[clamav-users] More info on Win.Trojan.Generic-9847134-0 please

[G.W. Haywood]

Hi there,

On Mon, 29 Mar 2021, Trung Hoang via clamav-users wrote:

> I am using ClamAV with Exim in Cpanel v94. Today, doing scanning found
> couple of email files infected with "Win.Trojan.Generic-9847134-0". I could
> not find any additional information on this malware anywhere. Please any one
> share me with more info of it.

$ time sigtool --datadir=/EXPORTS/clamav/databases --find-sigs 'Win.Trojan.Generic-9847134-0' | sigtool --decode-sigs
VIRUS NAME: Win.Trojan.Generic-9847134-0
TDB: Engine:51-255,Target:1
LOGICAL EXPRESSION: 0&1&2&3&4
  * SUBSIG ID 0
  +-> OFFSET: ANY
  +-> SIGMOD: NONE
  +-> DECODED SUBSIGNATURE:
Computer wins
  * SUBSIG ID 1
  +-> OFFSET: ANY
  +-> SIGMOD: NONE
  +-> DECODED SUBSIGNATURE:
Bgcedtxsf
  * SUBSIG ID 2
  +-> OFFSET: ANY
  +-> SIGMOD: NONE
  +-> DECODED SUBSIGNATURE:
Player Wins
  * SUBSIG ID 3
  +-> OFFSET: ANY
  +-> SIGMOD: NONE
  +-> DECODED SUBSIGNATURE:
Enter your choice:>
  * SUBSIG ID 4
  +-> OFFSET: ANY
  +-> SIGMOD: NONE
  +-> DECODED SUBSIGNATURE:
Your Turn :>

real    2m27.815s
user    0m10.970s
sys     0m9.467s

-- 

73,
Ged.