[Snort-sigs] Re: Virus/Worms signatures ruleset

Brian bmc at ...95...
Fri Jun 18 06:03:03 EDT 2004


On Fri, Jun 18, 2004 at 10:03:16AM +0100, Mark wrote:
> I wonder would it be possible to change the text in virus.rules, from
> just saying that the rules are not maintained. 

Uh, have you read virus.rules lately?  For a while it has said:

# We don't care about virus rules anymore.  BUT, you people won't stop asking
# us for virus rules.  So... here ya go.
#
# There is now one rule that looks for any of the following attachment
# types:
#
#   ade, adp, asd, asf, asx, bat, chm, cli, cmd, com, cpp, diz, dll, dot, emf,
#   eml, exe, hlp, hsq, hta, ini, js, jse, lnk, mda, mdb, mde, mdw, msi, msp,
#   nws, ocx, pif, pl, pm, pot, pps, ppt, reg, rtf, scr, shs, swf, sys, vb,
#   vbe, vbs, vcf, vxd, wmd, wmf, wms, wmz, wpd, wpm, wps, wpz, wsc, wsf, wsh,
#   xls, xlt, xlw
#

Brian




More information about the Snort-sigs mailing list