[Snort-sigs] worm_sobig.c?

Magnus Larsson magnus.larsson at ...1524...
Mon Jun 2 05:51:06 EDT 2003

Can anyone help me to write a rule for the virus worm_sobig.c?

It can be found with help of this:

From: (any of the identified recipient addresses)
Subject: (any of the following) 
• Re: Screensaver 
• Re: Movie 
• Re: Submited (004756-3463) 
• Re: 45443-343556 
• Re: Approved 
• Approved 
• Re: Your application 
• Re: Application
Message Body: Please see the attached file. 
Attachment: (any of the following) 
• screensaver.scr 
• movie.pif 
• submited.pif 
• 45443.pif 
• documents.pif 
• approved.pif 
• application.pif 
• document.pif 

I hope someone can help me out.

Best Regards,


More information about the Snort-sigs mailing list