CodeStoreDB - Revision history

CCRDude: /* Usage */ added var types

2008-02-22T16:09:33Z

Usage: added var types

← Older revision		Revision as of 16:09, 22 February 2008
Line 12:		Line 12:

	==Usage==		==Usage==
	CodeStoreDB:<~~part of url~~>[,advanced build parameters]		CodeStoreDB:<urlpart(string)>[,advanced build parameters]

	===Examples===		===Examples===

CCRDude: added info box

2008-02-22T13:41:17Z

added info box

← Older revision		Revision as of 13:41, 22 February 2008
Line 1:		Line 1:
	{{Outdated SBI\|RegyKey}}		{{SbiCmdInfo
	If the download of the spyware was done using ActiveX, information may be saved in the Code Store Database. This command identifies those database entries by the used URL.		\|SYNTAX = CodeStoreDB
			\|PENAME = SpybotSD.exe
			\|PEVERSION = 1.3 or later
			\|GROUP = Registry
			\|MINUPDATE = n/a
			\|ADVFILEPARAMS = no
			\|ADVREGPARAMS = no
			\|ADVBUILDPARAMS = yes (second)
			\|ADVSPECIALPARAMS = no
			}}{{Outdated SBI\|RegyKey}}If the download of the spyware was done using ActiveX, information may be saved in the Code Store Database. This command identifies those database entries by the used URL.

	==Usage==		==Usage==

CCRDude at 10:23, 18 February 2008

2008-02-18T10:23:26Z

← Older revision		Revision as of 10:23, 18 February 2008
Line 3:		Line 3:

	==Usage==		==Usage==
	CodeStoreDB:[part of url],<advanced build parameters>		CodeStoreDB:<part of url>[,advanced build parameters]

	===Examples===		===Examples===
Line 14:		Line 14:
	===Description===		===Description===
	If malware sites use random GUIDs to describe ActiveX components, this command would help you identify them using the URL they were downloaded from by specifying a substring of the URL.		If malware sites use random GUIDs to describe ActiveX components, this command would help you identify them using the URL they were downloaded from by specifying a substring of the URL.

			* The first and only parameter specifies a substring of the URL. After 1.5.2, [[AlgoPrefix\|Algo-Prefixes will be supported here as well]]. {{AlgoPrefix}}

	Using the [[RegyKey]] [[SBI Command]] along with the proper [[Advanced registry parameters\|advanced registry parameters]] would do the same, but also allow you to use [[AlgoPrefix\|Algo-Prefixes]] to have more control on how to identify the URL. This way is recommended to avoid ambiguous detections (most ''popular'' example would be that ''gator.com'' would also identify ''newsgator.com'', a [[False positive\|false positive]] that happened some years ago).		Using the [[RegyKey]] [[SBI Command]] along with the proper [[Advanced registry parameters\|advanced registry parameters]] would do the same, but also allow you to use [[AlgoPrefix\|Algo-Prefixes]] to have more control on how to identify the URL. This way is recommended to avoid ambiguous detections (most ''popular'' example would be that ''gator.com'' would also identify ''newsgator.com'', a [[False positive\|false positive]] that happened some years ago).

			Take special care when the installer includes newer version of system files, as some badly written DPFs do, since these files would get flagged as well.

			===Scan Results===
			* DPF registry entries that were identified.
			* The associated files mentioned in the registry key (under the ''\Contains\Files\'' subkey).

	==See also==		==See also==
	* [[Advanced build parameters]]		* [[Advanced build parameters]]
	* [[Advanced registry parameters]]		* [[Advanced registry parameters]]
			* [[AlgoPrefix]]

	===Similar commands===		===Similar commands===
Line 25:		Line 34:

	[[Category:SBI Commands]]		[[Category:SBI Commands]]
	[[Category:SBI Commands ~~(current)~~]]		[[Category:SBI Commands supporting AlgoPrefix]]

CCRDude: New page: {{Outdated SBI|RegyKey}} If the download of the spyware was done using ActiveX, information may be saved in the Code Store Database. This command identifies those database entries by the u...

2008-02-16T15:09:52Z

New page: {{Outdated SBI|RegyKey}} If the download of the spyware was done using ActiveX, information may be saved in the Code Store Database. This command identifies those database entries by the u...

New page

{{Outdated SBI|RegyKey}}
If the download of the spyware was done using ActiveX, information may be saved in the Code Store Database. This command identifies those database entries by the used URL.

==Usage==
CodeStoreDB:[part of url],<advanced build parameters>

===Examples===
CodeStoreDB:"download.spyware.com"

This search would identify the following entry in the Code Store Database:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Code Store Database\Distribution Units\{44332211-00AA-BBCC-DDEE-FF5566778899}\DownloadInformation]
"CODEBASE"="http://download.spyware.com/archive.cab"

===Description===
If malware sites use random GUIDs to describe ActiveX components, this command would help you identify them using the URL they were downloaded from by specifying a substring of the URL.

Using the [[RegyKey]] [[SBI Command]] along with the proper [[Advanced registry parameters|advanced registry parameters]] would do the same, but also allow you to use [[AlgoPrefix|Algo-Prefixes]] to have more control on how to identify the URL. This way is recommended to avoid ambiguous detections (most ''popular'' example would be that ''gator.com'' would also identify ''newsgator.com'', a [[False positive|false positive]] that happened some years ago).

==See also==
* [[Advanced build parameters]]
* [[Advanced registry parameters]]

===Similar commands===
* [[RegyKey]]

[[Category:SBI Commands]]
[[Category:SBI Commands (current)]]