102
How does ESET SysInspector evaluate the risk posed by a particular object ?
In most cases, ESET SysInspector assigns risk levels to objects (files, processes, registry keys and so forth) using a series
of heuristic rules that examine the characteristics of each object and then weight the potential for malicious activity.
Based on these heuristics, objects are assigned a risk level from "1 - Fine (green)" to "9 - Risky (red)." In the left navigation
pane, sections are colored based on the highest risk level of an object inside them.
Does a risk level of "6 - Unknown (red)" mean an object is dangerous ?
ESET SysInspector's assessments do not guarantee that an object is malicious- that determination should be made by
a security expert. What ESET SysInspector is designed for is to provide a quick assessment for security experts so that
they know what objects on a system they may with to further examine for unusual behavior.
Why does ESET SysInspector connect to the Internet when run ?
Like many applications, ESET SysInspector is signed with a digital signature "certificate" to help ensure the software was
published ESET and has not been altered. In order to verify the certificate, the operating system contacts a certificate
authority to verify the identity of the software publisher. This is normal behavior for all digitally-signed programs under
Microsoft Windows.
What is Anti-Stealth technology ?
The Anti-Stealth technology provide effective rootkits detection.
If the system is attacked by malicious code that behaves as a rootkit, the user is exposed to the risk of damaging, losing
or stealing of data. Without a special anti-rootkit tool, it is almost impossible to detect rootkits.
Why are there sometimes files marked as "Signed by MS", having a different "Company Name" entry at the same
time ?
When trying to identify the digital signature of an executable file, the SysInspector first seeks whether there is a digital
signature embedded in the file. Is this the case the identification within the file will be used when validating. On the
other hand, should the file not contain a digital signature, the ESI starts looking for the corresponding CAT file (Security
Catalog - %systemroot%\system32\catroot) that contains information about the executable file processed. In case the
relevant CAT file is found, the digital signature of that CAT file will be applied in the validation process of the executable.
This is why there are sometimes files marked as "Signed by MS", but having a different "CompanyName" entry.
Example:
Windows 2000 includes the HyperTerminal application located in
C:\Program Files\Windows NT
. The main application
executable file is not digitally signed, but SysInspector marks it as a file signed by Microsoft. The reason for this is a
reference in
C:\WINNT\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\sp4.cat
pointing to
C:\Program
Files\Windows NT\hypertrm.exe
(the main executable of the HyperTerminal application) and
sp4.cat
is digitally signed by
Microsoft.
