This repository has been archived by the owner on May 22, 2022. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 10
/
Crossrider.adf
84 lines (84 loc) · 4.04 KB
/
Crossrider.adf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
<AdwareDefinition>
<Version>95</Version>
<SavingThrowVersion>1.1.0</SavingThrowVersion>
<DefinitionAuthor>Owen Pragel</DefinitionAuthor>
<DefinitionSource>http://www.adwaremedic.com/signatures.xml</DefinitionSource>
<Comment>This is a work in progress, and as such, many lines are as of yet unconverted to ADF format.</Comment>
<Adware>
<AdwareName>Crossrider</AdwareName>
<!-- Unresolved Adware extensions
<item type="extContent">(buca ?apps)|(js\.newonlinedatastack\.com)|(newonlinedemoserv\.com)|(w9u6a2p6\.ssl\.hwcdn\.net)</item>
<item type="extContent"><string>[ ]*http://www\.my-search-start\.com/search/\?asset</item>
<item type="extName">(cinema(s?)[- \+]*(plus|\+)?[- \+]*(pro|hd)?)|(cinema(s?) ?pl[aeiou]+s)</item>
<item type="extName">(shopp?y ?mate)|(flashmall)|(palmall)|(shoo?pimac)</item> -->
<File>/Users/*/Library/Application Support/Google/Chrome/External Extensions/phpdijfdkggndfmgcfdhcimlflflnega.json</File>
<File>/Users/*/Library/LaunchAgents/Safari Security</File>
<TestedFile>
<Path>/Library</Path>
<FilenameRegex>(cinema(s?)[- \+]*(plus|\+)?[- \+]*(pro|hd)?)|(cinema(s?) ?pl[aeiou]+s)</FilenameRegex>
<Regex>com\.(cinema(s?)[- \+]*(plus|\+)?[- \+]*(pro|hd)?)|(cinema(s?) ?pl[aeiou]+s)\.Service</Regex>
</TestedFile>
<TestedFile>
<Path>/Users/*/Library/LaunchAgents</Path>
<FilenameRegex>flashmall</FilenameRegex>
<FilenameRegex>shopp?y.?mate</FilenameRegex>
<FilenameRegex>palmall</FilenameRegex>
</TestedFile>
<TestedFile>
<Path>/Users/*/Library/LaunchAgents</Path>
<Path>/Library/LaunchAgents</Path>
<Path>/Library/LaunchDaemons</Path>
<FilenameRegex>(cinema(s?)[- \+]*(plus|\+)?[- \+]*(pro|hd)?)|(cinema(s?) ?pl[aeiou]+s)</FilenameRegex>
</TestedFile>
<TestedFile>
<Path>/Users/*/Library/LaunchAgents</Path>
<FilenameRegex>com\.crossrider\.wss\d+\.agent\.plist</FilenameRegex>
</TestedFile>
<File>/Users/*/Library/LaunchAgents/WebSocketServerApp</File>
<File>/Users/*/Library/LaunchAgents/com.webhelper.plist</File>
<File>/Users/*/Library/LaunchAgents/com.webtools.update.agent.plist</File>
<File>/Users/*/Library/LaunchAgents/com.webtools.uninstaller.plist</File>
<TestedFile>
<Path>/Library/LaunchAgents</Path>
<FilenameRegex>com\.webhelper\..*\.plist</FilenameRegex>
<Regex>/Library/Application Support/webhelper</Regex>
</TestedFile>
<TestedFile>
<Path>/Library/LaunchAgents</Path>
<FilenameRegex>com\.webshopper\..*\.plist</FilenameRegex>
<Regex>/Library/Application Support/WebShopper</Regex>
</TestedFile>
<TestedFile>
<Path>/Users/*/Library/LaunchAgents</Path>
<FilenameRegex>com\.webtools\..*\.plist</FilenameRegex>
<Regex>/Library/Application Support/WebTools</Regex>
</TestedFile>
<File cruft="true">/Users/*/Library/Application Support/webHelperApp/</File>
<File cruft="true">/Users/*/Library/Application Support/webhelper/</File>
<File cruft="true">/Users/*/Library/Application Support/WebTools/</File>
<File cruft="true">/Users/*/Library/Application Support/WebShopper/</File>
<File cruft="true">/Users/*/Library/WebTools/</File>
<File cruft="true">/Users/*/Library/flashmall/</File>
<File>/Applications/WebTools.app</File>
<File>/Applications/WebShopper.app</File>
<File>/Users/*/Applications/flashmall.app</File>
<TestedFile>
<Path>/Applications</Path>
<Path>/Users/*/Applications</Path>
<FilenameRegex>cinema(s?)[- \+]*((plus)|(pro))[- \+0123456789]*</FilenameRegex>
</TestedFile>
<!-- This is just the Firefox profile. <File>/Users/*/Library/Application Support/Firefox/Profiles/*/user.js</File>-->
<File>/Users/*/Library/cinemapro1-2</File>
<File>/Users/*/Library/LaunchAgents/UpdateDownloader</File>
<TestedFile>
<Path>/Users/*/Library/LaunchAgents</Path>
<FilenameRegex>\.agent\.plist</FilenameRegex>
<Regex>UpdateDownloader</Regex>
</TestedFile>
<TestedFile>
<Path>/Users/*/Library/LaunchAgents</Path>
<FilenameRegex>com\.extensions\.updater[0123456789]*\.ver</FilenameRegex>
</TestedFile>
<File>/Users/*/Library/ScriptingAdditions/BrowserHelper.osax</File>
</Adware>
</AdwareDefinition>