Does ESET SysInspector require Administrator privileges to run?
While ESET SysInspector does not require Administrator privileges to run, some of the information in collects can only be accessed from an Administrator account. Running it as a Standard User or a Restricted User will result in it collecting less information about your operating environment.
Does ESET SysInspector create a log file?
ESET SysInspector can create a log file of your computer’s configuration. To save one, select File > Save Log from the main menu. Logs are saved in XML format. By default, files are saved to the %USERPROFILE%\My Documents\ directory, with a file naming convention of “SysInpsector-%COMPUTERNAME%-YYMMDD-HHMM.XML”. You may change the location and name of the log file to something else before saving, if you prefer.
How do I view the ESET SysInspector log file?
To view a log file created by ESET SysInspector, run the program and select File > Open Log from the main menu. You can also drag and drop log files onto the ESET SysInspector application. If you need to frequently view ESET SysInspector log files, we recommend creating a shortcut to the SYSINSPECTOR.EXE file on your Desktop; you can then drag and drop log files onto it for viewing. For security reasons Windows Vista may disallow drag and drop between windows that have different security permissions.
Is a specification available for the log file format? What about an SDK?
At the current time, neither a specification for the log file or an SDK are available since the program is still in development. After the program has been released, we may provide these based on customer feedback and demand.
How does ESET SysInspector evaluate the risk posed by a particular object?
In most cases, ESET SysInspector assigns risk levels to objects (files, processes, registry keys and so forth) using a series of heuristic rules that examine the characteristics of each object and then weight the potential for malicious activity. Based on these heuristics, objects are assigned a risk level from “1 – Fine (green)” to “9 – Risky (red).” In the left navigation pane, sections are colored based on the highest risk level of an object inside them.
Does a risk level of “6 – Unknown (red)” mean an object is dangerous?
ESET SysInspector’s assessments do not guarantee that an object is malicious—that determination should be made by a security expert. What ESET SysInspector is designed for is to provide a quick assessment for security experts so that they know what objects on a system they may with to further examine for unusual behavior.
Why does ESET SysInspector connect to the Internet when run?
Like many applications, ESET SysInspector is signed with a digital signature “certificate” to help ensure the software was published ESET and has not been altered. In order to verify the certificate, the operating system contacts a certificate authority to verify the identity of the software publisher. This is normal behavior for all digitally-signed programs under Microsoft Windows.
What is Anti-Stealth technology
The Anti-Stealth technology provide effective rootkits detection.
If the system is attacked by malicious code that behaves as a rootkit, the user is exposed to the risk of damaging, losing or stealing of data. Without a special anti-rootkit tool, it is almost impossible to detect rootkits.
Why are there sometimes files marked as “Signed by MS”, having a different “Company Name” entry at the same time ?
When trying to identify the digital signature of an executable file, the SysInspector first seeks whether there is a digital signature embedded in the file. Is this the case the identification within the file will be used when validating. On the other hand, should the file not contain a digital signature, the ESI starts looking for the corresponding CAT file (Security Catalog – %systemroot%\system32\catroot) that contains information about the executable file processed. In case the relevant CAT file is found, the digital signature of that CAT file will be applied in the validation process of the executable.
This is why there are sometimes files marked as “Signed by MS”, but having a different “CompanyName” entry.
Example:
Windows 2000 includes the HyperTerminal application located in “C:\Program Files\Windows NT”. The main application executable file is not digitally signed, but SysInspector marks it as a file signed by Microsoft. The reason for this is a reference in “C:\WINNT\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\sp4.cat” pointing to “C:\Program Files\Windows NT\hypertrm.exe” (the main executable of the HyperTerminal application) and sp4.cat is digitally signed by Microsoft.