"""

===================================================================

FILE: flash_pref-malware_scan.py

DESCRIPTION: This script is used for listing and

submitting urls that have been created under the

flash player preferences folder while browsing

with Firefox.

The url list is submitted to VirusTotal.com

public API to check each of the urls if they are

known as a "Malware site"

against diffrent antivirus vendors.

You must have a virustotal.com

account and a public API key to use this program.

NOTES: Tested using Python 2.6.7 on OSX 10.7

2.6.5 on bt5 and 2.7.2 on XP

AUTHOR: Alejandro Laboy - alejandro[AT]vliot.com

UPDATED: 11/7/11

UPDATE: Now working on Xp, Lion and bt5

====================================================================

"""

USAGE EXAMPLE:

root@bt:# ./flash_pref-malware_scan.py -h

Usage: flash_pref-malware_scan.py

Options: -v verbose mode. Prints all the results from the diffrent AV vendors.

    -h      --help  This help message.

    -p  --path  Path to Flash Player (sys) folder

example path: /Flash_Player/macromedia.com/support/flashplayer/sys/

example path for mac: /Users/{username}/Library/Preferences/Macromedia/Flash Player/macromedia.com/support/flashplayer/sys/

example path for a mounted drive: /media/disk-1/Documents\ and\ Settings/Admin/Application\ Data/Macromedia/Flash\ Player/macromedia.com/support/flashplayer/sys/

root@bt:# ./flash_pref-malware_scan.py [] linux OS detected... [] Platform: linux2

[] Enumerating urls from path ... [] Getting detections from virusatotal.com API ...

[*] The url 38zu.cn IS flagged as a (Malware site)

[*] End of urls reached URLS scanned: 2

will now exit. root@bt:# ./flash_pref-malware_scan.py -v [] linux OS detected... [] Platform: linux2

[] Enumerating urls from path ... [] Getting detections from virusatotal.com API ...

[] Printing in verbose mode [] Printing list of found urls: ['#38zu.cn', '#s.ytimg.com'] [*] Scanning right now url: 38zu.cn

[!] Found Malware flags from the following vendors:

TrendMicro": "Malware site" Data": "Malware site" BitDefender": "Malware site" ThreatSeeker": "Malware site"

[*] End of urls reached URLS scanned: 2

will now exit.

test-box:$ python flash_pref-malware_scan.py -p ~/Library/Preferences/Macromedia/Flash\ Player/macromedia.com/support/flashplayer/sys/ [] Macintosh OS detected... [] Platform: darwin

[*] Getting detections from virusatotal.com API ...

[*] Url: mail.google.com is not flagged.

[*] Url: is not flagged.

[*] End of urls reached URLS scanned: 1

will now exit.