suspscan.dat

在网络安全中经常会遇到rootkit

Version:2007061101
a:0x..,.0x.., a:add? a:asm+10 a:%:bh a:decb a:decl a:disasm+10 a:%e[bp,di,sp] a:%e[cx,si] a:%e?x a:%hi a:inc[b,l] a:jmp a:jmpcode ajuda a:jump a:%?l a:mov? a:nasm+10 a:ndisasm+10 a:nopsize+10 a:notb a:offset+10 a:opcode+10 a:p[op,ush] a:reassembl a:ret a:ro[r,l]b a:sub? a:xor c:%..%..%..% d:bonk d:flood+100 d:jolt d:kuang d:land d:nuke+100 d:saihyousen d:tear d:teardrop f:abort f:access f:AF_INET f:atoi@ f:buf[fe,si] f:call f:changeown f:exec.* f:fopen@ f:fread f:free f:fscanf f:loop f:lseek f:malloc f:memcpy f:memset f:mmap f:putenv f:static.char.*= f:str[len,cat] f:'system(' i:botz i:bounc+10 i:dalnet i:dc\.pl i:eggbot+10 i:eggshell+10 i:invite+10 i:irc\.+100 i:iroffer+100 i:dalnet i:efnet i:undernet i:nick+10 i:pbsync+100 i:psybnc+100 i:vhost+100 i:xdcc+100 n:bind n:connect+100 n:'connect('+100 n:'gethostbyname(' n:'getprotobyname(' n:ident n:inet+10 n:'inet_aton(' n:IO::Socket n:listen+100 n:network n:packet+10 n:relay+10 n:remote+10 n:resolv+10 n:rhost n:sendfile+10 n:server+10 n:setsockopt+10 n:'(?sock' n:sockaddr n:'sockaddr_in(' n:sock[ad,et,fd] n:socket n:socklen n:'sockopen(' s:?0x[a-z0-9]\{2\}.* s:backdoor+10 s:/bin/sh+100 s:chmod s:chown s:keylog+10 s:logcleaner s:login s:password+10 s:/ptmx+100 s:/pty+100 s:setgid+100 s:setreuid+100 s:setuid+100 s:shellcode+100 s:tmp/sh+100 s:/tty+100 s:\"/\x[a-z0-9]\{2\}.* t:'0^wN' t:0wn3d t:0wned t:advantag t:advisory+100 t:affect t:allocation t:anony t:arbitr t:attack+10 t:authenti t:bogus t:brute+100 t:buscar t:comando t:crypt t:decode t:destinat t:destruct t:device t:/dev/kmem+100 t:/dev/mem+100 t:disclos+10 t:discov+10 t:distrib+10 t:downloader t:elf-init t:elflbl t:endian t:enem t:evasion+10 t:exception t:exclusiv+10 t:existant t:ploit+100 t:fake t:fatal+10 t:fixed t:fragment t:fuckin t:group t:h[a4]x[oO0]r t:hardcod+100 t:harvest t:heap+100 t:hexdump+10 t:hidden+10 t:hide+100 t:host t:hostile t:hotfix t:infect+10 t:info t:init t:inject+100 t:kernel+100 t:kill t:leak t:'log(' t:mech+10 t:modif[yi] t:mprotect t:nvalid+10 t:overwrit+10 t:pages t:patch t:payload+100 t:philar\.pl t:pointer+100 t:priv[a8] t:process t:procur t:publi[cs] t:purpose t:registered t:risk t:r.nin t:sapphire t:scam+10 t:segment t:sent t:shell\.php t:signed t:sniff+10 t:spawn+10 t:spoof+10 t:stealth+10 t:succes t:suficiente t:terminate t:transact t:transpar t:udp\.pl t:victim t:violat t:vma t:vuln t:worm t:wreck t:rootkit t:banner t:portsc x:apache x:mambo x:openssl x:samba x:sshd x:openssh x:wwwadmin x:telnet x:ftpd