/******************************* */
/* Rule Set Based Access Control */
/* Author and (c) 1999: Amon Ott */
/* MS decision module:           */
/*  Malware scan strings         */
/* Last modified: 08/Feb/99      */
/******************************* */

#ifndef __RSBAC_MS_STRINGS_H
#define __RSBAC_MS_STRINGS_H

/* Scanner level, increase for every increase in detected malware */
#define MS_LEVEL 4
#define RSBAC_MS_MAX_STR_LEN 52
#define RSBAC_MS_CHUNK_SIZE (8192 - RSBAC_MS_MAX_STR_LEN)
#define RSBAC_MS_NR_STRINGS 2
/* if NR_MALWARE is changed, adjust IPC default aci in aci_data_structures.h! */
#define RSBAC_MS_NR_MALWARE 7

#define BLISS_SIGS 9
#define RSBAC_MS_BLISS_SIG_STRS { \
      "/tmp/.bliss", \
      "infected by bliss", \
      "already infected", \
      "skipping, infected with same vers or different type", \
      "replacing older version", \
      "new size: %d", \
      "infecting: %s,", \
      "infect() returning success", \
      "been to %s already!"}

struct ms_malware_entry_t {
      char name[RSBAC_MS_MAX_STR_LEN];
      char string[RSBAC_MS_NR_STRINGS][RSBAC_MS_MAX_STR_LEN];
  };

typedef struct ms_malware_entry_t rsbac_ms_all_malware_t[RSBAC_MS_NR_MALWARE];

#define RSBAC_MS_ALL_STRINGS { \
     {"Bliss.A", \
      {"infected by bliss", \
       "replacing ourselves with newer version" \
      } \
     }, \
     {"Bliss.B", \
      {"infected by bliss", \
       "newer vers, replacing self (size %d)" \
      } \
     }, \
     {"VHP-648", \
      {"PATH=DANGER!.COM.EM.COM", \
       "DANGER!.COM" \
      } \
     }, \
     {"Israeli", \
      {"sUMsDos", \
       "Hello, world!$" \
      } \
     }, \
     {"Eddie2", \
      {"!_^ZY[X", \
       "Eddie lives" \
      } \
     }, \
     {"Dark Avenger", \
      {"somewhere in time!", \
       "city of Sofia (C) 1988-89 Dark Avenger" \
      } \
     }, \
     {"1704C", \
      {"hjhnzji", \
       "ib6tjTp" \
      } \
     } \
  }
#endif
