[Snort-users] scr Worm - false alarms

Wolfgang Rohdewald wr6 at ...4412...
Mon Feb 4 03:29:06 EST 2002

On 03.02.2002 21:48, Frank Knobbe wrote:

> I guess simply adding a 'content: "filename=";' would be enough. Take a
> look at the other rules in virus.rules and you see how they are
> 'refined'.

Did so, thanks. Of course I should have found that out myself...


More information about the Snort-users mailing list