Results 1 to 3 of 3

Thread: New Malware v8

  1. #1
    Senior Member Matt's Avatar
    Join Date
    Aug 2006
    Location
    Bavaria
    Posts
    1,169

    Default New Malware v8

    detection rules for the following Malware:
    • Adware.Gamevance
    • Trojan.Agent
    • Trojan.BHO
    • Trojan.Downloader
    • Trojan.FakeAlert
    • Trojan.Virtumonde
    Category: Trojan
    Code:
    :: New Malware v8
    // Revision 1
    // {Cat:Trojan}{Cnt:1}
    // {Det:Matt,2009-05-23}
    
    // Adware.Gamevance:
    //BrowserHelperEx:"Gamevance","flagfile=1"
    RegyKey:"<$REG_BHO>",HKEY_LOCAL_MACHINE,"\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\","{0ED403E8-470A-4a8a-85A4-D7688CFE39A3}"
    RegyKey:"<$REG_CLASSID>",HKEY_LOCAL_MACHINE,"\SOFTWARE\Classes\CLSID\","{0ED403E8-470A-4a8a-85A4-D7688CFE39A3}"
    
    // Trojan.Agent:
    // BrowserHelperEx:"CDNSCacheObj Object","flagfile=1"
    RegyKey:"<$REG_BHO>",HKEY_LOCAL_MACHINE,"\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\","{376892AE-1825-4E5F-9F85-23F9640051CC}"
    RegyKey:"<$REG_CLASSID>",HKEY_LOCAL_MACHINE,"\SOFTWARE\Classes\CLSID\","{376892AE-1825-4E5F-9F85-23F9640051CC}"
    
    // Trojan.BHO:
    // BrowserHelperEx:"Microsoft copyright","flagfile=1"
    RegyKey:"<$REG_BHO>",HKEY_LOCAL_MACHINE,"\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\","{F30B5E7E-CFBB-44fb-A947-226E5A7A4290}"
    RegyKey:"<$REG_CLASSID>",HKEY_LOCAL_MACHINE,"\SOFTWARE\Classes\CLSID\","{F30B5E7E-CFBB-44fb-A947-226E5A7A4290}"
    
    // Trojan.Downloader:
    AutoRun:"Cognac","<$LOCALSETTINGS>\Temp\2207.exe","flagifnofile=1"
    RegyValue:"<$REG_AUTORUN>",HKEY_CURRENT_USER,"\Software\Microsoft\Windows\CurrentVersion\Run\","Cognac"
    File:"<$FILE_EXE>","<$LOCALSETTINGS>\Temp\2207.exe"
    
    // Trojan.FakeAlert:
    // BrowserHelperEx:"XML module","flagfile=1"
    RegyKey:"<$REG_BHO>",HKEY_LOCAL_MACHINE,"\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\","{500BCA15-57A7-4eaf-8143-8C619470B13D}"
    RegyKey:"<$REG_CLASSID>",HKEY_LOCAL_MACHINE,"\SOFTWARE\Classes\CLSID\","{500BCA15-57A7-4eaf-8143-8C619470B13D}"
    
    // Trojan.Downloader
    Downloads: 8Rating: 25 (rated by 2 users)

  2. #2
    Senior Member Matt's Avatar
    Join Date
    Aug 2006
    Location
    Bavaria
    Posts
    1,169

    Default

    Where is the rest of my file MisterW??

    It seems to me that OpenSBI has some bugs; let's hope you'll fix it soon...
    Best regards - Beste Gre,

    Matt

  3. #3
    Retired
    Join Date
    Oct 2005
    Posts
    566

    Default

    There is a new version of the editor available soon. I hope I can send it to you on Monday

    Best regards,
    Markus

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •