Re: scr Worm - false alarms

[Wolfgang Rohdewald <wr6 () uni de>]

On 03.02.2002 21:48, Frank Knobbe wrote:

> I guess simply adding a 'content: "filename=";' would be enough. Take a
> look at the other rules in virus.rules and you see how they are
> 'refined'.

Did so, thanks. Of course I should have found that out myself...

Wolfgang


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users