Snort mailing list archives
Re: Simple problem with virus.rules line 16 (cvs)
From: Brian <bmc () snort org>
Date: Thu, 3 Jan 2002 11:17:02 -0500
According to Phil Wood:
patch is:
-alert tcp any 110 -> any any (msg:"Virus - Possible NAVIDAD Worm"; content: "NAVIDAD.EXE""; nocase; sid:722; classtype:misc-activity; rev:3;) +alert tcp any 110 -> any any (msg:"Virus - Possible NAVIDAD Worm"; content: "NAVIDAD.EXE"; nocase; sid:722; classtype:misc-activity; rev:3;)
ident virus.rules please. This was fixed in 1.12 at 2001/12/12 17:52:14. -- A complete lack of evidence is the surest sign that the conspiracy is working. _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Simple problem with virus.rules line 16 (cvs) Phil Wood (Jan 02)
- Re: Simple problem with virus.rules line 16 (cvs) Brian (Jan 03)
- Re: Simple problem with virus.rules line 16 (cvs) Phil Wood (Jan 03)
- Re: Simple problem with virus.rules line 16 (cvs) Brian (Jan 03)
- Re: Simple problem with virus.rules line 16 (cvs) Phil Wood (Jan 03)
- Re: Simple problem with virus.rules line 16 (cvs) Brian (Jan 03)