The Ethical Hacker Network - Hiren's Boot Disk, ComboFix.exe, Symantec, Detected Trojan, NEW

Latest Additions

Who's Online

EH-Net News Feeds

Latest Additions

delusion

Newbie

Offline

Posts: 49

Hiren's Boot Disk, ComboFix.exe, Symantec, Detected Trojan, NEW

« on: March 23, 2010, 05:56:29 AM »

Hey guys I have used the above mentioned Boot CD in our environment for various reasons, now I am unclear if I have used this particular disk, I may have, but then again I may not have. I popped the disk into a workstation yesterday and BOOM Symantec detected a generic Trojan virus, with the wild level of Low. Now I am pretty sure that symantec have just recently updated their signatures, which now detects this tool as a trojan and in reality it is a false positive. Have any of you guys experienced any false positives OR viruses from the Hirens Boot Disk?

I have explored the Cyberwebs/Symantec threat explorer/SecurityFocus with no exciting discoveries Tongue

I look forward to hearing about your experience with this Boot CD Cool


	Logged

You Cant Resolve Problems Whilst At WAR!

n1p

Jr. Member

Offline

Posts: 89

Re: Hiren's Boot Disk, ComboFix.exe, Symantec, Detected Trojan, NEW

« Reply #1 on: March 24, 2010, 02:00:53 PM »

If it is an option, I usually identify the suspect file and submit it to virustotal.com or jotti. This will scan the file using a large number of AVs. See what else it gets flagged as. To further verify the files integrity I submit the file to an online virus sandbox like CWSandbox or Anubis to see if any malicious registry, network or file activity occurs. This is by no means 100% confirmation, but allows you to make an informed decision about the executable/file's intentions!

Hope it helps in some way
n1p


	Logged

delusion

Newbie

Offline

Posts: 49

Re: Hiren's Boot Disk, ComboFix.exe, Symantec, Detected Trojan, NEW

« Reply #2 on: March 27, 2010, 09:42:01 AM »

That was informative, thanks for your help Cool


	Logged

You Cant Resolve Problems Whilst At WAR!

Ketchup

Hero Member

Offline

Posts: 1006

Re: Hiren's Boot Disk, ComboFix.exe, Symantec, Detected Trojan, NEW

« Reply #3 on: March 28, 2010, 11:35:04 AM »

I don't believe that Hiren's boot CD is a licensed distribution of the tools that it includes. If you downloaded the CD from a questionable source, it is possible that it could be infected with a virus. The other possibility is that anti-virus software is detecting a security tool as a virus. Some software will identify metasploit as a virus for example.