Malware Class IDs

[sidki3003]

<span style='color:blue'>Last list update: Mar 4, 2005.</span>

From the ReadMe:

Quote:Malware CLSIDs (toolbars, hijackers, dialers, etc) are an Internet Explorer
issue - unless you are using Mozilla's Active-X plugin.

These filters compare encountered IDs with a blocklist and block the code on
match.

The list is quite big already and new malware CLSIDs will come.
So there are two changes because of that:

Updating the list is "semi-automated".
There are two filters included for Tony Klein's BHO Collection:

http://www.sysinfo.org/bholist.txt

The first one enables filtering of above text/plain file.

The second one removes the duped CLSIDs and compares the "X" (certified
malware) and "O" (open to debate) entries with the blocklist.&nbsp; Missed items
will be printed in the proper list format so that you just need to navigate to
above link and copy/paste.&nbsp; Hits/matches/missed stats are printed at the
bottom, too.

The list is scanned rarely now, since the filters will fail early for the Flash
CLSID.&nbsp; This hardly has any influence on the filter speed (yet), but it gives
you the option to save some memory and Proxomitron startup time by adding
"NoHash" somewhere to the top comment.


The list is current as of March 4th, 2005 and contains 975 entries (62 KB).

The zip contains the merge file "MergeMe.cfg" and the Count list (ScoJo/Mona,
modified) which is required if you want to see the stats.


Installation:

Copy "Count.txt" and "ClassIDs.txt" to the "lists" subdirectory.
Copy the the dummy-script "empty" to the "html" subdirectory.
Merge "MergeMe.cfg" with your config.

This is the stand-alone version. Don't merge it with my config set!
ClassIDs.zip (offsite link, 31 KB)


sidki