Posted: Tue Apr 03, 2007 6:31 pm Post subject: I need help on MIRT submissions and using MD5 (Newbie here)
I have a .sys file called ip6fw.sys that I think is infected by a virus/trojan horse. So I need to know if it's a Genuine Windows Certificate file (because this file is often used by malware to hijack the firewall I understand).
How can I .zip this file, include the MD5 checksum (I have a program to generate the MD5 checksum), and upload it to the Malware Listserv? Then will somebody check it to see if it's a genuine file or whether it's infected? Do I have to pay money (I don't mind paying a donation BTW)?
A few step by step instructions would be very helpful, as this is my first post here.
Security Expert Special Response Team Joined: Apr 19, 2006 Posts: 6301 Location: USA
Posted: Tue Apr 03, 2007 6:52 pm Post subject:
Quote:
I have a .sys file called ip6fw.sys that I think is infected by a virus/trojan horse. So I need to know if it's a Genuine Windows Certificate file (because this file is often used by malware to hijack the firewall I understand).
The first question is whether or not you can copy and paste the file . Often malware can prevent this (until we use the correct tools) . If you can copy and paste the file do so to your desktop and then zip it with the password "infected" . Create a new post here : /f81-Unknown_Files.html . I or one of my MIRT hunters will process it and give you our results . The MIRT listserv is for MIRT staff only , guests and non MIRT staff must use the unknown files forum .
7Zip : http://www.7-zip.org/ is my choice for zipping and password protecting files (its free as well) . Once 7zip is installed you can right click any file and zip it with 7zip . Choose the add to archive option and change the archive format from 7z to zip .
Quote:
Do I have to pay money (I don't mind paying a donation BTW)?
Castlecops does not pay us , we do this for the warm fuzzies and the experience . You can make a donation to Castlecops though .
If you can't copy this file then we can walk you through extracting it . There are tools that will cut through it like butter .
You can post new topics in this forum You can reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You can attach files in this forum You cannot download files in this forum
Forum FAQ
Search
Usergroups
Profile
Login to check your private messages
Login
Castlecops does not pay us , we do this for the warm fuzzies and the experience . You can make a donation to Castlecops though .
