smb_suspicious_files.nasl

漏洞扫描源码,可以扫描linux,windows,交换机路由器

ITEM=
EXP=instafin.dll
NAME=SearchCentrix adware variant
URL=http://www.kephyr.com/spywarescanner/library/searchcentrix.mygeek/index.phtml
KEY=CLSID\{4E7BD74F-2B8D-469E-DFF7-EC6BF4D5FA7D}\InprocServer32
ITEM=
EXP=gsim.dll
NAME=KeenValue/Powersearch variant
URL=http://www.doxdesk.com/parasite/KeenValue.html
KEY=CLSID\{4E7BD74F-2B8D-469E-DFF7-EC7DA787AD2D}\InprocServer32
ITEM=
EXP=Pwrsqsim.dll
NAME=404Search
URL=http://doxdesk.com/parasite/404Search.html
KEY=CLSID\{4E7BD74F-2B8D-469E-EEFD-ED6DB186CE4D}\InprocServer32
ITEM=
EXP=404Search.dll
NAME=IncrediFind/Keenvalue
URL=http://www.doxdesk.com/parasite/KeenValue.html
KEY=CLSID\{4FC95EDD-4796-4966-9049-29649C80111D}\InprocServer32
ITEM=
EXP=incfindbho.dll
NAME=SeekSeek
URL=http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=ADW_SCANPORTAL.A&VSect=T
KEY=CLSID\{5074851C-F67A-488E-A9C9-C244573F4068}\InprocServer32
ITEM=
EXP=iesearch.dll
NAME=AdBars
URL=http://www.ca.com/us/securityadvisor/pest/pest.aspx?id=453079049
KEY=CLSID\{51641EF3-8A7A-4D84-8659-B0911E947CC8}\InprocServer32
ITEM=
EXP=DownloadHtml.dll
NAME=WurldMedia
URL=http://www.ca.com/us/securityadvisor/pest/pest.aspx?id=59272
KEY=CLSID\{525BBD23-1863-46C6-86D6-5F9A3715D44E}\InprocServer32
ITEM=
EXP=mbho.dll
NAME=NetNucleus/Mirar webband
URL=http://www.kephyr.com/spywarescanner/library/mirartoolbar.winnb40/index.phtml
KEY=CLSID\{528DA727-EC08-461E-9564-DF5C971E8574}\InprocServer32
ITEM=
EXP=WinNB40.dll
NAME=CoolWebSearch parasite variant
URL=http://www.richardthelionhearted.com/~merijn/cwschronicles.html#
KEY=CLSID\{52DC9EC1-35A9-4914-98D9-D568A9854DA2}\InprocServer32
ITEM=
EXP=dll
NAME=DigitalNames spyware related
URL=http://securityresponse.symantec.com/avcenter/venc/data/spyware.digitalnames.html
KEY=CLSID\{531553EB-B210-4116-BC2C-C09608F4193E}\InprocServer32
ITEM=
EXP=SetGlbHO.dll
NAME=CoolWebSearch parasite variant
URL=http://www.richardthelionhearted.com/~merijn/cwschronicles.html#
KEY=CLSID\{5321E378-FFAD-4999-8C62-03CA8155F0B3}\InprocServer32
ITEM=
EXP=1.00.07.dll
NAME=404Search
URL=http://doxdesk.com/parasite/404Search.html
KEY=CLSID\{53C330D6-A4AB-419B-B45D-FD4411C1FEF4}\InprocServer32
ITEM=
EXP=404Search.dll
NAME=WinAd
URL=http://www.kephyr.com/spywarescanner/library/winad/index.phtml
KEY=CLSID\{53D3C442-8FEE-4784-9A21-6297D39613F0}\InprocServer32
ITEM=
EXP=Winad2.dll
NAME=HighTraffic
URL=http://www.doxdesk.com/parasite/HighTraffic.html
KEY=CLSID\{53E10C2C-43B2-4657-BA29-AAE179E7D35C}\InprocServer32
ITEM=
EXP=BHO2.dll
NAME=CoolWebSearch parasite variant
URL=http://www.richardthelionhearted.com/~merijn/cwschronicles.html#
KEY=CLSID\{5483427F-93B8-1470-5A89-E6B56484CDB2}\InprocServer32
ITEM=
EXP=
NAME=InetSpeak/Iexplorr
URL=http://www.doxdesk.com/parasite/InetSpeak.html
KEY=CLSID\{54ED9B49-81D1-4866-95A6-30F01DE0047E}\InprocServer32
ITEM=
EXP=iexplorr29.dll
NAME=from imu.com.cn
URL=
KEY=CLSID\{54F8C0E2-34F9-474F-B47F-2CFCFE2300A2}\InprocServer32
ITEM=
EXP=IMULiver.dll
NAME=VirtuMonde adware variant
URL=http://securityresponse.symantec.com/avcenter/venc/data/adware.virtumonde.html
KEY=CLSID\{55E301E5-BA44-4095-BB0B-14E0123CCF71}\InprocServer32
ITEM=
EXP=dat
NAME=SafeguardProtect/Veevo
URL=http://www.castlecops.com/tk1602-sfg_dll_random_char.html
KEY=CLSID\{564FFB73-9EEF-4969-92FA-5FC4A92E2C2A}\InprocServer32
ITEM=
EXP=sfg_
NAME=CoolWebSearch parasite variant
URL=http://www.richardthelionhearted.com/~merijn/cwschronicles.html#
KEY=CLSID\{5742F79A-1D91-42c4-990C-B46CF55A6478}\InprocServer32
ITEM=
EXP=setfgi.dll
NAME=Adware.Margoc variant
URL=http://sarc.com/avcenter/venc/data/adware.margoc.html
KEY=CLSID\{57CD6D2E-0291-488F-B846-AF101B367DD5}\InprocServer32
ITEM=
EXP=dll
NAME=Ezula TopText
URL=http://www.cexx.org/toptext.htm
KEY=CLSID\{58359010-BF36-11D3-99A2-0050DA2EE1BE}\InprocServer32
ITEM=
EXP=eabh.dll
NAME=Gratisware
URL=http://www.doxdesk.com/parasite/Gratisware.html
KEY=CLSID\{5843A29E-1246-11D4-BA8C-0050DA707ACD}\InprocServer32
ITEM=
EXP=crs32.dll
NAME=CoolWebSearch parasite variant
URL=http://www.richardthelionhearted.com/~merijn/cwschronicles.html#
KEY=CLSID\{587DBF2D-9145-4c9e-92C2-1F953DA73773}\InprocServer32
ITEM=
EXP=Iefeatsl.dll
NAME=TotalVelocity zSearch
URL=http://www.ca.com/us/securityadvisor/pest/pest.aspx?id=453083031
KEY=CLSID\{5886A6DC-AAF4-45E9-979A-8E5E6DEE30E7}\InprocServer32
ITEM=
EXP=zSearch.dll
NAME=JimmySurf
URL=http://www.safer-networking.com/removeJimmySurf.php
KEY=CLSID\{5998B08E-CFAC-11D5-822A-0050048E6E38}\InprocServer32
ITEM=
EXP=SurfPlugin.dll
NAME=WurldMedia
URL=http://www.doxdesk.com/parasite/WurldMedia.html
KEY=CLSID\{5A3A5040-4210-11D7-BD2E-00080E34122F}\InprocServer32
ITEM=
EXP=M030206POHS.DLL
NAME=iSearch Desktop Search toolbar
URL=
KEY=CLSID\{5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993}\InprocServer32
ITEM=
EXP=sysupd.dll
NAME=eSearch browser Hijacker
URL=http://www.vsantivirus.com/troj-startpage-lg.htm
KEY=CLSID\{5C472352-90D0-4214-BF20-8E4A2B82F980}\InprocServer32
ITEM=
EXP=win32app.dll
NAME=IncrediFind/Keenvalue
URL=http://www.doxdesk.com/parasite/KeenValue.html
KEY=CLSID\{5D60FF48-95BE-4956-B4C6-6BB168A70310}\InprocServer32
ITEM=
EXP=incfindbho.dll
NAME=180solutions
URL=http://www.surfassistant.com/eula.html
KEY=CLSID\{5DAFD089-24B1-4c5e-BD42-8CA72550717B}\InprocServer32
ITEM=
EXP=saiemod.dll
NAME=ClientMan
URL=http://www.doxdesk.com/parasite/ClientMan.html
KEY=CLSID\{5ED50735-B0D9-47C6-9774-02DD8E6FE053}\InprocServer32
ITEM=
EXP=disable.dll
NAME=BrowserAid CashToolbar/QuickLaunch toolbar
URL=http://www.doxdesk.com/parasite/BrowserAid.html
KEY=CLSID\{5F5564AC-DE7A-4DCD-9296-32E71A35DCB6}\InprocServer32
ITEM=
EXP=Browseraidtoolbar.dll
NAME=BrowserPal toolbar
URL=http://www.doxdesk.com/parasite/BrowserPal.html
KEY=CLSID\{5F5564AC-DE7A-4DCD-9296-32E71A35DCB7}\InprocServer32
ITEM=
EXP=bptlb.dll
NAME=Adlogix.com Zamingo adware
URL=http://www.spyany.com/program/article_adw_rm_Zamingo.html
KEY=CLSID\{5FA6752A-C4A0-4222-88C2-928AE5AB4966}\InprocServer32
ITEM=
EXP=SWin32.dll
NAME=VirtuMonde adware variant
URL=http://securityresponse.symantec.com/avcenter/venc/data/adware.virtumonde.html
KEY=CLSID\{60112085-E1CE-4e0e-823A-EBB1AD98804C}\InprocServer32
ITEM=
EXP=dat
NAME=Naupoint toolbar
URL=http://doxdesk.com/parasite/Naupoint.html
KEY=CLSID\{60261C06-81B0-4DE0-9313-E5BA203A64E9}\InprocServer32
ITEM=
EXP=pdfmgr.dll
NAME=Netpal
URL=http://www.doxdesk.com/parasite/NetPal.html
KEY=CLSID\{6085FB5B-C281-4B9C-8E5D-D2792EA30D2F}\InprocServer32
ITEM=
EXP=Netpal.dll
NAME=iGetNet/Natural Language Navigation
URL=http://www.doxdesk.com/parasite/IGetNet.html
KEY=CLSID\{60E78CAC-E9A7-4302-B9EE-8582EDE22FBF}\InprocServer32
ITEM=
EXP=BHO001.DLL
NAME=i-lookup search bar
URL=http://www.doxdesk.com/parasite/ILookup.html
KEY=CLSID\{61D029AC-972B-49FE-A155-962DFA0A37BB}\InprocServer32
ITEM=
EXP=Ineb.dll
NAME=CoolWebSearch parasite variant
URL=http://www.richardthelionhearted.com/~merijn/cwschronicles.html#
KEY=CLSID\{62160EEF-9D84-4C19-B7B8-6AC2526CD726}\InprocServer32
ITEM=
EXP=dll
NAME=Matrix Technology Network 123Mania
URL=http://www.ca.com/us/securityadvisor/pest/pest.aspx?id=453094812
KEY=CLSID\{622CC208-B014-4FE0-801B-874A5E5E403A}\InprocServer32
ITEM=
EXP=GIDCAI32.DLL
NAME=CnsMin
URL=http://www.doxdesk.com/parasite/CnsMin.html
KEY=CLSID\{6231D512-E4A4-4DF2-BE62-5B8F0EE348EF}\InprocServer32
ITEM=
EXP=cesweb.dll
NAME=Stingware GuardBar
URL=http://www.guardbar.com/
KEY=CLSID\{62F5BBB6-A71E-46E7-AE78-73D25185EDC8}\InprocServer32
ITEM=
EXP=GuardBar.dll
NAME=Townews.com adware
URL=
KEY=CLSID\{634EFDE4-087D-4ce9-952F-63C9EEB2E0BF}\InprocServer32
ITEM=
EXP=WNDPOS~1.DLL
NAME=Naupoint toolbar
URL=http://doxdesk.com/parasite/Naupoint.html
KEY=CLSID\{6375B3AD-4440-4C1F-95E5-A24198ED671C}\InprocServer32
ITEM=
EXP=sp1.dll
NAME=Huntbar
URL=http://www.doxdesk.com/parasite/HuntBar.html
KEY=CLSID\{63B78BC1-A711-4D46-AD2F-C581AC420D41}\InprocServer32
ITEM=
EXP=Btiein.dll
NAME=FlashTrack, Ftapp
URL=http://www.doxdesk.com/parasite/FlashTrack.html
KEY=CLSID\{63CF97E8-4133-438a-A831-CC9C6D47D673}\InprocServer32
ITEM=
EXP=Flcp.dll
NAME=Win32/Aspam.Trojan
URL=http://www.doxdesk.com/parasite/ASpam.html
KEY=CLSID\{657B9354-BB3B-4500-A9B0-109B4FA64815}\InprocServer32
ITEM=
EXP=amcis32.dll
NAME=Commander Toolbar
URL=
KEY=CLSID\{6596829B-37D4-40ad-971B-1E9041725C52}\InprocServer32
ITEM=
EXP=ietb.dll
NAME=PeopleOnPage/AproposMedia
URL=http://www.doxdesk.com/parasite/AproposMedia.html
KEY=CLSID\{65C8C1F5-230E-4DC9-9A0D-F3159A5E7778}\InprocServer32
ITEM=
EXP=pop
NAME=OpinionBar
URL=http://www.earncashontheinternet.com/paidtosurf/review/opinionbar.asp
KEY=CLSID\{6607C683-AE7C-11D4-ACD7-0050DAC291A2}\InprocServer32
ITEM=
EXP=Myiemonitor.dll
NAME=Commonname toolbar
URL=http://www.doxdesk.com/parasite/CommonName.html
KEY=CLSID\{6656B666-992F-4D74-8588-8CAC9E79D90C}\InprocServer32
ITEM=
EXP=CNBabe.dll
NAME=FlashTrack, Ftapp
URL=http://www.doxdesk.com/parasite/FlashTrack.html
KEY=CLSID\{665ACD90-4541-4836-9FE4-062386BB8F05}\InprocServer32
ITEM=
EXP=F
NAME=LinkReplacer
URL=http://www.doxdesk.com/parasite/LinkReplacer.html
KEY=CLSID\{66993893-61B8-47DC-B10D-21E0C86DD9C8}\InprocServer32
ITEM=
EXP=iehelper.dll
NAME=Whazit
URL=http://www.doxdesk.com/parasite/Whazit.html
KEY=CLSID\{66F67511-2665-4C34-9E20-FAC2C0954EF2}\InprocServer32
ITEM=
EXP=whattt.dll
NAME=VirtuMonde adware variant
URL=http://securityresponse.symantec.com/avcenter/venc/data/adware.virtumonde.html
KEY=CLSID\{68132581-10F2-416E-B188-4E648075325A}\InprocServer32
ITEM=
EXP=dat
NAME=PrecisionPop adware
URL=http://sarc.com/avcenter/venc/data/adware.precisionpop.html
KEY=CLSID\{68513770-A18E-11D7-B77C-00C0DFF3F600}\InprocServer32
ITEM=
EXP=Helper.dll
NAME=IEplugin
URL=http://www.doxdesk.com/parasite/IEPlugin.html
KEY=CLSID\{69135BDE-5FDC-4B61-98AA-82AD2091BCCC}\InprocServer32
ITEM=
EXP=systb.dll
NAME=VirtuMonde adware variant
URL=http://securityresponse.symantec.com/avcenter/venc/data/adware.virtumonde.html
KEY=CLSID\{6A06CDAD-9D2D-42A0-9C91-C0CF7CB9971B}\InprocServer32
ITEM=
EXP=dat
NAME=LinkReplacer hijacker variant
URL=http://www.doxdesk.com/parasite/LinkReplacer.html
KEY=CLSID\{6A6E50DC-BFA8-4B40-AB1B-159E03E829FD}\InprocServer32
ITEM=
EXP=lmf32.dll
NAME=eAcceleration StopSign
URL=http://www.doxdesk.com/parasite/DownloadReceiver.html
KEY=CLSID\{6ACD11BD-4CA0-4283-A8D8-872B9BA289B6}\InprocServer32
ITEM=
EXP=webcbrowse.dll
NAME=Alexa Toolbar
URL=http://pages.alexa.com/prod_serv/quicktour_new.html
KEY=CLSID\{6AF9BC61-3CC5-42A7-82D1-FFC2562A7289}\InprocServer32
ITEM=
EXP=Alxie328.dll
NAME=InetSpeak/Iexplorr
URL=http://www.doxdesk.com/parasite/InetSpeak.html
KEY=CLSID\{6B12DABB-0B7C-44FA-B0B3-4BAFF3790256}\InprocServer32
ITEM=
EXP=Iexplorr24.dll
NAME=Winshow/Searchv.com hijacker
URL=http://www.doxdesk.com/parasite/Winshow.html
KEY=CLSID\{6CC1C918-AE8B-4373-A5B4-28BA1851E39A}\InprocServer32
ITEM=
EXP=winshow.dll
NAME=CoolWebSearch parasite variant
URL=http://www.richardthelionhearted.com/~merijn/cwschronicles.html#
KEY=CLSID\{6CC1C91A-AE8B-4373-A5B4-28BA1851E39A}\InprocServer32
ITEM=
EXP=winlink.dll
NAME=SafeguardProtect/Veevo
URL=http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453082734
KEY=CLSID\{6CDF3C49-20E6-48d7-811B-9F5DD17F1D90}\InprocServer32
ITEM=
EXP=sfg****.dll
NAME=Comet Cursor
URL=http://www.castlecops.com/tk364-brbho_dll.html
KEY=CLSID\{6D0AC7F7-B628-4581-A8B2-14D97F24AA76}\InprocServer32
ITEM=
EXP=brbho.dll
NAME=BrowserAid/ABCSearch
URL=http://www.doxdesk.com/parasite/CashToolbar.html
KEY=CLSID\{6D55490C-1BD4-4790-BA31-84D261316E28}\InprocServer32
ITEM=
EXP=Highlighthelper.dll
NAME=suspected keyword hijacker
URL=http://computercops.biz/postlite89308-.html
KEY=CLSID\{6D9F42B8-B7E5-4BB9-9A13-CAE53D44196E}\InprocServer32
ITEM=
EXP=searcher.dll
NAME=SafeguardProtect/Veevo
URL=http://www.ca.com/us/securityadvisor/pest/pest.aspx?id=453082734
KEY=CLSID\{6E1C5E3D-A8E6-4a92-820F-BFCFE45BA158}\InprocServer32
ITEM=
EXP=veev
NAME=SafeguardProtect/Veevo
URL=http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453082734
KEY=CLSID\{6E34D984-4054-45E3-8452-0159A2F0D232}\InprocServer32
ITEM=
EXP=Veevo.dll
NAME=FriendGreetings E-Card foistware
URL=http://vil.nai.com/vil/content/v_99760.htm
KEY=CLSID\{7011471D-3F74-498E-88E1-C0491200312D}\InprocServer32
ITEM=
EXP=Otglove.dll
NAME=Xupiter Orbitexplorer
URL=http://www.doxdesk.com/parasite/Xupiter.html
KEY=CLSID\{702AD576-FDDB-4d0f-9811-A43252064684}\InprocServer32
ITEM=
EXP=Toolbar.dll
NAME=TV Media/CleverIEHooker
URL=http://www.ca.com/us/securityadvisor/pest/pest.aspx?id=453077508
KEY=CLSID\{707E6F76-9FFB-4920-A976-EA101271BC25}\InprocServer32
ITEM=
EXP=Jeired.dll
NAME=HDTbar
URL=http://www.spynet.com/spyware/spyware-HDTBar.aspx
KEY=CLSID\{70B3DA2C-E02D-4ce0-B1F8-48320FD443D2}\InprocServer32
ITEM=
EXP=T2BHO.dll
NAME=CoolWebSearch parasite variant
URL=http://www.richardthelionhearted.com/~merijn/cwschronicles.html#
KEY=CLSID\{710089CF-87C3-763F-C8F6-5A0DBFD3AEC3}\InprocServer32
ITEM=
EXP=Multiple file names
NAME=321search.com search hijacker
URL=
KEY=CLSID\{7148369a-1105-4e85-83e0-085e784ba374}\InprocServer32
ITEM=
EXP=SearchAssistant.dll
NAME=Blazefind IESearchbar
URL=http://www.kephyr.com/spywarescanner/library/iesearchbar/index.phtml
KEY=CLSID\{71ED4FBA-4024-4bbe-91DC-9704C93F453E}\InprocServer32
ITEM=
EXP=Iesearchbar.dll
NAME=NeoToolbar
URL=http://doxdesk.com/parasite/NeoToolbar.html
KEY=CLSID\{722E8B26-1C44-460F-88BB-50C82B20E30E}\InprocServer32
ITEM=
EXP=msqsb.dll
NAME=LoveTester foistware
URL=http://spamwatch.codefish.net.au/modules.php?op=modload&name=News&file=index&catid=&topic=24
KEY=CLSID\{72557F9F-13AE-44C9-B3D7-5091B599027C}\InprocServer32
ITEM=
EXP=smail11.dll
NAME=ZeroPopupBar
URL=http://www.doxdesk.com/parasite/ZeroPopUp.html
KEY=CLSID\{