[Snort-sigs] GDI Sig

Added this quickie to bleedingsnort.com. Should catch the login to an 
ftp server if you have an unpatched user that views the first infected 
jpeg that's out:

alert tcp any any -> any any (msg:"BLEEDING-EDGE GDI Exploit - Worm 1 
Successful Execution"; content:"USER bawz"; nocase; content:"PASS 
pagdba"; nocase; reference:url,www.easynews.com/virus.txt; 
classtype:trojan-activity; sid:2001332; rev:1;)


We'll drop this rule in a few hours or a day or so, depending on how 
long the repository of the malware stays reachable.

Available at www.bleedingsnort.com.

Matt


-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs