BFDrv.sys

显示全部楼层 · 发表于 2019-9-18 12:48:21

infected

Properties
Name BFDrv.sys
Location C:\Windows\system32\drivers
Size 16.6 KB
Time 1210.1 days ago (2016-05-26 10:07:33)
Authenticode Valid
Entropy 6.1
RSA Key Size 2048
Service BFDrv
SHA-256 15C034B29DC13C01BD4364C27C248D83665ECD3749D50829410E0F3D7C24B3D3

Detection Names
HitmanPro Mal/RootKit-A

Scoring (104.0)
One or more antivirus vendors have indicated that the file is malicious.
Authors name is missing in version info. This is not common to most programs.
Version control is missing. This file is probably created by an individual. This is not typical for most programs.
Program starts automatically without user intervention.
The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities.
Starts automatically as a service during system bootup.
The file is a device driver. Device drivers run as trusted (highly privileged) code.
Program is code signed with a valid Authenticode certificate.

Startup
HKLM\SYSTEM\CurrentControlSet\Services\BFDrv\

显示全部楼层 · 发表于 2019-9-18 14:18:52

好的。。。

显示全部楼层 · 发表于 2019-9-18 14:27:38

本帖最后由 evans168 于 2019-9-18 14:29 编辑

SecureAPlus (Sophos), Norton 掃描沒報...
@疯狂破解者

显示全部楼层 · 发表于 2019-9-18 14:53:25

看数字签名是暴风影音的驱动，误报？微软Defender不杀

显示全部楼层 · 发表于 2019-9-18 15:06:49

驭龙发表于 2019-9-18 14:53
看数字签名是暴风影音的驱动，误报？微软Defender不杀

只有兩個報毒
https://www.virustotal.com/gui/f ... d7c24b3d3/detection

显示全部楼层 · 发表于 2019-9-18 15:07:03

本帖最后由 www-tekeze 于 2019-9-18 15:09 编辑

绒智都不报！暴风的驱动。。

补充：安天和管家也不报。

显示全部楼层 · 发表于 2019-9-18 15:07:51

我一看信任就感觉大概率是误报，连QQ铁壳都是良好，这个信任可见铁壳下了多大的决心

显示全部楼层 · 发表于 2019-9-18 17:19:08

Avast Miss

[可疑文件] BFDrv.sys

本帖子中包含更多资源

本帖子中包含更多资源