[Snort-sigs] Snort Community Rules Update

Sourcefire VRT research at ...435...
Wed Jan 25 14:00:02 EST 2006

This message is to announce the availability of an update for the 
Sourcefire community rule set, which can be downloaded free of cost or 
registration from http://www.snort.org/pub-bin/downloads.cgi.

The new rule in this release is identified as SID 100000226. This rule 
detects successful infections by the BlackWorm/Nyxem worm by watching 
for the reporting URL the virus accesses immediately after infection.

The new rule and its SID follows.

Alex Kirk
Community Rules Maintainer
Sourcefire, Inc.

100000226 || COMMUNITY VIRUS Possible BlackWorm or Nymex infected host

More information about the Snort-sigs mailing list