[Snort-sigs] More on RxBot and IRC traffic

Chris Harrington charrington at ...1244...
Sat Jan 22 12:08:04 EST 2005


> James Riden <j.riden at ...1766...> writes:
> 
> 
> Duh; the LURHQ ones are already included in bleeding-virus.rules. 
> 
> -- 


It's hard to keep track, there are so many bot variants

Rbot, rxbot, urxbot, spybot, phatbot, agobaot, forbot, sbot, sdbot, Sky2k4, 
Nesebot........

So many script kiddies modding the source code to these, and some that are 
not kiddies as well.

--Chris






More information about the Snort-sigs mailing list