[Emerging-Sigs] Warezov/Stration sigs

[Matt Jonkman]

The url for warezov changed a bit. The old sigs didn't catch the new form:

GET http://
cadesfinjeriokas.com/chr/1407/e/b?lid=A590474043D7B2FBB606&pt=1 	

GET http:// cadesfinjeriokas.com/chr/1407/e/t0000?lid=A590474043D7B2FBB606

The former ones had only a 3 digit number in the 1407 spot. Adjusted to
catch any size there. So if you see a rash of warezov's, don't panic.
They may have been there a few weeks.

Well, if you do have a lot of those you should panic, but not because
there's a huge wave or infections this morning. :)


Matt

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc