check out http://ddanchev.blogspot.com/2008/02/yet-another-massive-embedded-malware.html I'm sure a few sigs can come from the URLs listed.... -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080227/9ae1bc43/attachment.html