[Snort-sigs] MyParty

Mark Canter marcus at ...64...
Tue Jan 29 11:38:11 EST 2002

Ugh, dunno if anyones done this but atleast for the time being to block
inbounds.  Got tired of emails filling up the logs of this virus.

alert tcp any any -> any 25 (msg:"Virus - Possbile MyParty"; content:
"subject\: new photos from my party!"; nocase; reference:MCAFEE,99332;
classtype:misc-activity; rev:1; react:block;)

More information about the Snort-sigs mailing list