Re: [Vol-users] Attributing a string to a program

Another few suggestions: * If you're using Yara with Malfind, you're probably using an old version of Volatility. Since 2.1, Malfind no longer has anything to do with Yara - there's a separate YaraScan plugin that you should use instead [1] * When you use YaraScan, make sure to try scanning in both usermode (process memory) and kernel mode (there are different switches, see the [1] reference) * When you create the Yara rules, make sure you indicate "wide" if the string is unicode MHL [1] http://code.google.com/p/volatility/wiki/CommandReference22#yarascan On Mon, Sep 17, 2012 at 11:36 AM, Jamie Levy <jamie.levy(a)gmail.com> wrote: