[***] Results from Oinkmaster started Wed Nov 23 20:00:09 2005 [***]
[+++] Added rules: [+++]
2002683 - BLEEDING-EDGE WEB shell bot perl code download (bleeding-virus.rules)
2002688 - BLEEDING-EDGE VIRUS Bagle.EO or EP Inbound (bleeding-virus.rules)
2002689 - BLEEDING-EDGE VIRUS Bagle.EO or EP Outbound (bleeding-virus.rules)
2002690 - BLEEDING-EDGE VIRUS Bagle.ES or ET Inbound (bleeding-virus.rules)
2002691 - BLEEDING-EDGE VIRUS Bagle.ES or ET Outbound (bleeding-virus.rules)
[///] Modified active rules: [///]
2002686 - BLEEDING-EDGE VIRUS Sober.AA (.Z,.AG,.X,.Y,.W) worm SMTP Outbound
(bleeding-virus.rules)
[///] Modified inactive rules: [///]
2002687 - BLEEDING-EDGE VIRUS Sober.AA (.Z,.AG,.X,.Y,.W) worm SMTP Inbound
(bleeding-virus.rules)
[---] Removed rules: [---]
200283 - BLEEDING-EDGE WEB shell bot perl code download (bleeding-virus.rules)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-sid-msg.map (7):
2002683 || BLEEDING-EDGE WEB shell bot perl code download
2002686 || BLEEDING-EDGE VIRUS Sober.AA (.Z,.AG,.X,.Y,.W) worm SMTP
Outbound || url,www.norman.com/Virus/Virus_descriptions/25962 ||
url,cme.mitre.org/data/list.html#681
2002687 || BLEEDING-EDGE VIRUS Sober.AA (.Z,.AG,.X,.Y,.W) worm SMTP
Inbound || url,www.norman.com/Virus/Virus_descriptions/25962 ||
url,cme.mitre.org/data/list.html#681
2002688 || BLEEDING-EDGE VIRUS Bagle.EO or EP Inbound ||
url,www.f-secure.com/v-descs/bagle_ep.shtml ||
url,www.f-secure.com/v-descs/bagle_eo.shtml
2002689 || BLEEDING-EDGE VIRUS Bagle.EO or EP Outbound ||
url,www.f-secure.com/v-descs/bagle_ep.shtml ||
url,www.f-secure.com/v-descs/bagle_eo.shtml
2002690 || BLEEDING-EDGE VIRUS Bagle.ES or ET Inbound ||
url,www.f-secure.com/v-descs/bagle_es.shtml ||
url,www.f-secure.com/v-descs/bagle_et.shtml
2002691 || BLEEDING-EDGE VIRUS Bagle.ES or ET Outbound ||
url,www.f-secure.com/v-descs/bagle_es.shtml ||
url,www.f-secure.com/v-descs/bagle_et.shtml
-> Added to bleeding-virus.rules (2):
# Submitted by Mark Scott, 2005-11-21, for Sober.AA worm
(.Z,.AG,.X,.Y,.W)
#by Mark Tombaugh, the Virus King
[---] Removed non-rule lines: [---]
-> Removed from bleeding-sid-msg.map (3):
200283 || BLEEDING-EDGE WEB shell bot perl code download
2002686 || BLEEDING-EDGE VIRUS Sober.AA worm SMTP Outbound ||
url,www.norman.com/Virus/Virus_descriptions/25962/en-us ||
url,secunia.com/search/?search=sober.aa
2002687 || BLEEDING-EDGE VIRUS Sober.AA worm SMTP Inbound ||
url,www.norman.com/Virus/Virus_descriptions/25962/en-us ||
url,secunia.com/search/?search=sober.aa
-> Removed from bleeding-virus.rules (1):
# Submitted by Mark Scott, 2005-11-21, for Sober.AA worm
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
