[Esa-l] Re: Swen worm: sanitizer local rule

[John D. Hardin]

On Thu, 25 Sep 2003, Sergey Latkin wrote:

> does not catch about 5% (3 misses of 80 so far), but it's better
> than nothing.

I've added some refinements that should trap most of the ones Sergey's
original rule missed, and added it to the recommended local rules.

Comments solicited.

Interesting observation: one that didn't get identified had
"cumulative patch 2094" and "copyright microsoft 2094" in it... :) :)


--
 John Hardin KA7OHZ    ICQ#15735746    http://www.impsec.org/~jhardin/
 jhardin at impsec.org                        pgpk -a jhardin at impsec.org
 key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
  "...people who like assault weapons they should join the United
  States Army, we have them."
                              -- Gen. Wesley Clark, candidate, on CNN

  "Germans who wish to use firearms should join the SS or the SA -
  ordinary citizens don't need guns, as their having guns doesn't
  serve the State."
                              -- Heinrich Himmler
-----------------------------------------------------------------------
   38 days until Matrix Revolutions