alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Win32.Virut - GET"; flow:established,to_server; content:"GET"; depth:3; http_method; content:"?n="; nocase; http_uri; content:"&lastid="; nocase; http_uri; content:"&Version"; nocase; http_uri; content:"&smartpic="; nocase; http_uri; content:"&rand="; nocase; http_uri; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fVirut; reference:url,www.avast.com/eng/win32-virut.html; reference:url,free.avg.com/66558; reference:url,www.threatexpert.com/threats/virus-win32-virut-ce.html; reference:url,doc.emergingthreats.net/2009808; classtype:trojan-activity; sid:2009808; rev:5;)

Added 2011-10-12 19:28:18 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Win32.Virut - GET"; flow:established,to_server; content:"GET"; depth:3; http_method; content:"?n="; nocase; http_uri; content:"&lastid="; nocase; http_uri; content:"&Version"; nocase; http_uri; content:"&smartpic="; nocase; http_uri; content:"&rand="; nocase; http_uri; classtype:trojan-activity; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fVirut; reference:url,www.avast.com/eng/win32-virut.html; reference:url,free.avg.com/66558; reference:url,www.threatexpert.com/threats/virus-win32-virut-ce.html; reference:url,doc.emergingthreats.net/2009808; sid:2009808; rev:5;)

Added 2011-09-14 22:41:36 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Win32.Virut - GET"; flow:established,to_server; content:"GET"; depth:3; http_method; content:"?n="; nocase; http_uri; content:"&lastid="; nocase; http_uri; content:"&Version"; nocase; http_uri; content:"&smartpic="; nocase; http_uri; content:"&rand="; nocase; http_uri; classtype:trojan-activity; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fVirut; reference:url,www.avast.com/eng/win32-virut.html; reference:url,free.avg.com/66558; reference:url,www.threatexpert.com/threats/virus-win32-virut-ce.html; reference:url,doc.emergingthreats.net/2009808; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Virut; sid:2009808; rev:5;)

Added 2011-02-04 17:29:12 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Win32.Virut - GET"; flow:established,to_server; content:"GET "; depth:4; uricontent:"?n="; nocase; uricontent:"&lastid="; nocase; uricontent:"&Version"; nocase; uricontent:"&smartpic="; nocase; uricontent:"&rand="; nocase; classtype:trojan-activity; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fVirut; reference:url,www.avast.com/eng/win32-virut.html; reference:url,free.avg.com/66558; reference:url,www.threatexpert.com/threats/virus-win32-virut-ce.html; reference:url,doc.emergingthreats.net/2009808; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Virut; sid:2009808; rev:2;)

Added 2009-08-31 16:38:43 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Win32.Virut - GET"; flow:established,to_server; content:"GET "; depth:4; uricontent:"?n="; nocase; uricontent:"&lastid="; nocase; uricontent:"&Version"; nocase; uricontent:"&smartpic="; nocase; uricontent:"&rand="; nocase; classtype:trojan-activity; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fVirut; reference:url,www.avast.com/eng/win32-virut.html; reference:url,free.avg.com/66558; reference:url,www.threatexpert.com/threats/virus-win32-virut-ce.html; reference:url,doc.emergingthreats.net/2009808; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Virut; sid:2009808; rev:2;)

Added 2009-08-31 16:38:43 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Win32.Virut - GET"; flow:established,to_server; content:"GET "; depth:4; uricontent:"?n="; nocase; uricontent:"&lastid="; nocase; uricontent:"&Version"; nocase; uricontent:"&smartpic="; nocase; uricontent:"&rand="; nocase; classtype:trojan-activity; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fVirut; reference:url,www.avast.com/eng/win32-virut.html; reference:url,free.avg.com/66558; reference:url,www.threatexpert.com/threats/virus-win32-virut-ce.html; sid:2009808; rev:1;)

Added 2009-08-28 10:24:51 UTC


Topic revision: r1 - 2011-10-12 - TWikiGuest
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats