Signatures list

[Guest]

Hi,

I need to check the signature list of Windows Antispyware because it seems
to fail in detecting the spoolv.exe spyware on my computer.
Is there a link to that list?

Thank you.
Julien.

 

[Dave M]

Hi Julien;
There is no such list, however you might want to take a look at the CounterSpy
signatures of which MSAS signatures are a subset, in that Ms supplies the
signatures to Sunbelt for their use (and modification) in CounterSpy.
http://research.sunbelt-software.com/threat_library_search.cfm

 

[Bill Sanderson]

No such list is published, I'm afraid.

Please submit a Tools, suspected spyware report from your machine--and note
the presence of spoolv.exe.

I would recommend updating your antivirus software, and performing a full
scan of the machine in safe mode with both Microsoft Antispyware and your
updated antivirus app:

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SDBOT.ZG&VSect=T

Spoolv is likely a virus.

 

[Guest]

Thank you "Bill Sanderson" and "Dave M".

"Bill Sanderson" said :

Spoolv is likely a virus.

and "Dave M" said:

you might want to take a look at the CounterSpy
signatures of which MSAS signatures are a subset

Yes, it was a virus. My firewall stopped it. But I don't understand why it
has appeared at this time. I ran a Windows AntiSpyware just before installing
a freesoftware, and then this virus appear... After cleaning I tryed to
install the software again, and the virus does not appear again. If Windows
AntiSpyware could detect it, the freesoftware is implyed (perhaps random
installation). But if Windows AntiSpyware doesn't, that spyware was in my
computer for a long.
I'll have a look to CouterSpy signatures.
Thank you again.
Julien.

 

[Bill Sanderson]

If it is the virus at the link I provided, or another member of the same
family--these are trojans--they don't infect automatically--you must open an
email attachment.

There have been recent times when the number of variants of this family was
such that they were well ahead of at least some antivirus vendors--so it is
possible to have become infected before signatures were available to detect
the virus on your machine.

In this situation, updating your antivirus and doing a full scan of the
machine is necessary to be sure that you are not infected.

--

 

[Guest]

you must open an email attachment.

I was so affraid I destroyed it. But I know it was the virus because that
process has never needed to access to the internet, nor that day.
My Windows antispyware is up to date now, with the last version. I have also
ran an other famous online antivirus, and manually checked all the current
running processes.

you might want to take a look at the CounterSpy signatures

The family of that virus was in that list, so it doesn't help me.

Thank you very much.

 

[Bill Sanderson]

I'd strongly recommend that you run an antivirus app on your system. An
occasional online scan is useful to confirm things, but it is no substitute
for having antivirus in place on your system. Microsoft Antispyware is not
an antivirus.

There are some good trial offers available here:

http://www.microsoft.com/athome/security/protect/windows2000/antivirus.mspx

--