GetSusp

From aldeid
Jump to: navigation, search

Description

McAfee GetSusp is intended for users who suspect undetected malware on their computer. GetSusp eliminates the need for deep technical knowledge of computer systems to isolate undetected malware. It does this by using a combination of heuristics and querying the McAfee Global Threat Intelligence (GTI) file reputation database to gather suspicious files.

Installation

The program can be downloaded from the following link: http://downloadcenter.mcafee.com/products/mcafee-avert/getsusp/getsusp.exe

Usage

Graphical Interface (GUI)

Top start a scan via the GUI, click on the "Scan Now" icon:

Getsusp.png

Command Line (CLI)

Options

--MD5
Send only the report
--SILENT
Initiate a silent scan
--OFFLINE
scan in offline mode
--EMAIL=email
Specify email address
--PROXY=ip
port
Specify proxy address and port
--UPLOAD=path
Specify folder or GetSusp zip file path for upload
--COMMENT=comment
Specify comments
--ZIPPATH=path
Specify folder to save suspicious zip file
--SCANPATH=path
Scan specific file or folder path
--PROXY-SCRIPT=url
Specify automatic configuration script URL

Example

Let's say you want to scan a suspected host (192.168.1.3) remotely from your computer (192.168.1.2).

C:\>psexec \\192.168.1.3 -u administrator -p passwd -c getsusp.exe

Log files will be generated in the C:\windows\system32\logs\ directory on the targeted system (192.168.1.3).

From a *nix machine, you can remotely grab the interesting log file as follows:

$ smbget -u unknown smb://192.168.1.32/c$/windows/system32/logs/getsusp.log
Password for c$ at 192.168.1.32: 
Using workgroup WORKGROUP, user unknown
smb://192.168.1.32/c$/windows/system32/logs/getsusp.log                                   
Downloaded 36,97kB in 2 seconds

Here is what the log file looks like:

$ egrep -v "OK" getsusp.log 
McAfee Labs(r) GetSusp(tm) Version 3.0.0.323 built on Dec 31 2012
Copyright (c) 2012 McAfee, Inc. All Rights Reserved.

GetSusp initiated on Thu Jun 06 18:26:44 2013


  Master Boot Record(s):....1
  Possibly Infected:.............0
  Boot Sector(s):.................1
  Possibly Infected:.............0

C:\documents and settings\unknown\local settings\application data\lollipop\lollipop.exe ... is Suspicious !!!
C:\DOCUMENTS AND SETTINGS\UNKNOWN\LOCAL SETTINGS\APPS\2.0\QQ8NQWYL.8LX\DED97HG1.CQQ\GITH..TION_8F45A2159C87C850_0001.0000_E49521E8B5E59340\GITHUB.EXE ... is Unknown !!!
C:\Documents and Settings\unknown\Local Settings\Temp\sngalng.exe ... is Suspicious !!!
C:\PROGRAM FILES\FICHIERS COMMUNS\ADOBE\ACROBAT\ACTIVEX\PDFSHELL.FRA ... is Unknown !!!
C:\Program Files\SingAlong\singalng.dll ... is Suspicious !!!
C:\Program Files\SingAlong\SingalngUpdater.exe ... is Suspicious !!!

GetSusp scan identified (4) Suspicious file(s) and (2) Unknown file(s).

Comments

blog comments powered by Disqus