[Snort-users] About virus.rules

Michael Sconzo msconzo at ...5072...
Mon May 17 14:55:01 EDT 2004

> No, actually... it's because you're worthless... hehe  ;)

My worst fear has come true *cry*. :)

> So basically, remove virus.rules or trim it to only to those that also
> spread through the network (hybrids), but create and maintain a
> worm.rules file.

Similiar to what we do around here at TAMU for the 40+ snort boxes
we have out in the wild.  I figued it would be a benefit to most
people (especially .edu's) that are trying to be good 'net neighbors
to everybody else, due to the nature of our user base.  

I try to monitor the snort-sigs list and a few other places to try
and keep up with worm rules, due to problems they cause around here.
Figured it might be a good way to help give back...but oh well.

I still wouldn't mind doing it offically or unoffically ... 


The New Testament offers the basis for modern computer coding theory,
in the form of an affirmation of the binary number system.
        But let your communication be Yea, yea; nay, nay: for
        whatsoever is more than these cometh of evil.
                -- Matthew 5:37

More information about the Snort-users mailing list