The bleeding snort guy's have already done the work for you.
http://www.bleedingsnort.com/bleeding-virus.rules
DISCLAIMER: The ClamAV preproc is not meant to be a replacement for
Mail Gateway AV scanners. We are looking at fragments of files, not
the whole thing. In which case we are unable to look inside the
contents of zip files etc.
Regards,
Will
On 5/25/05, Siddhartha Jain <sid@netmagicsolutions.com> wrote:
Hi,
I am trying to write a signature for the mytob virus. I have the ClamAV
signature for the virus but clam extracts the .exe from the .zip file
and then does a match so the clam signature seems useless.
How do I identify the base64 string in the mytob zip file that uniquely
identifies the virus?
- Siddhartha
-------------------------------------------------------
SF.Net email is sponsored by: GoToMeeting - the easiest way to collaborate
online with coworkers and clients while avoiding the high cost of travel and
communications. There is no equipment to buy and you can meet as often as
you want. Try it free.http://ads.osdn.com/?ad_id=7402&alloc_id=16135&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------
SF.Net email is sponsored by: GoToMeeting - the easiest way to collaborate
online with coworkers and clients while avoiding the high cost of travel and
communications. There is no equipment to buy and you can meet as often as
you want. Try it free.http://ads.osdn.com/?ad_idt02&alloc_id135&opÌk
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list
