W32.Novarg.A@mm worm Work!, but....

[Snortty <cwcwcwg () yahoo com>]

All, 

I did add this rule below to my virus.rules file last
week thanks to this Snor-Users suggesting, and
activated this rule from snort.conf file, It works
detecting some REAL infected machines.

alert tcp any any -> any any (msg: "W32.Novarg.A@mm
worm"; content: "represented in 7-bit ASCII"; nocase;
sid:1000569;)


But, later on, some alerts showing Severity level
MEDIUM, others showing LOW, by this SAME rule. Can
someone tell me WHY please?

Thanks a lot again. 

Snortlover. 

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free web site building tool. Try it!
http://webhosting.yahoo.com/ps/sb/


-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users