[Snort-sigs] Re: Virus/Worms signatures ruleset
bmc at ...95...
Fri Jun 18 06:03:03 EDT 2004
On Fri, Jun 18, 2004 at 10:03:16AM +0100, Mark wrote:
> I wonder would it be possible to change the text in virus.rules, from
> just saying that the rules are not maintained.
Uh, have you read virus.rules lately? For a while it has said:
# We don't care about virus rules anymore. BUT, you people won't stop asking
# us for virus rules. So... here ya go.
# There is now one rule that looks for any of the following attachment
# ade, adp, asd, asf, asx, bat, chm, cli, cmd, com, cpp, diz, dll, dot, emf,
# eml, exe, hlp, hsq, hta, ini, js, jse, lnk, mda, mdb, mde, mdw, msi, msp,
# nws, ocx, pif, pl, pm, pot, pps, ppt, reg, rtf, scr, shs, swf, sys, vb,
# vbe, vbs, vcf, vxd, wmd, wmf, wms, wmz, wpd, wpm, wps, wpz, wsc, wsf, wsh,
# xls, xlt, xlw
More information about the Snort-sigs