Re: Rule for Sobig

[Erek Adams <erek () snort org>]

On Fri, 29 Aug 2003, Timm Schneider wrote:

> i got an Mailserver(official) behind my Iptables+Snort FW.
>
> I would like to filter the Sobig Worm on my Snort.
> How should i do that?
> Where i can find any rule for that?
> I become in an hour about 50 Mails with sobig on my
> Mailserver.

How?  By using the right tool for the job.  And here's a hint:  It's not
Snort.

Use a virus filter on your mailserver.  That should take care of you.
Just google on '"sobig.f filter" mailserver' (no single quotes on the
search line) and you should find tons of hits.

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users