Interpreting Hitman Pro Results
Hi, I ran a Hitman Pro scan and was wondering if I should be worried about these two files that were flagged.
Anyone know if these could be a false positive or a potential real issue?
C:\WINDOWS\system32\drivers\refsv1.sys Size . . . . . . . : 1,000,928 bytes Age . . . . . . . : 15.1 days (2024-06-12 08:32:42) Entropy . . . . . : 6.4 SHA-256 . . . . . : 1DD929035608179759F96858E849D059AEFDEC74712EF1730E48C01243E821C9 Product . . . . . : Microsoft® Windows® Operating System Publisher . . . . : Microsoft Corporation Description . . . : NT ReFS FS Driver Version . . . . . : 10.0.22621.3672 Copyright . . . . : © Microsoft Corporation. All rights reserved. LanguageID . . . . : 1033 Fuzzy . . . . . . : 49.0 The file is hidden from Windows API. This is typical for malware. The file is completely hidden from view and most antivirus products. It may belong to a rootkit. It appears there is no service associated with this driver. The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities. Time indicates that the file appeared recently on this computer. The file is a device driver. Device drivers run as trusted (highly privileged) code. The file is protected by Windows File Protection (WFP). This is typical for critical Windows system files.
C:\WINDOWS\system32\mfc140.dll Size . . . . . . . : 5,631,056 bytes Age . . . . . . . : 159.6 days (2024-01-19 20:38:02) Entropy . . . . . : 6.7 SHA-256 . . . . . : 694DDC3842544243C31B586325DB98E30A29EA86D3E96E95DC63CCE537F944F8 Product . . . . . : Microsoft® Visual Studio® Publisher . . . . : Microsoft Corporation Description . . . : MFCDLL Shared Library - Retail Version Version . . . . . : 14.38.33135.0 Copyright . . . . : © Microsoft Corporation. All rights reserved. RSA Key Size . . . : 2048 LanguageID . . . . : 1033 Authenticode . . . : Invalid Fuzzy . . . . . . : 22.0 Program is altered or corrupted since it was code signed by its author. This is typical for malware and pirated software. The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities.
Posted Jun 27, 2024, 2:43 PM UTC