Can TDS detect the Berbew Trojan ?

Discussion in 'Trojan Defence Suite' started by godzillex, Jun 27, 2004.

Thread Status:
Not open for further replies.
  1. godzillex

    godzillex Registered Member

    Joined:
    May 28, 2004
    Posts:
    57
    Hi,

    1. Can TDS detect the Berbew Trojan ?
    2. If so, since when?

    Also, is there a list showing the names of the trojans that TDS can currently defend against? Is it updated daily ? If so, please provide the link.

    Thanks.
     
  2. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Open TDS3 - Help -Primary list - search for "webber"

    HTH Pilli
     
  3. godzillex

    godzillex Registered Member

    Joined:
    May 28, 2004
    Posts:
    57
    Hi Pilli,

    Thanks. I would have not guessed that one! Why is the Berbew called Webber ? Is there a list somewhere where I can see this info?

    R/
    godzillex
     
    Last edited: Jun 28, 2004
  4. Wayne - DiamondCS

    Wayne - DiamondCS Security Expert

    Joined:
    Jul 19, 2002
    Posts:
    1,533
    Location:
    Perth, Oz
    Yes we have two variants of the Russian "Berbew/Webber" trojan and to my knowledge TDS3 is the only anti-trojan scanner that actually detects any of them at this stage, but its name is an interesting one (and a poorly chosen one IMHO) -- the string "Berbew" doesn't actually exist, not in ASCII or Unicode, not even in the unpacked/decrypted version. The first variant we obtained was back in early November 2003, but another variant was received today, and analysis of this new variant will continue through the night here in Perth (it's currently 12:30am as I type) as there's a fair amount of code to get through, and consequently we'll probably release two database updates tomorrow - one in the morning with extended Berbew detection (including mutex, memory object detection, etc etc, just to provide additional detection to what's there already), followed by the standard daily update later in the afternoon.

    Anyway, back to work. :)
     
    Last edited: Jun 28, 2004
Thread Status:
Not open for further replies.