Slashdot Mirror
A Searchable Virus Database?
PktLoss asks: "I recently got hit with a worm/trojan, it was my own fault, I got sloppy. Anyways, once I got hit with the virus it was time to get rid of it. It had infected my system while my A/V program was running, so I presumed it was rather new. I already knew a bunch about it: it was a Messenger Worm; it killed regedit, msconfig or taskmanager upon being run; and it turned off viewing hidden/system files, in Explorer. This information in hand, I thought I would have an easy time figuring out what it was, and hopefully locating a dedicated cleaner, I was wrong. In my mind I envision a page with an advanced search allowing you to give it the information you have (attack vector/type, symptoms, etc) one at a time, each new piece of information cutting down the list of possibilities. Does such a page exist? If not why not?"
"Instead of an easy search, I started off Googling in the dark, dropping key words in the hope they would point me in the right direction. When that failed I moved to the websites of major anti-virus vendors, either continuing to search based on key words I felt were relevant, or just listing viruses in reverse chronological order and reading their summaries.
No dice.
For the curious, I think it was Chode-e. I cleaned it manually."
No dice.
For the curious, I think it was Chode-e. I cleaned it manually."
Because that's the single most precious asset the anti-virus makers have!!! There's no way they're going to give that away! And it doesn't seem like a huge priority for a volunteer effort as the sort of people capable of and interested in doing that work don't often get viruses.
What I'm listening to now on Pandora...
MS and the companies profiting from malware (Anti-virus companies, etc) taught people into the "I recently got hit with a worm/trojan, it was my own fault, I got sloppy." mindset. But in reality, this shouldn't be and isn't like that.
True, a user needs education to use a computer intelligently, but it is largely up to the given software platform's coders to fix issues like that.
Don't assume you were at fault, just because you need to jump through hoops to prevent your computer from getting infected.
It takes a man to suffer ignorance and smile
Be yourself no matter what they say
why should av-companies help you out of the mess you got yourself into?
http://support.microsoft.com/
You should check out F-Secure , they have a very good, searchable database with descriptions of various viruses, worms, and spyware.
clamav
you can pull the DB apart and add your own entries
If it's killing off regedit then it is probably not a virus but a lame worm that has just added it'self into the registry to start at bootup.
Rebooting into safe mode, or with a Linux boot disk with Windows rescue tools installed, and you should be able to remove it from the registry.
http://www.symantec.com/avcenter/global/vinfodb.ht ml
This is the one I always have bookmarked. It seems to be the most comprehensive database on the Internet.
Pax Vobiscum
A couple people have been kind enough to post links to some of the major a/v vendor's pages. They're there, and they work, but they don't seem to give the results i'm looking for. Try using those search engines entering some of the information given in the original post. I would consider getting: Chode-d, Chode-e or Landis-B the 'right' answer. Can you get that answer out of it?
I think tabular data rather than wrapping google or standard full text searches would be great, but there doesn't seem to be such a beast out there.
paul reinheimer
Unless I misunderstood the question, besides the ones already pointed by some other folks, there's also http://vil.nai.com/vil/default.asp It even has a section dedicated to hoaxes, which I regularly use to educate my friends and family about those "Microsoft warned about this virus yesterday, anti-virus vendors don't know about it yet, pass this to all your contacts" e-mails.
There have been a number of stories that compared how fast the different A/V companies respond to a threat. I seem to recall that for really bothersome stuff, the updates are usually ready to go around 48-56 hours after they're picked up.
Having said that, it wouldn't hurt to install a free A/V scanner such as ClamAV, AVG or even something like Trend Micro's free online scanner.
Moreover, one of the key issues is that some companies are not picking up on some of the malware, which makes the occasional install of a free product worthwhile, in addition to an AdAware/Spybot/foo scan.
-
I know in this case google didn't work out for you, but I can't say I've ever had to do more than the following:
1. Norton AV pops and says "Danger! Danger! Virus found! Something.Win32.A2; clean failed; quarantine (failed|successful)."
2. Then I google "Something.Win32.A2" and usually the first link is Symantec's page on that virus/worm.
3. Click that link. Read that page.
4. Either download the removal tool, which is on that page, or follow the manual removal directions they give.
Not sure about MSNM worms or even if something like Norton detects them. But I can't say I've ever had any viral/worm experience above and beyond the above in the last 5 years; and that is not as an individual running Windows, but as someone who does desktop support for a few labfulls of PCs at a university library and a bunch of staff machines and the same held true when I worked the Uni-wide helpdesk.
Good luck!
Working toward a usable PDA environment in the spirit of Newton OS: Dynapad
At my company, we've had at least two virus infections before definitions were released. We worked through symptoms and used stuff like HijackThis! and Process Explorer to find out what was going on, plus a few of the PS Tools to get rid of it and Bart's PE to clean-room the system to remove persistent files. It took our virus vendor a week to come up with definitions, but a few others had them earlier and we could use their online or free versions to clean the systems.
Generally, when we get a suspicious file, it goes to VirusTotal first. If any of the 20-or-so listed AV vendors have a definition for the virus, you can usually find some information about it (at least a name) and from there figure out how to clean it. If nobody has a definition, next stop is Norman Sandbox to figure out what the beastie does, at least from a high-level point of view. If nothing else, it will probably give you a mutex that you can create to block execution/further infection, and sometimes it even gives you a clue as to what the virus would be or if it's a variant of something else. I found that we had a new variant of W32/Sality based on its mutex, which was one version number incremented from the info available online.
If there are no hits after that, there are some more things you can try, but they're mostly shots in the dark. Unless you can un-UPX the file and do some serious reverse-engineering on your own, you probably have to wait for a definition or post your symptoms in a newsgroup or forum and hope someone can help.
One good thing about VirusTotal is that it submits your sample to AV vendors (if you give it permission) so they are alerted and can start to develop definitions. It's difficult to find contact info for some vendors, but McAfee, ClamAV, CA and others have places you can submit a sample, you would do well to try them all if you have non-sensitive information in an infected file.
One word: causality! Instead of trying to get rid of the consequence, try to avoid the cause, which is in this case the operating system.
Per Aspera Ad Astra.
We have a penalty for blatant ignorance. This results in a two year internet privilege suspension and an additional beating around the ears with an Internet for Total Fucking Dummies book. PLease step away from the keyboard and assume the position!
Symantec Antivirus Center
Computer Associates Virus Information Center"
McAfee Virus Library
Kaspersky Virus Encyclopedia
Panda Software Virus Encyclopedia
Sophos virus analyses
BitDefender Virus Encyclopedia
For those that will argue that these search engines do not behave as the article requested; it is simply a matter of searching for the right symptoms. If you accurately describe the behavior of the virus, all of these search engines give you the answer.
The fact of the matter is that the very best solution is simply to use a commercial antivirus solution. If you are infected with a 0hour virus, simply wait an hour and run the update utility. Such a product will at least see the virus and tell you its name, even if it is unable to clean it. Worst case you have to use a bootable CD-ROM OS to catch/clean it.
C:\>attrib -r -a -s -h C:\*.* /s
And there's plenty of Registry Editors out there besides RegEdit.exe (even RegEdt32.exe ships with Windoze so you can modify Registry ACL's).
A few years ago, before I had any idea what I was doing, I got this annoying virus that began a countdown to restart my computer every time I connected to the internet or went to Microsoft's website. I can't remember what it was called but apparently it caused some havoc. When I found out how easy it was to stop, I was so embarrassed. That was the first day I found out that Windows XP has a built in "firewall" that could be activated. Later that month Microsoft released an update that activated the "firewall". Thanks for the foresight, Microsoft!
Anyway, with that being said, a searchable database would not be used by the average computer user. It may help those of us who know what we're doing but I think we're in the minority. It surely wouldn't have helped me back then.