Forest Global Training Partners

Cyber Risks · Krebs on Security

WinMHR: (Re)Introducing the Malware Hash Registry

Summary: Team Cymru released WinMHR, a free point-and-click Windows tool that queries its Malware Hash Registry - a repository of hashes for millions of files flagged as malicious by dozens of anti-virus firms and its own analysis sandbox - in real time when a user scans downloaded files. The tool also runs at Windows startup to scan processes, but it cannot remove the bad files it finds and does not classify or name them, and Team Cymru said a Firefox add-on version was planned.

Why it matters: The tool's own team acknowledged a high false-positive rate, flagging tools like nirsoft.net password-recovery utilities and VNC as malware, and a hash absent from the registry is reported as 'not detected as malware' even when the file has never been seen before.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related