Hi,
I am interested in writing signatures for ClamAV. I plan on doing this
regularly; should I email them to someone or upload them on the virus
submission page? I tried contacting Alain / Joel, but I never got a
response. I wrote a few signatures below, mostly for malware cryptors. If
you don't want to publish them, could I publish them here:
http://www.clamav.net/lang/en/download/cvd/3rdparty?
ndb
Trojan.Packed:1:EP+0:558BEC{-40}8B45??50E8????????83C4048BE55DC3
Trojan.Packed-1:1:EP+0:558BEC{-4}89????????00E8????FFFF5DC3
Trojan.Packed-2:1:*:8B2C2483C404C3
Trojan.Packed-3:1:*:54536A006A006A006A006A
Trojan.Packed-4:1:EP+0:33F6{-2}81??????400083EE??8B??FF6A
Trojan.Packed-5:1:EP+0:2BF6{-2}81??????400083EE??8B??FF6A
Trojan.Zbot:1:*:C745F801000000C745F8C10C00008B45FC05
Trojan.Zbot-1:1:EP+0:5589E583EC18C7042402000000FF1528614000E8F8FEFFFF
Rogue.Installer:1:*:8D4DE0895DE0895DE4895DE8E8160F0000568D4D8C895D8C895D90895D94E804
Trojan.Downloader.Cutwail:1:*:5B3C83C3188B531C2B55088D9B880000008B1B33C085DB74
Trojan.Banker:1:*:50617373776F72643D6D7476323030383B5065727369737420536563757269747920496E666F3D547275653B557365722049443D686F6E646130315F6D6174726978
Trojan.FakeAlert:1:EP+0:83E30033C066B8D741C1E008B00096BF00????0003FBB900040000F3A581EF0001000081EF0001000081EF0001000081EF0001000081EF0001000081EF0001
lbd
Trojan.Generic.Medfos;Engine:55-255,Target:1,NumberOfSections:4-4;(0&(1|2));EP+0:6A??68????0010E8??0000;S1+2:0200????0200????0200????0200????0200????0200????0200????0200????0200????0200????0200????0200????0200????0200;S1+2:0100????0100????0100????0100????0100????0100????0100????0100????0100????0100????0100????0100????0100????0100
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
