ClamAV signatures for detecting eval’s in php code

ClamAV signatures for detecting eval’s in php code

March 19, 2013 11:41 am 0 comments

Trojan.evalStrip.A:0:*:6576616c287374726970736c617368657328
Trojan.asciiEval.A:0:*:5c7836355c7837365c7836315c783663
Trojan.evalStripPost.A:0:*:6576616c287374726970736c61736865732861727261795f706f70
Trojan.reqEvalFwrite.A:0:*:245f72657175657374??*6576616c28??*667772697465
Trojan.reqEvalPutfile.A:0:*:245f72657175657374??*6576616c28??*66696c655f7075745f636f6e74656e747328

put these in /var/lib/clamav/manual_clam.ndb (YMMV)

Leave a reply


%d bloggers like this: