Fake DNS & Mailpot

This link has Fake DNS and Mailpot listening on localhost.

http://labs.idefense.com/software/malcode.php#more_malcode+analysis+pack

CaptureBAT

http://www.honeynet.org/node/315

Using this file we can capture the network activity and all the shift deleted files.

capturebat -n -c

 

 We need to have the following pre-requisites so that capture bat will run properly.

http://www.microsoft.com/download/en/details.aspx?id=3387

http://www.winpcap.org/install/default.htm

Process Monitor

This tool will allow you to see the process which are created on the system. 

Now we will create a filter to show just those process with the name talk associated with it.

Here it has captured all the process which have started when Gtalk was clicked.

RegShot

This tool will take a Registry snapshot of the system at two different times and tell what has changed.

http://sourceforge.net/projects/regshot

Strings to analyse Executables

Strings just scans the file you pass it for UNICODE (or ASCII) strings of a default length of 3 or more UNICODE (or ASCII) characters.

 http://technet.microsoft.com/en-us/sysinternals/bb897439.aspx

Digging Web Browsers

This tool would show the IE Cache.

http://www.nirsoft.net/utils/ie_cache_viewer.html

This tool would show the IEHistory.

http://www.nirsoft.net/utils/iehv.html

This tool would show My Last Search.

http://www.nirsoft.net/utils/my_last_search.html

This tool would show the Mozilla's History View.

http://www.nirsoft.net/utils/mozilla_history_view.html

This tool would show the Mozilla's Cache.

http://www.nirsoft.net/utils/mozilla_cache_viewer.html

This tool would show the Favorites in both IE and Mozilla.

http://www.nirsoft.net/utils/faview.html

Mozilla and IE password recovery

Kindly use these tools only for the good, I am no way responsible for your irresponsible acts.

IE 7 > http://www.nirsoft.net/utils/pspv.html
IE 7 < http://www.nirsoft.net/utils/internet_explorer_password.html

Firfox: http://www.nirsoft.net/utils/passwordfox.html