[Snort-users] Elkern Worm

Lorraine Cannavale LCannavale at ...8048...
Tue May 27 11:07:05 EDT 2003

I just sent an e-mail to the snort-sigs list seeking a rule or ruleset to
detect the Elkern worm (if anyone in this group has the rule, your response
is welcome).

But, I would really like some tips and advice on controlling the Elkern worm
on our network.  We have antivirus software installed on each workstation,
and it should be configured to obtain the latest virus definitions daily.
However, we do not have an accurate way (today) of determining if
workstations do in fact have the latest AV signatures, nor do we have a way
of determining what workstations may be infected with viruses.  Our shared
folders on servers keep getting re-infected with the Elkern virus.

Any help and suggestions would be appreciated.
Thank you in advance,


More information about the Snort-users mailing list