How to Create Custom Signatures in Network Malware Cleaner · 2008. 7. 18. · Adding File Exist...

Continues development for the improvement of features of Network Malware Cleaner,

yield a more powerful version of EMCO Network Malware Cleaner that provides the

flexibility of creating custom signatures. This means that you can define your custom

scan criteria for searching a signature. Built-in Custom Signature builder makes signature

definitions fast and easy. You can specify a file name or a version of a file, search for

existence of a directory, registry key exist, registry value exist, registry values/data exist

or application installed in Add/Remove. You can also set different actions to be taken if a

selected signature is found on a machine.

This new feature is very useful in case when you need to remove a virus infection

manually. It could also be helpful when you need to remove some extra file or registry

settings or directories created by some Adware or some unknown tool.

You can add following items to your custom signatures:

• File Exists

• File Version Exist

• File MD5 Exist

• Directory Exist

• Registry Key Exist

• Registry Value Exist

• Registry Value/Data Exist

• Application Installed in Add/Remove

We will discuss each of above mentioned item in detail in the next sections.

Adding File Exist Option

To create a custom signature:

To create a custom signature in EMCO Network Malware Cleaner; perform the following

steps:

1. Select Add/Edit Custom Signatures menu item under Create Custom

Signatures menu.

2. Custom Signatures Database dialog box will appear on the screen.

3. Click the Add button to add the required option.

4. Each one of the above options is discussed in detail in next section.

Adding File Exist option

To add File Exist option:

To add File Exist option, perform the following steps:

1. Click Add button on the Custom Signatures Database, a popup menu will

appear on the screen.

2. Click File Exist menu item under add

3. File Exist Dialog box will appear on the screen.

4. Type in the name of your signature in the Name textbox.

5. Type in the path of the file in the Path to File.

6. Click Assign Action button.

7. Actions dialog box will appear on the screen.

8. Select the required action from the Actions drop down list.

9. The added action will appear on the Action Info.

10. To add, multiple actions select you actions that you want to add; one by one from

the dropdown list. Click Add button to add your actions.

11. Click Add button on the File Exist dialog box.

12. Your added signature will appear in the custom signatures list.

Adding File Version Exist option

To add File Version Exist option:

To add File Version Exists option, perform the following steps:



2. Click File Version Exist menu item under add

3. File Version Exist dialog box will appear on the screen.


4. Type in the location of the program in the Path to File textbox.

5. Type in the version of the program in the Version textbox.

6. Click Assign Actions button.


8. Select the required action from the Actions dropdown list.

9. Click the Add button to add your actions.

10. Click the Add button on the File Version Exist dialog box.


Adding File MD5 option

To add File MD5 Exist option:

To add File MD5 Exists option, perform the following steps:



2. Click File MD5 Exist menu item under add

3. File MD5 Exist dialog box will appear on the screen.


5. Type in the location of the file in the Path to File textbox.

6. Type in the MD5 value in the MD5 Value textbox.

7. To Fetch MD5 value from a file click Fetch MD5 button and select a file.

8. Click Assign Action button.

14. Click the Add button to add your actions.

15. Click the Add button on the File MD5 Exist dialog box.

Adding Directory Exist Option

To add Directory Exist option:

To add Directory Exist option, perform the following steps:



2. Click Directory Exist menu item under add

3. Directory Exist dialog box will appear on the screen.


5. Type in the location of the directory in the Path to the Directory textbox.


9. Click Add button to add your actions.

10. Click Add button on the Directory Exist dialog box.

Adding Registry Key Exist

To add Registry Key Exist option:

To add Registry Key Exist option, perform the following steps:



2. Click Registry Key Exist menu item under add

3. Registry Key Exist dialog box will appear on the screen.


5. Select the root registry key from the Root Key dropdown list.

6. Type in the registry key in the Registry Key textbox.

9. Select the required action for the Actions dropdown list.

10. Click Add button to add your action.

11. Click Add button on the Registry Key Exist dialog box.


Adding Registry Value Exist option

To Add Registry Value Exist option

To Add Registry Value Exist option, perform the following steps:



2. Click Registry Value Exist menu item under add

3. Registry Value Exist dialog box will appear on the screen.

4. Type in the name of your signature in Name textbox.

5. Select the root key from the Root Key dropdown list.

6. Type in your key in the Registry Key textbox.

7. Type in the value of the registry key in the Registry Value textbox.



10. Select the required action from the actions drop down list.

13. Click Add button on the Registry Value Exist dialog box.


Adding Registry Value/Data Exist Option

To add Registry Value/Data Exist

To add Registry Value/Data Exist, perform the following steps:



2. Click Registry Value/Data Exist menu item under add

3. Registry Value/Data Exist dialog box will appear on the screen.


5. Select the root key form the Rook Key dropdown list.

6. Type in the registry key in the Registry Key textbox.

7. Type in the registry value in the Registry Value textbox.

8. Type in the registry data in the Registry Data textbox.

11. Select the required action from the Actions drop down list.




14. Click Add button on the Registry Value/Data Exist dialog box.

Adding Application installed in Add/Remove Option

To add Application installed in Add/Remove:

To add Application installed in Add Remove, perform the following steps:



2. Click Application installed in Add/Remove menu item under add

3. Application Add/Remove dialog box will appear on the screen.


5. Type in the name of your application in the Application Name textbox.

6. Type in the application version in the Application Version textbox.

17. Select the required action from the actions drop down list.




20. Click Add button on the Applications in Add/Remove dialog box.

How to Create Custom Signatures in Network Malware Cleaner · 2008. 7. 18. · Adding File Exist...

Documents

Transcript of How to Create Custom Signatures in Network Malware Cleaner · 2008. 7. 18. · Adding File Exist...