[Snort-sigs] Evaman Worm Outbound BLEEDINGSNORT

James Ashton James at ...2424...
Mon Jul 5 21:45:02 EDT 2004



alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg: BLEEDING-EDGE VIRUS
Possible Evaman Worm Outbound"; pcre:
"m/(body|message|email|returned|text|docum
ent)\.(scr|txt\.scr|html\.scr|outlook\.scrtxt\.exe)/";
reference:url,secunia.com/virus_information/10429/evaman; sid:2000343;
rev:1;)

Has just been added to the bleedingsnort.com sig base.

Thanks to msconzo at ...1371... for the submition.




More information about the Snort-sigs mailing list