unbekannter ADS -> RDS : NSRL Reference Data Set? Einstellungen

[Gast_Beobachter_*]

Hallo Leute,

Ich habe heut bei meinem Windows7 System einen verdächtigen ADS entdeckt, der an "c:Windows" angehängt war. Bei upload bei Virustotal
ergab als Hinweis dies

MD5 : 529917fa550eea5a8cc0db00ca803e2b
SHA1 : 0588a5c17d46c2b67fd4708adf9ad675cef15c71
SHA256: 1f783b232a5e1890dde9855defd2f58096b53dac28b3eac6cf588cd04c8f174f
TrID : File type identification
Unknown!
ssdeep: 3:ol2Rvlt/:VJv
PEiD : -
RDS : NSRL Reference Data Set

weitere Recherchen brachten mich zu dieser Seite

http://www.nsrl.nist.gov/

kann mir jemand das mal erklären bitte? Ansonsten bin ich ganz schnell wieder bei XP.

mfg Beobachter

Der Beitrag wurde von Manu bearbeitet: 02.01.2010, 01:59

[Gast_Beobachter_*]

@Sebastian

ich zitiere mal

This project is supported by the U.S. Department of Justice's National Institute of Justice (NIJ), federal, state, and local law enforcement, and the National Institute of Standards and Technology (NIST) to promote efficient and effective use of computer technology in the investigation of crimes involving computers. Numerous other sponsoring organizations from law enforcement, government, and industry are providing resources to accomplish these goals, in particular the FBI who provided the major impetus for creating the NSRL out of their ACES program.

The National Software Reference Library (NSRL) is designed to collect software from various sources and incorporate file profiles computed from this software into a Reference Data Set (RDS) of information. The RDS can be used by law enforcement, government, and industry organizations to review files on a computer by matching file profiles in the RDS. This will help alleviate much of the effort involved in determining which files are important as evidence on computers or file systems that have been seized as part of criminal investigations.

The RDS is a collection of digital signatures of known, traceable software applications. There are application hash values in the hash set which may be considered malicious, i.e. steganography tools and hacking scripts. There are no hash values of illicit data, i.e. child abuse images.

mfG Beobachter