smb_suspicious_files.nasl

漏洞扫描源码,可以扫描linux,windows,交换机路由器

URL=http://www.doxdesk.com/parasite/Transponder.html 
KEY=CLSID\{00000580-C637-11D5-831C-00105AD6ACF0}\InprocServer32
ITEM=
EXP=Msview.dll
NAME=VX2.aBetterInternet
URL=http://www.doxdesk.com/parasite/Transponder.html 
KEY=CLSID\{000006B1-19B5-414A-849F-2A3C64AE6939}\InprocServer32
ITEM=
EXP=bi.dll
NAME=SideSearch
URL=http://doxdesk.com/parasite/Sidesearch.html
KEY=CLSID\{00000762-3965-4A1A-98CE-3D4BF457D4C8}\InprocServer32
ITEM=
EXP=sidesearch.dll
NAME=FavoriteMan
URL=http://www.doxdesk.com/parasite/FavoriteMan.html
KEY=CLSID\{00000EF1-0786-4633-87C6-1AA7A44296DA}\InprocServer32
ITEM=
EXP=ATPartners.dll
NAME=FavoriteMan
URL=http://www.doxdesk.com/parasite/FavoriteMan.html 
KEY=CLSID\{00000EF1-34E3-4633-87C6-1AA7A44296DA}\InprocServer32
ITEM=
EXP=F1.dll
NAME=TwainTech adware
URL=http://www.pchell.com/support/twaintec.shtml
KEY=CLSID\{000020DD-C72E-4113-AF77-DD56626C6C42}\InprocServer32
ITEM=
EXP=twaintec.dll
NAME=TwainTech adware
URL=http://www.ca.com/us/securityadvisor/pest/pest.aspx?id=453078844
KEY=CLSID\{0000607D-D204-42C7-8E46-216055BF9918}\InprocServer32
ITEM=
EXP=mxTarget.dll
NAME=AdsStore adware
URL=http://research.sunbelt-software.com/threatdisplay.aspx?name=AdsStore&threatid=1717
KEY=CLSID\{00010a21-b924-4cd6-893c-eea1071ae8b3}\InprocServer32
ITEM=
EXP=PCDBS.DLL
NAME=SearchFast parasite
URL=http://doxdesk.com/parasite/Searchfst.html
KEY=CLSID\{000277A3-7D84-406a-9799-D12A81594693}\InprocServer32
ITEM=
EXP=srchfst.dll
NAME=SearchEnhancement hijacker
URL=http://www.doxdesk.com/parasite/SCBar.html
KEY=CLSID\{00041A26-7033-432C-94C7-6371DE343822}\InprocServer32
ITEM=
EXP=scbar.dll
NAME=ShopNav variant
URL=http://www.doxdesk.com/parasite/ShopNav.html
KEY=CLSID\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\InprocServer32
ITEM=
EXP=enhtb.dll
NAME=LZIO.com adware
URL=http://www.spywareguide.com/product_show.php?id=853
KEY=CLSID\{000E6ED5-E3FC-4c93-99E9-D38D2A9F9B09}\InprocServer32
ITEM=
EXP=he3e3fc4.dll
NAME=NetPal
URL=http://www.doxdesk.com/parasite/NetPal.html
KEY=CLSID\{000E7270-CC7A-0786-8E7A-DA09B51938A6}\InprocServer32
ITEM=
EXP=n3tpa1.dll
NAME=CoolWebSearch parasite variant
URL=http://www.richardthelionhearted.com/~merijn/cwschronicles.html#
KEY=CLSID\{00110011-4B0B-44D5-9718-90C88817369B}\InprocServer32
ITEM=
EXP=NavExt.dll
NAME=BookedSpace
URL=http://www.doxdesk.com/parasite/BookedSpace.html
KEY=CLSID\{0019C3E2-DD48-4A6D-AB2D-8D32436313D9}\InprocServer32
ITEM=
EXP=oo4.dll
NAME=BookedSpace variant
URL=http://www.doxdesk.com/parasite/BookedSpace.html
KEY=CLSID\{0019C3E2-DD48-4A6D-ABCD-8D32436313D9}\InprocServer32
ITEM=
EXP=bxsx5.dll
NAME=BookedSpace variant
URL=http://www.doxdesk.com/parasite/BookedSpace.html
KEY=CLSID\{0019C3E2-DD48-4A6D-ABCD-8D32436323D9}\InprocServer32
ITEM=
EXP=bxxs5.dll
NAME=WebSearch
URL=http://www.spywareguide.com/product_show.php?id=505
KEY=CLSID\{001DAE60-95C0-11d3-924E-009027950886}\InprocServer32
ITEM=
EXP=Spotonbh.dll
NAME=AtHoc Toolbar
URL=http://www.athoc.com/site/products/portalToolbar.asp
KEY=CLSID\{001F2470-5DF5-11d3-B991-00A0C9BB0874}\InprocServer32
ITEM=
EXP=AtHocTBr.DLL
NAME=MultiMPP.com adware
URL=http://www.multimpp.com/
KEY=CLSID\{002EB272-2590-4693-B166-FBD5D9B6FEA6}\InprocServer32
ITEM=
EXP=multimpp.dll
NAME=Transponder parasite variant
URL=http://www.doxdesk.com/parasite/Transponder.html
KEY=CLSID\{00320615-B6C2-40A6-8F99-F1C52D674FAD}\InprocServer32
ITEM=
EXP=localNRD.dll
NAME=Naupoint toolbar
URL=http://doxdesk.com/parasite/Naupoint.html
KEY=CLSID\{0036F389-FEF8-43AC-9220-16430E0012ED}\InprocServer32
ITEM=
EXP=iEBINST.dll
NAME=Malware taking advantage of the ASN.1 exploit
URL=http://www.us-cert.gov/cas/techalerts/TA04-041A.html
KEY=CLSID\{00673769-777F-4814-BE0F-74CBA1D823B8}\InprocServer32
ITEM=
EXP=Iehook.dll
NAME=Adware.Slagent
URL=http://securityresponse.symantec.com/avcenter/venc/data/trojan.simcss.b.html
KEY=CLSID\{008DB894-99ED-445D-8547-0E7C9808898D}\InprocServer32
ITEM=
EXP=4b_1,0,1,2_mslagent.dll
NAME=ClientMan
URL=http://www.doxdesk.com/parasite/ClientMan.html
KEY=CLSID\{00A0A40C-F432-4C59-BA11-B25D142C7AB7}\InprocServer32
ITEM=
EXP=2IN
NAME=MyTotalSearch
URL=http://www.doxdesk.com/parasite/MySearch.html
KEY=CLSID\{00BD2861-C654-4694-A44A-98642D73247D}\InprocServer32
ITEM=
EXP=MTSSRCAS.DLL
NAME=IncrediFind variant
URL=http://www.doxdesk.com/parasite/KeenValue.html
KEY=CLSID\{00D6A7E7-4A97-456f-848A-3B75BF7554D7}\InprocServer32
ITEM=
EXP=PerfectNavBHO.dll
NAME=FastFind.org SubSearch
URL=http://www.ca.com/us/securityadvisor/pest/pest.aspx?id=453074896
KEY=CLSID\{00F16DC8-1B2A-42F4-B18B-E21DA9D2D7FD}\InprocServer32
ITEM=
EXP=01A00.DLL
NAME=PolyFilter
URL=
KEY=CLSID\{0140DF95-9128-4053-AE72-F43F0CFCA062}\InprocServer32
ITEM=
EXP=SiKernel.dll
NAME=ExactSearch or MySearch
URL=http://www.doxdesk.com/parasite/eXactSearch.html http://doxdesk.com/parasite/MySearch.html
KEY=CLSID\{014DA6C1-189F-421a-88CD-07CFE51CFF10}\InprocServer32
ITEM=
EXP=eXacttoolbar.dll
NAME=Apropos Adware
URL=http://www.giantcompany.com/antispyware/research/spyware/spyware-AproposMedia.aspx
KEY=CLSID\{016235BE-59D4-4CEB-ADD5-E2378282A1D9}\InprocServer32
ITEM=
EXP=CxtPls.dll
NAME=Enhancemysearch.com keyword hijacker
URL=
KEY=CLSID\{017C20C1-F86F-11D8-9B25-000ACD002AE3}\InprocServer32
ITEM=
EXP=Helper100.dll
NAME=Incredifind/Keenvalue
URL=http://www.doxdesk.com/parasite/KeenValue.html
KEY=CLSID\{0199DF25-9820-4bd5-9FEE-5A765AB4371E}\InprocServer32
ITEM=
EXP=IncFindBHO170.dll
NAME=PeopleOnPage/AproposMedia
URL=http://www.doxdesk.com/parasite/AproposMedia.html 
KEY=CLSID\{01C5BF6C-E699-4CD7-BEA1-786FA05C83AB}\InprocServer32
ITEM=
EXP=AproposPlugin.dll
NAME=IncrediFind/Keenvalue
URL=http://www.doxdesk.com/parasite/KeenValue.html
KEY=CLSID\{01CD4DDA-166D-4831-A373-ACCC27E1BB9D}\InprocServer32
ITEM=
EXP=IncFindBHO150c.dll
NAME=IEPlugin variant
URL=http://www.doxdesk.com/parasite/IEPlugin.html
KEY=CLSID\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\InprocServer32
ITEM=
EXP=systb.dll
NAME=unknown malware
URL=http://www.virit.com/startup/scheda.asp?num=21
KEY=CLSID\{01FB9C55-FC66-4476-A199-389241193188}\InprocServer32
ITEM=
EXP=dll
NAME=Adware.Slagent
URL=http://securityresponse.symantec.com/avcenter/venc/data/trojan.simcss.b.html
KEY=CLSID\{021BB032-80A8-4FB6-B3D5-CF27B1553B95}\InprocServer32
ITEM=
EXP=4b_1,0,1,0_mslagent.dll
NAME=Adlogix InPop
URL=
KEY=CLSID\{024DE5EB-3649-445E-8D57-C09A9A33D479}\InprocServer32
ITEM=
EXP=phelper.dll
NAME=Adware.LizardBar
URL=http://sarc.com/avcenter/venc/data/adware.lizardbar.html
KEY=CLSID\{029BB53A-C312-4b09-9B4F-ED57AF027B28}\InprocServer32
ITEM=
EXP=winhlp32.dll
NAME=VirtuMonde adware variant Vundo
URL=http://securityresponse.symantec.com/avcenter/venc/data/trojan.vundo.html
KEY=CLSID\{02F96FB7-8AF6-439B-B7BA-2F952F9E4800}\InprocServer32
ITEM=
EXP=dat
NAME=Trojan.Downloader.Domcom.A
URL=
KEY=CLSID\{031B6D43-CBC4-46A5-8E46-CF8B407C1A33}\InprocServer32
ITEM=
EXP=ipreg32.dll
NAME=Muul.com SiteHistory  hijacker
URL=
KEY=CLSID\{0345B059-8731-42BC-B7B7-5121014B02C6}\InprocServer32
ITEM=
EXP=ChangeURL_30.dll
NAME=TOPicks
URL=http://www.doxdesk.com/parasite/TOPicks.html 
KEY=CLSID\{0352960F-47BE-11D5-AB93-00D0B760B4EB}\InprocServer32
ITEM=
EXP=Htcheck2.dll
NAME=SmartPops
URL=http://www.kephyr.com/spywarescanner/library/smartpops/index.phtml
KEY=CLSID\{0421701D-CF13-4E70-ADF0-45A953E7CB8B}\InprocServer32
ITEM=
EXP=RH.dll
NAME=IncrediFind variant
URL=http://www.doxdesk.com/parasite/KeenValue.html 
KEY=CLSID\{0428FFC7-1931-45b7-95CB-3CBB919777E1}\InprocServer32
ITEM=
EXP=PerfectNavBHO.dll
NAME=unidentified hijacker
URL=
KEY=CLSID\{044D9F9F-0EE0-4E9B-B89B-5EBCA0F852CC}\InprocServer32
ITEM=
EXP=fsearchbar.dll
NAME=Actual Names (AdvSearch) Internet Keywords
URL=http://www.ca.com/us/securityadvisor/pest/pest.aspx?id=453072513
KEY=CLSID\{046D6EA4-15E3-4b27-8010-45BD78A9219E}\InprocServer32
ITEM=
EXP=inetkw.dll
NAME=Excite Search bar
URL=http://www.excite.com/ 
KEY=CLSID\{04719991-296F-4958-AA0F-FA25FFA5008B}\InprocServer32
ITEM=
EXP=X8bar.dll
NAME=Icoo Loader
URL=http://www.by-users.co.uk/forums/?board=help&action=display&num=1085918311
KEY=CLSID\{0519A9C9-064A-4cbc-BC47-D0EACD581477}\InprocServer32
ITEM=
EXP=icooue.dll
NAME=ShopForGood/Marketdart
URL=http://www.kephyr.com/spywarescanner/library/shopforgood/index.phtml 
KEY=CLSID\{05BBB56A-2A69-4A5C-BFDA-43295DD67434}\InprocServer32
ITEM=
EXP=Winy.dll
NAME=StickyPops.com adware
URL=
KEY=CLSID\{06594350-D723-11D8-9669-0800200C9A66}\InprocServer32
ITEM=
EXP=DNSProxy.dll
NAME=Zy web search hijacker
URL=
KEY=CLSID\{06CAD548-14DD-4fa3-9EA9-05F83C18CBD7}\InprocServer32
ITEM=
EXP=MSPXS32.DLL
NAME=7FaSSt /7Search
URL=http://www.doxdesk.com/parasite/7FaSSt.html 
KEY=CLSID\{06DFEDAA-6196-11D5-BFC8-00508B4A487D}\InprocServer32
ITEM=
EXP=7Search.dll
NAME=Spyware.BrowserAccel
URL=http://securityresponse.symantec.com/avcenter/venc/data/spyware.browseraccel.html
KEY=CLSID\{074E3AA7-7718-4404-B3F8-FF8FB5414E0E}\InprocServer32
ITEM=
EXP=BrowserAccelerator.dll
NAME=Advanced Searchbar
URL=http://www.spynet.com/spyware/spyware-Advanced-Searchbar.aspx
KEY=CLSID\{07531599-F255-4050-B96E-ECE5AA2E63A5}\InprocServer32
ITEM=
EXP=AdvancedBar.dll
NAME=Superlogy.com search hijacker
URL=
KEY=CLSID\{08227B4B-54FE-4C4D-809F-BCA46292FC5B}\InprocServer32
ITEM=
EXP=Zedd4.dll
NAME=SideStep
URL=http://www.doxdesk.com/parasite/SideStep.html 
KEY=CLSID\{08351226-6472-43BD-8A40-D9221FF1C4CE}\InprocServer32
ITEM=
EXP=SbCIe026.dll
NAME=SideStep
URL=http://www.doxdesk.com/parasite/SideStep.html
KEY=CLSID\{08351227-6472-43BD-8A40-D9221FF1C4CE}\InprocServer32
ITEM=
EXP=SbCIe027.dll
NAME=CoolWebSearch parasite variant
URL=http://www.richardthelionhearted.com/~merijn/cwschronicles.html
KEY=CLSID\{086AE192-23A6-48D6-96EC-715F53797E85}\InprocServer32
ITEM=
EXP=DReplace.dll
NAME=TrafficHog, iLookup variant
URL=http://www.doxdesk.com/parasite/ILookup.html
KEY=CLSID\{086CEFD5-A88D-4981-8915-D51F04360ED1}\InprocServer32
ITEM=
EXP=winalot32.dll
NAME=BrowserAid/SearchandClick
URL=http://www.kephyr.com/spywarescanner/library/browseraid/index.phtml
KEY=CLSID\{087173EF-9829-4F49-8340-A524177D3F60}\InprocServer32
ITEM=
EXP=inetp60.dll
NAME=Linkz.com AdBlock
URL=http://www.castlecops.com/tk89-APHelper_Class.html
KEY=CLSID\{08C63920-DC18-11D2-9E1E-00A0247061AB}\InprocServer32
ITEM=
EXP=Aphelper.dll
NAME=Friends.fr. toolbar
URL=http://research.sunbelt-software.com/threatdisplay.aspx?threatid=47429
KEY=CLSID\{08DBDE36-DF28-11D5-8CA5-0050DA44A764}\InprocServer32
ITEM=
EXP=Msvri.dll
NAME=Trojan.Clicker.Delf.ai
URL=http://research.sunbelt-software.com/threatdisplay.aspx?threatid=47211
KEY=CLSID\{08DF42F3-792D-4944-941B-512582B87219}\InprocServer32
ITEM=
EXP=adobeacr.dll
NAME=iWon Search Assistant
URL=http://www.doxdesk.com/parasite/Aornum.html
KEY=CLSID\{08E1C8E1-E565-44fc-A766-C9539BB3ABB7}\InprocServer32
ITEM=
EXP=I1srchas.dll
NAME=Grip Toolbar
URL=http://www.giantcompany.com/antispyware/research/spyware/spyware-Grip-Toolbar.aspx
KEY=CLSID\{08F46458-D00F-4573-8EB3-A9A9E15503F8}\InprocServer32
ITEM=
EXP=NetGuideBHO170.dll
NAME=MyTotalSearch
URL=http://www.doxdesk.com/parasite/MySearch.html
KEY=CLSID\{094176F1-BF35-4bcb-B68A-108DFB8C3825}\InprocServer32
ITEM=
EXP=MTSBAR.DLL
NAME=ClientMan
URL=http://www.doxdesk.com/parasite/ClientMan.html 
KEY=CLSID\{0982868C-47F0-4EFB-A664-C7B0B1015808}\InprocServer32
ITEM=
EXP=Newads~1.dll
NAME=Adware.IAGold
URL=http://sarc.com/avcenter/venc/data/adware.iagold.html
KEY=CLSID\{0A1A2A3A-4A5A-6A7A-8A9A-AABACADAEAFA}\InprocServer32
ITEM=
EXP=dll
NAME=HuntBar/Stoolbar
URL=http://www.doxdesk.com/parasite/HuntBar.html
KEY=CLSID\{0A5CF411-F0BF-4AF8-A2A4-8233F3109BED}\InprocServer32
ITEM=
EXP=Stoolbar.dll
NAME=HuntBar
URL=http://www.doxdesk.com/parasite/HuntBar.html
KEY=CLSID\{0A68C5A2-64AE-4415-88A2-6542304A4745}\InprocServer32
ITEM=
EXP=Msiets.dll
NAME=Sexxxpassport.com browser plugin
URL=
KEY=CLSID\{0A7E7249-89E4-4FBF-B256-04DC8F8BAD69}\InprocServer32
ITEM=
EXP=Spp3.dll
NAME=Thesearchmall, iLookup variant
URL=http://www.doxdesk.com/parasite/ILookup.htm
KEY=CLSID\{0AEE4D0C-4B38-4196-AE32-70ACE5656647}\InprocServer32
ITEM=
EXP=winsrm32.dll
NAME=CoolWebSearch parasite variant
URL=http://www.richardthelionhearted.com/~merijn/cwschronicles.html#
KEY=CLSID\{0B519E07-7824-4adc-8890-93D5EABBF285}\InprocServer32
ITEM=
EXP=msadocm32.dll
NAME=Adlogix.com Zamingo adware
URL=http://www.spyany.com/program/article_adw_rm_Zamingo.html
KEY=CLSID\{0B90AA1B-F649-44C3-9FD3-736C332CBBCF}\InprocServer32
ITEM=
EXP=IEEnhancer.dll
NAME=ClientMan
URL=http://www.doxdesk.com/parasite/ClientMan.html 
KEY=CLSID\{0BA1C6EB-D062-4E37-9DB5-B07743276324}\InprocServer32
ITEM=
EXP=ms****.dll
NAME=SBSoft/EZFinder.com hijacker
URL=http://www.castlecops.com/tk1385-uns_dll.html
KEY=CLSID\{0CA6C3EA-2054-4011-BC9F-8BBC017A169C}\InprocServer32
ITEM=
EXP=uns.dll
NAME=LZIO.com adware
URL=http://www.spywareguide.com/product_show.php?id=853
KEY=CLSID\{0D7DC475-59EB-4781-985F-A6F5D4E2BC73}\InprocServer32
ITEM=
EXP=Lie1D6Ff.dll
NAME=BrowserAid/FeaturedResults
URL=http://www.doxdesk.com/parasite/BrowserAid.html 
KEY=CLSID\{0DDBB570-0396-44C9-986A-8F6F61A51C2F}\InprocServer32
ITEM=
EXP=Msiefr40.dll
NAME=Deltabar : Deltaclick
URL=http://support.microsoft.com/?kbid=316770 
KEY=CLSID\{0FC817C2-3B45-11D4-8340-0050DA825906}\InprocServer32
ITEM=
EXP=DeltaClick.dll
NAME=Whazit
URL=http://www.doxdesk.com/parasite/Whazit.html 
KEY=CLSID\{10955232-B671-11D7-8066-0040F6F477E4}\InprocServer32
ITEM=
EXP=whattn.dll
NAME=CnsMin
URL=http://www.doxdesk.com/parasite/CnsMin.html
KEY=CLSID\{118CE65F-5D86-4AEA-A9BD-94F92B89119F}\InprocServer32
ITEM=
EXP=CnsMinIdn.dll