sb-viruses.rc

这是一个从音频信号里提取特征参量的程序

# Anset Virus
#
:0 BH
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*   400^0   ^Subject: ANTS Version 3.0
*   400^0   ^webmaster@avnetwork\.de$
*   400^0   ^http://www\.ants-online\.de$
*  1100^0    name=\"ants3set\.exe\"
*   500^0    MABVUFghDAkFCBULeXJUtAuIOwsHAJqkAgAAqAYAJh4AYFtm/v8EEEAAAwdC
*   500^0    b29sZWFuAQAJKgVG+9/e/2Fsc2UEVHJ1ZY0bLCIBB0ludGVnZXIEQs3K72+A
*   500^0    /wF/i8BELgRCeW//aUZ+tgaQWCdXb3JkA/9s5rd3+QhDYWlurwUv//+QhHb7
*   500^0    7fsKBlN0ci1nkBYLCldpZGUfoGbNFNzlDAdWaWHvBvgBthz2Bj4EF6g4tAbN
{ Anset=yes }

:0
* Anset ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Anset Virus/Worm"

 :0
 { VIRUSTAG=yes }

 :0
 { DANGEROUS=yes }
}


# Dandi Worm/Virus
#
:0 BH
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*   500^0    TVpQAAIAAAAEAA8A//8AALgAAAAAAAAAQAAaAAAAAAAAAAAAAAAAAAAAAAAA
*   500^0    AAAAAAAAAAAAAAAAAAAAAAEAALoQAA4ftAnNIbgBTM0hkJBUaGlzIHByb2dy
*   500^0    YW0gbXVzdCBiZSBydW4gdW5kZXIgV2luMzINCiQ3AAAAAAAAAAAAAAAAAAAA
*   500^0    AAAAAAAA4ACOoQsBAhkAkAMAABAAAACABQDgGQkAAJAFAAAgCQAAAEAAABAA
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Dandi Virus/Worm"

 :0
 { VIRUSTAG=yes }

 :0
 { DANGEROUS=yes }
}


# Happy99.exe/Spanska Virus :/
#
:0
*  ^X-Spanska:
{ HAPPY99=yes }

:0 BH
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  1000^0   ^begin 644 Happy99.exe$
*   500^0   ^M35I0
*   500^0   ^M86T@;75S=
{ HAPPY99=yes }

:0
* HAPPY99 ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Happy99/Spanska Virus/Worm"

 :0
 { VIRUSTAG=yes }

 :0
 { DANGEROUS=yes }
}


# Homepage Worm :/
#

:0 BH
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  1100^0   ^Subject: Homepage
*  1100^0   Homepage\.HTML\.vbs
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Homepage.vbs Virus"

 :0
 { VIRUSTAG=yes }

 :0
 { DANGEROUS=yes }
}


# Klez Virus
#
:0 BH
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*   600^0   ^Subject: (Hi|Hello|Re:|Fw:)?[ ]?A (special|very) \
                      (New|funny|nice|humour|excite|good|powful|WinXP|IE 6\.0) \
                      (game|tool|website|patch)\.$
*   600^0   ^Subject: (W32\.Elkern|W32\.Klez\.E) removal tools$
*   400^0   ^Subject: (how are you|\
                       let's be friends|\
                       darling|\
                       so cool a flash,enjoy it|\
                       your password|\
                       honey|\
                       some questions|\
                       please try again|\
                       welcome to my hometown|\
                       the Garden of Eden|\
                       introduction on ADSL|\
                       meeting notice|\
                       questionnaire|\
                       congratulations|\
                       Sos!|\
                       japanese girl VS playboy|\
                       look,my beautiful girl friend|\
                       eager to see you|\
                       spice girls' vocal concert|\
                       japanese lass' sexy pictures|\
                       Undeliverable mail --|\
                       Returned mail --)$
*   400^0   ^Subject: (Hi|\
                       Hello|\
                       How are you\?|\
                       Can you help me\?|\
                       We want peace|\
                       Where will you go\?|\
                       Congratulations!!!|\
                       Don't cry|\
                       Look at the pretty|\
                       Some advice on your shortcoming|\
                       Free XXX Pictures|\
                       A free hot porn site|\
                       Why don't you reply to me\?|\
                       How about have dinner with me together\?|\
                       Never kiss a stranger)$
*   400^0   ^Subject: Worm Klez\.E immunity$
*   400^0   ^Klez\.E is the most common world-wide spreading worm\.
*   400^0   ^I'm sorry to do so,but it\'s helpless to say sorry\.
*   400^0   ^I want a good job,I must support my parents\.
*   400^0   ^Now you have seen my technical capabilities
*   400^0   ^How much my year-salary now\? NO more than \$5,500
*   400^0   ^What do you think of this fact\?
*   400^0   ^Don't call my names,I have no hostility
*   400^0   ^acts as a fake Klez to fool the real worm,some AV monitor maybe cry when$
*   400^0   ^you run it. If so,Ignore the warning,and select \'continue\'\.
*   400^0   ^()\<FONT()\>Hi,This is a  nice game()\<br()\>$
*   400^0   ^This game is my first work\.()\<br()\>$
*   400^0   ^You're the first player\.()\<br()\>$
*   400^0   ^I hope you would enjoy it.()\<\/FONT()\>()\<\/BODY()\>()\<\/HTML()\>$
*   500^0   ^TVqQAAM
*   500^0   ^AAAAAAAA2AA
*   500^0   ^RE9TIG1v
*   500^0   ^GbNm\+BOzPuc
*   500^0   ^GbPm9hOz
*   500^0   ^UEUAAEwB
*   500^0   ^EFNWM\/ZXM9
*   500^0   ^q4XJqn4Vi0
*   500^0   ^BBCIBDOKR
*   500^0   ^PEhUTUw\+PEJPR
*   500^0   ^ZiBwb3AtdXAiI
*   500^0   ^Y3JpcHQ+DQo8
*   500^0   ^aWdhdG9yLm1pbWVUeXBl
*   500^0   ^YXZpZ2F0b3IubW
*   500^0   ^AAAA2AAAAA4f
*   500^0   ^ZGUuDQ0KJAAA
*   500^0   ^s1X4E7Nc\+BKzJfgTs
*   500^0   ^qn4Vi0UIjX38A
*   500^0   ^0EPA6gQCyoXbdC
*   500^0   ^PGh0bWw\+CiAgIDxoZ
*   500^0   ^IGNvbnRlbnQ9InRleH
*   500^0   ^PgogICA8L2hlYWQ
*   500^0   ^dmxpbms9IiNCOTI
*   500^0   ^UiBCVVRUT05TLS
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Klez Virus/Worm"

 :0
 { VIRUSTAG=yes }

 :0
 { DANGEROUS=yes }
}


# Mawanella Worm :/
#

:0 BH
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  1100^0   ^Subject: Mawanella
*  1100^0   Mawanella\.HTML\.vbs
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Mawanella.vbs Virus"

 :0
 { VIRUSTAG=yes }

 :0
 { DANGEROUS=yes }
}


# Nimda.A
#
#  New and extremely virulent virus, spreads as readme.exe.
#
:0 BH
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -200^1   ^[:;#>]
*   200^1  !^To:
*   500^1   ^X-Unsent: 1
*   500^1   ^Subject:.*serviceservicebots
*  1100^0    name=\"readme\.exe\"
*   500^0    TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
*   500^0    AAAA2AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1v
*   500^0    ZGUuDQ0KJAAAAAAAAAA11CFvcbVPPHG1TzxxtU88E6pcPHW1TzyZqkU8dbVPPJmqSzxytU88cbVO
*   500^0    PBG1TzyZqkQ8fbVPPMmzSTxwtU88UmljaHG1TzwAAAAAAAAAAMx11goAAAB/UEUAAEwBBQB1Oqc7
*   500^0    AFNWVzP/aAwCAACNhbT8//9XUOjEYwAAg8QM/xVcgBc2gKW3/P//f2oBW2aJhbT8//9TiJ22/P//
*   500^0    /xU4rBc2V2aJhbj8////FTisFzZXZomFuvz///8VOKwXNldmiYW+/P///xU4rBc2/3UIZomFvPz/
*   500^0    /42FwPz//1DoAgIAAFk7x1kPjIgAAABqD420BcD8////FTisFzZmiQZGU0b/FTisFzZmiQaNhbT8
*   500^0    hAAAtoQAAMKEAADShAAA5IQAAPqEAAAIhQAAHoUAACqFAAA4hQAAQIUAAFCFAABkhQAAeIUAAIiF
*   500^0    mocAAAAAAADOgwAAWIMAABqEAAAmhAAA8oMAAASEAAD6gwAA1oMAAOiDAADegwAAxIMAALqDAACw
*   500^0    dmFuY2VkACVscwBcXCVzAAAAACVsZCAlbGQgJWxkACVsZCAlbGQASW1hZ2UgU3BhY2UgRXhlYyBX
*   500^0    rKysrNnZ06z09PTz8/MbG7wSCgoKCgqGkaDOrKz29vb29oWs6NnTrPb09PTz8/MbvBIKCgoKCqeG
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Nimda-A"

 :0
 { VIRUSTAG=yes }

 :0
 { DANGEROUS=yes }
}


# SirCam Virus (W32.SirCam@MM)
#
:0 BH
* ^Content-Type:.*(multipart|attachment)
* -1000^0
*  1100^0   mDmcOaA5pDmoOaw5sDnAOeA56DnsOfA59Dn4Ofw5ADoEOgg6HDo8OkQ6SD
*   500^0   Hi\! How are you(\?|=3F)
*   500^0   I send you this file in order to have your advice
*   500^0   I hope you like the file that I send[ t]?o you
*   500^0   This is the file with the information that you ask for
*   500^0   See you later(\.|=2E) Thanks
*   500^0   Hola como estas *\?
*   500^0   Te mando este archivo para que me des tu punto de vista
*   500^0   Espero me puedas ayudar con el archivo que te mando
*   500^0   Espero te guste este archivo que te mando
*   500^0   Este es el archivo con la informaci=n que me pediste
*   500^0   Nos vemos pronto, gracias\.
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: SirCam Virus"

 :0
 { VIRUSTAG=yes }

 :0
 { DANGEROUS=yes }
}


# Snow White Virus :/
#
:0
*  ^From:.*hahaha@sexyfun\.net
{ SNOWW=yes }

:0 BH
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  1100^0   ^From:.*hahaha@sexyfun\.net
*  1100^0   ^Subject: Snowhite and the Seven Dwarfs \- The REAL story\!$
*  1100^0   dwarf4you\.exe
*  1100^0   midgets\.scr
{ SNOWW=yes }

:0
* SNOWW ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Snow White Virus"

 :0
 { VIRUSTAG=yes }

 :0
 { DANGEROUS=yes }
}