Snort mailing list archives
Re: writing virus signatures
From: Will Metcalf <william.metcalf () gmail com>
Date: Wed, 25 May 2005 09:53:33 -0500
The bleeding snort guy's have already done the work for you. http://www.bleedingsnort.com/bleeding-virus.rules DISCLAIMER: The ClamAV preproc is not meant to be a replacement for Mail Gateway AV scanners. We are looking at fragments of files, not the whole thing. In which case we are unable to look inside the contents of zip files etc. Regards, Will On 5/25/05, Siddhartha Jain <sid () netmagicsolutions com> wrote:
Hi, I am trying to write a signature for the mytob virus. I have the ClamAV signature for the virus but clam extracts the .exe from the .zip file and then does a match so the clam signature seems useless. How do I identify the base64 string in the mytob zip file that uniquely identifies the virus? - Siddhartha ------------------------------------------------------- SF.Net email is sponsored by: GoToMeeting - the easiest way to collaborate online with coworkers and clients while avoiding the high cost of travel and communications. There is no equipment to buy and you can meet as often as you want. Try it free.http://ads.osdn.com/?ad_id=7402&alloc_id=16135&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- SF.Net email is sponsored by: GoToMeeting - the easiest way to collaborate online with coworkers and clients while avoiding the high cost of travel and communications. There is no equipment to buy and you can meet as often as you want. Try it free.http://ads.osdn.com/?ad_idt02&alloc_id135&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- writing virus signatures Siddhartha Jain (May 25)
- Re: writing virus signatures Will Metcalf (May 25)
- Re: writing virus signatures Siddhartha Jain (May 25)
- Re: writing virus signatures Will Metcalf (May 25)
- Re: writing virus signatures Siddhartha Jain (May 25)
- Re: writing virus signatures Siddhartha Jain (May 25)
- Re: writing virus signatures Will Metcalf (May 25)