How would you go about reverse engineering malware W32/Malware!Gemini. Recently I found it installed on my computer and would like to trace where the data is being sent.

1 Answer 1


Well there's a slight difference between the two.

The best way to try and determine where the data is being sent is to monitor and trace all of your outbound traffic.

If you'd like to reverse engineer it to possibly learn more about it and if you are missing anything as far as what it is doing or what it is sending there'd be a slightly different path.

Monitoring a clean and controlled system, using packet sniffers in conjunction with IDS(s), trying to disassemble any binaries you find that it adds, debugging/looking at the strings/hexediting as best you can should garner you plenty more information about it than you currently know.

  • So wireshark to sniff. Where would I start? Any specific filters that would be more likely to sniff this exact traffic? Do you have a IDS that you recommend? Thank you for the reply.
    – m4ck
    Commented Jan 29, 2012 at 6:12
  • @m4ck - You want an honest answer? If you do not already know where to start, then you do not have the tools nor the ability to track where the data is being sent to, besides what are you going to do if you do find the desination of the data? I guarantee you its in a country that could careless about your rights.
    – Ramhound
    Commented Jan 30, 2012 at 15:11
  • 1
    Everyone has to start somewhere. I would forward the information I found to proper authorities or someone that might possible care or take proper action. Or use the information for record keeping purposes.
    – m4ck
    Commented Jan 30, 2012 at 16:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .