Re: [Snort-users] Black/Nyxem

If anyone wants to see what real Black/Nyxem traffic looks like check 
out the pcaps at:

http://www.snort.org/rules/docs/vrt/nymex/blackworm_analysis.html

This is from our lab when we fired it up.

Additionally the VRT would be interested in any reports of actual 
infection, cause so far even our sales guys haven't been hit ;)

Cheers,
Matthew Watchinski
Director, Vulnerability Research
Sourcefire, Inc.

Frank Knobbe wrote:
> On Thu, 2006-01-26 at 12:04 -0600, Ron Jenkins wrote:
>
> > On the below rule, does anyone show the payload as:
>
>
> > GET /cgi-bin/Count.cgi?df=765247 HTTP/1.1..Accept: */*..Referer:
> > http://www.snort.org/rules/advisories/vrt-rules-2006-01-25.html. 
>
>
> The virus doesn't send a Referer request header, so this is a false
> positive. Use the BleedingSnort rule 2002788 instead. We specifically
> exclude the Referer.
>
> Regards,
> Frank



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users