NetWatchMan
Premium,VIP
join:2001-03-13
Alpharetta, GA
| reply to billy g
Re: Is aswBoot.exe malware?
Untrusted File | 
Extremely Trusted File |
»www.mynetwatchman.com/tools/sc
SecCheck has aggregated SHA1 hash dumps from thousands of systems and enables you to see how hashes on your system compare to what others have submitted. E.g. in this case I'm guessing you should have seen dozens of other Avast users submitting the same SHA1 for the aswBoot.exe file.
Note the following two columns:
Machines Reporting Same Hash
-and-
Total Machines Reporting
If the machines reporting a hash is low (say less than 5) the file may not be malware, but I'm sure not going to trust it. If the number of machines reporting a hash is greater than 20, the file is almost certainly trusted.
The attachments show the extreme low-end and high-end of this trust analysis from an infected lab system.
--
Lawrence Baldwin
myNetWatchman
The Internet Neighborhood Watch |
