Hello Virustotal? It's Microsoft Calling. - Internet Security

Hello Virustotal? It's Microsoft Calling.
You might think that phone call might be unlikely, but as of this week it's built in and is likely happening right now. I was poking around in the latest version of Sysinternals, and tripped over a new option. You can now submit any running process in memory directly to Virustotal. it's a simple right-click in the latest version of Process Explorer. If that's not just the coolest thing! If your AV product isn't triggering on a suspect process, you can now query all the AV engines without even having to find or upload the file - - assuming that a file that matches your process even exists - if you're in the midst of a security incident a suspect process might not have a matching file. Sysinternals: http://technet.microsoft.com/en-us/sysinternals VirusTotal: https://www.virustotal.com/ =============== Rob VandenBrink Metafore	Rob VandenBrink 496 Posts ISC Handler
Reply Subscribe	Feb 7th 2014 5 years ago
Worth a sub... http://blogs.technet.com/b/sysinternals/rss.aspx	lansalot 18 Posts
Reply Quote	Feb 7th 2014 5 years ago
This is quite a useful checker tool etc. http://phrozenvtuploader.com/ Cheers, Steve (Sanesecurity.com)	Sanesecurity 21 Posts
Reply Quote	Feb 7th 2014 5 years ago
Bleh. If I ever weaponize my tools you will submit random EXE files that are part of Windows.	Sanesecurity 39 Posts
Reply Quote	Feb 8th 2014 5 years ago
Bleh. If I ever weaponize my tools you will submit random EXE files that are part of Windows.	Sanesecurity 39 Posts
Reply Quote	Feb 8th 2014 5 years ago
Neat idea except it assumes the computer has a working Internet connection. Analysis of malware on a system isolated from net is safer.	Sanesecurity 7 Posts
Reply Quote	Feb 9th 2014 5 years ago