[Snort-sigs] Lovegate Signature

larosa, vjay larosa_vjay at ...375...
Wed Aug 20 06:05:08 EDT 2003


Here you go,

alert tcp any any -> any 139 ( msg: "lovgate virus"; content:
"configserversmtp.163.com#ab89d at ...144..."; flow:to_serve
r,established; classtype:misc-activity;)

alert tcp any any -> any 445 ( msg: "lovgate virus"; content:
"configserversmtp.163.com#ab89d at ...144..."; flow:to_serve
r,established; classtype:misc-activity;)

alert tcp any any -> any 445 ( msg: "lovgate virus netservices.exe";
content: "s.y.s.t.e.m.3.2.\.N.e.t.S.e.r.v.i.c.e.s.
..e.x.e"; flow:to_server,established; classtype:misc-activity;)

alert tcp any any -> any 445 ( msg: "lovgate virus netservices.exe";
content: "s|00|y|00|s|00|t|00|e|00|m|00|3|00|2|00 5C
00|N|00|e|00|t|00|S|00|e|00|r|00|v|00|i|00|c|00|e|00|s|00|.|00|e|00|x|00|e";
flow:to_server,established; classtype:misc-activity;)

vjl

-----Original Message-----
From: mos def [mailto:mosdef_it at ...1544...] 
Sent: Wednesday, August 20, 2003 6:05 AM
To: snort-sigs at lists.sourceforge.net
Subject: [Snort-sigs] Lovegate Signature

Hi minds, 
I'm looking for the signature about virus "Lovegate"
and it's variant.
Can you help me?

Thx.

______________________________________________________________________
Yahoo! Mail: 6MB di spazio gratuito, 30MB per i tuoi allegati, l'antivirus,
il filtro Anti-spam
http://it.yahoo.com/mail_it/foot/?http://it.mail.yahoo.com/


-------------------------------------------------------
This SF.net email is sponsored by Dice.com.
Did you know that Dice has over 25,000 tech jobs available today? From
careers in IT to Engineering to Tech Sales, Dice has tech jobs from the
best hiring companies. http://www.dice.com/index.epl?rel_code=104
_______________________________________________
Snort-sigs mailing list
Snort-sigs at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs




More information about the Snort-sigs mailing list