[***] Results from Oinkmaster started Mon Sep 19 20:00:16 2005 [***]
[+++] Added rules: [+++]
2002372 - BLEEDING-EDGE VIRUS Bagle.CJ SMTP Outbound (bleeding-virus.rules)
2002373 - BLEEDING-EDGE VIRUS Bagle.CJ SMTP Inbound (bleeding-virus.rules)
2002374 - Bleeding Edge Bagle.CS (.DK or other Bagle Alias) - Outbound
(bleeding-virus.rules)
2002375 - Bleeding Edge Bagle.CS (.DK or other Bagle Alias) - Inbound
(bleeding-virus.rules)
[///] Modified active rules: [///]
2001065 - BLEEDING-EDGE VIRUS Possible Bagle.AQ Worm Outbound
(bleeding-virus.rules)
2001234 - BLEEDING-EDGE Win32/Small.AR outbound activity (bleeding-virus.rules)
2001546 - BLEEDING-EDGE WEB-MISC LINK Method (bleeding-web.rules)
2001751 - BLEEDING-EDGE Nullsoft Shoutcast Server Format String Attack
(bleeding-exploit.rules)
2002192 - BLEEDING-EDGE POLICY MSN status change (bleeding-policy.rules)
2002365 - BLEEDING-EDGE WEB HP OpenView Network Node Manager Remote Command
Execution Attempt (bleeding-web.rules)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-sid-msg.map (4):
2002372 || BLEEDING-EDGE VIRUS Bagle.CJ SMTP Outbound ||
url,isc.sans.org/diary.php?date=2005-09-19
2002373 || BLEEDING-EDGE VIRUS Bagle.CJ SMTP Inbound ||
url,isc.sans.org/diary.php?date=2005-09-19
2002374 || Bleeding Edge Bagle.CS (.DK or other Bagle Alias) - Outbound
2002375 || Bleeding Edge Bagle.CS (.DK or other Bagle Alias) - Inbound
-> Added to bleeding-virus.rules (2):
# Submitted by Mark Tombaugh, 2005-09-15, for Bagle.CJ
# Submitted by Mark Scott 9/19/2005 Bagle.cs, .dk or variants
-> Added to bleeding-web.rules (1):
#Requires port 3443 to be included in http_inspect ports
-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
