SoundrelSimulator

06/27/06 Posted by geswall

SoundrelSimulator is a simulator of certain virus activities, such as changing browser homepage, adding auto-start application and etc.

GeSWall successfully prevented all attack probes by redirecting registry access and denying files creation in a startup folder. An attack notification message is displayed on detected malicious activity.

Log records:
scoundrelsimula REDIRECT access to HKU\...\ProgramsTab (Registry)
scoundrelsimula REDIRECT access to HKLM\...\Internet Explorer\Control Panel\ContentTab (Registry)
scoundrelsimula REDIRECT access to HKLM\...\Internet Explorer\Control Panel\GeneralTab (Registry)
scoundrelsimula REDIRECT access to HKU\...\DisableRegistryTools (Registry)
scoundrelsimula DENY access to C:\Documents and Settings\...\Start Menu\Programs\Startup\Scoundrel Simulator.lnk (File)

Link: http://www.geeksuperhero.com/scoundrelsim.shtml

Posted in GeSWall's Security Tests