propagate and is easy to remove - that I can use for testing
in small networks?


There's no such thing, but there are things that come close.

You probably need to find another way of accomplishing what you want, but
'what you want' isn't exactly clear in your post

Are you intending to study the worm, or are you trying to test a network?

Sorry for the lack of clarity. Test the network. A mix of virtual machines
and hosts with various firewalls or lack thereof. I just want to see what
it gets through and what it doesn't. Nothing will be connected to any
public networks, so no risk to public bandwidth.

Thanks,
Mike


  #10  
Old August 31st 10, 10:31 PM posted to microsoft.public.windowsxp.security_admin
dubya[_2_]
external usenet poster
 
Posts: 5
Default Worm for Testing Purposes?

??l,

Thanks. Indeed, that is a neat little item. I've used it. But it doesn't
attempt to travel from one machine to another on a network, which is what I
want to check.

Mike

"???l" wrote in message
...
dubya,

The EICAR group came up with a harmless file detected by antivirus
products
so you can safely verify the product's working. If you haven't seen
Windows
Defender detect something, visit
http://www.eicar.org/anti_virus_test_file.htm , download the 68 byte
file
eicar.com.txt, and copy it to your startup folder. Your AV solution (that
you should be running in addition to Windows Defender) will also pick it
up."
-=-

"dubya" wrote:

Hello\,

Does anyone know of a non-destructive, safe worm - one that doesn't do
anything but propagate and is easy to remove - that I can use for testing
in
small networks?

Thanks!

Mike


.



  #11  
Old August 31st 10, 10:38 PM posted to microsoft.public.windowsxp.security_admin
dubya[_2_]
external usenet poster
 
Posts: 5
Default Worm for Testing Purposes?

P.S.

You may be right that there is no such thing. I thought I might find one on
a security website, but quite a bit of searching before I posted here turned
up zilch. I guess people fear such a thing would be turned to a destructive
purposes - as some people here seemed to assume. And perhaps too that
someone using it to test their own setup would not know enough to pull the
cord to the internet.

Mike

"FromTheRafters" erratic @nomail.afraid.org wrote in message
...
"dubya" wrote in message
...
Hello\,

Does anyone know of a non-destructive, safe worm - one that doesn't do
anything but propagate and is easy to remove - that I can use for testing
in small networks?


There's no such thing, but there are things that come close.

You probably need to find another way of accomplishing what you want, but
'what you want' isn't exactly clear in your post

Are you intending to study the worm, or are you trying to test a network?



  #12  
Old September 1st 10, 01:47 AM posted to microsoft.public.windowsxp.security_admin
FromTheRafters[_3_]
external usenet poster
 
Posts: 102
Default Worm for Testing Purposes?

"dubya" wrote in message
...

"FromTheRafters" erratic @nomail.afraid.org wrote in message
...
"dubya" wrote in message
...
Hello\,

Does anyone know of a non-destructive, safe worm - one that doesn't
do anything but propagate and is easy to remove - that I can use for
testing in small networks?


There's no such thing, but there are things that come close.

You probably need to find another way of accomplishing what you want,
but 'what you want' isn't exactly clear in your post

Are you intending to study the worm, or are you trying to test a
network?

Sorry for the lack of clarity. Test the network. A mix of virtual
machines and hosts with various firewalls or lack thereof. I just
want to see what it gets through and what it doesn't. Nothing will be
connected to any public networks, so no risk to public bandwidth.


True worms are generally dependent upon software vulnerabilities. The
only test worms I know about are historical in nature, and were written
for historical exploits of historical vulnerabilities. Google Fred Cohen
and read some of his papers on viruses (many of what were called viruses
then were actually worms in retrospect now that worms are better
defined). Part of the reproductive function of his test virus asked the
user for permission to infect IIRC - something any self-respecting true
worm wouldn't dream of doing.

You could concieveably install the necessary vulnerabilities (retrograde
your patches for instance) to provide an environment that supports a
particular kind of worm (like CodeRed or Sapphire) - but what would be
the point then, as you wouldn't actually be testing the network.

....as for playing with worms, that might work, but it could be
dangerous.


  #13  
Old September 1st 10, 01:59 AM posted to microsoft.public.windowsxp.security_admin
FromTheRafters[_3_]
external usenet poster
 
Posts: 102
Default Worm for Testing Purposes?

There are basline security analyzers and vulnerability scanners out
there. It is those things that actually support true network worms, the
networking aspect is what networks are *supposed* to do. It is usually a
vulnerability that allows the parent to ensure its progeny is executed,
and this is what separates true worms from viruses.

By "no such thing", I was referring to your request:

"...a non-destructive, safe worm - one that doesn't do anything but
propagate..."

To be *safe* it must do *more* than just propagate - it must set serious
restrictions on itself. )

"dubya" wrote in message
...
P.S.

You may be right that there is no such thing. I thought I might find
one on a security website, but quite a bit of searching before I
posted here turned up zilch. I guess people fear such a thing would be
turned to a destructive purposes - as some people here seemed to
assume. And perhaps too that someone using it to test their own setup
would not know enough to pull the cord to the internet.

Mike

"FromTheRafters" erratic @nomail.afraid.org wrote in message
...
"dubya" wrote in message
...
Hello\,

Does anyone know of a non-destructive, safe worm - one that doesn't
do anything but propagate and is easy to remove - that I can use for
testing in small networks?


There's no such thing, but there are things that come close.

You probably need to find another way of accomplishing what you want,
but 'what you want' isn't exactly clear in your post

Are you intending to study the worm, or are you trying to test a
network?





 




Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is Off
HTML code is Off






All times are GMT +1. The time now is 07:50 PM.


Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2018, Jelsoft Enterprises Ltd.
Copyright 2004-2018 PCbanter.
The comments are property of their posters.