Cris Vol 1 Issue 04

eZine lover (@eZine)

Published in 

Cris

 · 5 years ago

  

-----BEGIN PGP SIGNED MESSAGE----- 

Written By:                        
Michael Paris (Cris) 

                        
                       Cris Signatures 
               How To Add Them To Your Scanner 

Cris will be servicing you with the latest Anti-Virus Signatures. 
As we get these new viruses in, we will be testing and extracting 
signatures that you will be able to add to your Anti-Virus scanner. 
This is providing you are using a good scanner that will allow you 
to add these. In this Document we will explain how it is done and 
what scanners we are aware of that allow you to update it as you go 
along. 

In the following Crisnews reports that come out, we will include 
the signatures that will be importable into F-prot, and A ready 
made file for importing into TBSCAN. 

Our studies show that the TBSCAN is the better all around scanner. 
If you are a virus collector or researcher, you are better off 
using both F-Prot and TBAV. F-Prot is better for the Caro names, 
where as the TBSCAN has more options, and is better for finding the 
new viruses that usually do not scan. 

Note: This is as of date (no telling what might happen). 

These new signatures will be posted in the Fido virus conference 
and in the crisnet. You will be able to screen capture them or 
write then down and add them manually to your scanner. Each update 
will have a PGP signature. If there is no PGP signature, it is not 
a Cris virus signature update. 

                        HOW THIS WORKS 

First The problem, F-prot only allows you to add 10 virus 
signatures. we plan on releasing more then ten unscannable strings, 
unless F-prot opens this channel and allows for more user definable 
strings, we suggest the use of TBSCAN for this purpose. It is true 
that the TBSCAN will show more false positives (detect viruses that 
are not there) but we feel this is safe. It is better to be safe 
then sorry. 

Note: The comment that TBSCAN shows more false positives is when it is in  
Heuristics mode. Heuristics looks at the contents inside of the file 
and analyses the code, in this mode the signatures are secondary.  
Using heuristics TBSCAN can find more viruses and trojans then other 
scanners. But there is always that program that has code in it that looks 
like it could do dammage, and TBAV will warn you of this. 

 
                   ADDING SIGNATURES TO F-PROTECT 

 
To add a string to F-prot just go to the directory where f-prot.exe 
is and type f-prot {enter} 

1. The menu appears, choose "Viruses" 
2. Choose "New Signatures" 
3. Choose "Add New Signature" 
4. Type in Virus Name 
5. Type "Y" if the virus infects .COM files 
6. Type "Y" if the virus infects .EXE files 
7. Type "Y" if the virus infects the boot sector 
8. Type in the string. (or paste it in from a screen capture. 

 
Now make sure when you scan using F-prot to use the switch /USER 
if you do not type /USER F-prot will not scan for the strings you 
added. 

In other words when you scan, type:  f-prot c: /user {enter} 

This is all there is to it. but remember, at this time you can only 
have 10 signatures at a time. 

                 ADDING SIGNATURES TO TBAV 

To add signatures to TBAV, all you need to do is make A simple 
ASCII text file. You will name this file USERSIG.DAT 

To make this text file you will use a regular dos editor. The file 
you make should have no blank lines, if you want to make a space 
between each virus you will put a ; in where the space is. 

Each virus will consist of three lines. The first line will be the 
description of the virus or virus name. The second line will be 
what the virus does, if it infects .COM files type COM INF if it 
infects .COM and .EXE files type COM EXE INF on the line. The third 
line is the virus string that you find in the PGP signed message. 

This is what your file should look like when you are done with it. 
(ALSO look at the USERSIG.DAT file in this crisnews for excample) 

;begin of file 
; 
Golgi_Testicles_1 
COM INF 
5D81ED03011E06B80342CD213D03 
; 
Golgi_Testicles_2 
COM EXE INF 
5D81ED0301061EB83D3DCD213D3D 
; 
Golgi_Testicles_3 
COM EXE INF 
5D81ED0301B83D4DCD213D3D0074 
; 
;End of file 

After making this file, copy it into the same directory where TBAV 
is, and type TBGENSIG {enter} 

Now you have added the new viruses to TBSCAN. 

If you are experienced in extracting virus strings, or have access 
to new viruses and want to help, give us a call. 

Michael Paris (Cris) 
1:115/863 (708) 863-5285 

 
-----BEGIN PGP SIGNATURE----- 
Version: 2.3a 

iQBVAgUBLNc4EKM4CDusTF+9AQHh+AH+KF6Q0gewWhZXT9HBBkpYmgGPgD6uG349 
5IjLY9LdKGqWqDZ3EchSQ6fwzLdH6keEHgMiWHX5aRZ6m4JI052nYQ== 
=k5AD 
-----END PGP SIGNATURE-----