FirstTime>'2008-11-18' and SigID=0 and FileType!='Text' and FileType!='DLL-PE' and Comment!='Clean' and (Submitter='Symantec' or Submitter='Grisoft' or Submitter='inca' or Submitter='Arbor' or Submitter='SecureComputing' or Submitter='AhnLab')
FirstTime>'2008-11-11 2' and FirstTime<'2008-11-11 10:30' and FileType='EXE-PE' and SigID>'10000000' and FileSize>'20000' and FileSize<'500000' and Submitter!='chensl' and Kaspersky!='Trojan.Win32.Obfuscated.gen'
FirstTime>'2008-11-09' and SigID>'10000000' and FileType='EXE-PE' and FileSize>'30000' and FileSize<'100000' and Archive='' and (Pack='' or Pack like '%UPX' or Pack like '%UPack')
FirstTime>'2008-11-21' and SigID>10000000 and Kaspersky='' and Trendmicro='' and McAfee='' and Antivir='' and Symantec='' and Sophos='' and NOD32='' and Panda='' and Grisoft='' and BitDefender=''