37 lines
No EOL
970 B
Text
37 lines
No EOL
970 B
Text
rule ConduitASample
|
|
{
|
|
meta:
|
|
Description = "Adware.Conduit.A.vb"
|
|
ThreatLevel = "5"
|
|
|
|
strings:
|
|
$ = "GetSpeedBrowserInstalled" ascii wide
|
|
$ = "SpeedBrowserAlreadyInstalled" ascii wide
|
|
$ = "Injekt SVN - client" ascii wide
|
|
|
|
condition:
|
|
any of them
|
|
}
|
|
|
|
rule ConduitBSample
|
|
{
|
|
meta:
|
|
Description = "Adware.Conduit.B.vb"
|
|
ThreatLevel = "5"
|
|
|
|
strings:
|
|
$ = "CAboutTabsInjector_" ascii wide
|
|
$ = "AboutTabsDataUrlPublisher" ascii wide
|
|
$ = "AboutTabsDataUrlConduit" ascii wide
|
|
$ = "AboutTabsUsageUrl" ascii wide
|
|
$ = "AboutTabsEnabledByUser" ascii wide
|
|
$ = "AboutTabsEnabledByConduit" ascii wide
|
|
$ = "AboutTabsEnabledByPublisher" ascii wide
|
|
$ = "SearchInNewTabContent.xml" ascii wide
|
|
$ = "CONDUIT_CHEVRON_MUTEX" ascii wide
|
|
$ = "CConduitExternalForTBAPI" ascii wide
|
|
$ = "EI_Toolbar_Update_Mutex" ascii wide
|
|
|
|
condition:
|
|
any of them
|
|
} |