X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?a=blobdiff_plain;f=etc%2Frules%2Fsquid_rules.xml;h=d74ef2ebf11de9a3177a3b393530b79c9c46c19d;hb=3f728675941dc69d4e544d3a880a56240a6e394a;hp=491b1e01b9ff2f3b5b838a0da9f1f3deb4915be4;hpb=914feba5d54f979cd5d7e69c349c3d01f630042a;p=ossec-hids.git

diff --git a/etc/rules/squid_rules.xml b/etc/rules/squid_rules.xml
old mode 100755
new mode 100644
index 491b1e0..d74ef2e
--- a/etc/rules/squid_rules.xml
+++ b/etc/rules/squid_rules.xml
@@ -1,4 +1,5 @@
-<!-- @(#) $Id: squid_rules.xml,v 1.38 2009/06/24 17:06:19 dcid Exp $
+<!-- @(#) $Id: ./etc/rules/squid_rules.xml, 2011/09/08 dcid Exp $
+
   -  Official Squid rules for OSSEC.
   -
   -  Copyright (C) 2009 Trend Micro Inc.
@@ -6,7 +7,7 @@
   -
   -  This program is a free software; you can redistribute it
   -  and/or modify it under the terms of the GNU General Public
-  -  License (version 3) as published by the FSF - Free Software
+  -  License (version 2) as published by the FSF - Free Software
   -  Foundation.
   -
   -  License details: http://www.ossec.net/en/licensing.html
@@ -99,7 +100,8 @@
     <url>blst.php|xxx3.php|ngr7.php|ngr2.php|/nul.php$|/mul.php$|/444.php</url>
     <description>Attempt to access a Beagle worm (or variant) </description>
     <description>file.</description>
-    <info>http://www.symantec.com/avcenter/venc/data/w32.beagle.dp.html</info>
+    <info type="link">http://www.symantec.com/avcenter/venc/data/w32.beagle.dp.html</info>
+    <info type="text">W32.Beagle.DP is a Worm that drops Trojan.Lodear and opens a back door on the compromised computer.</info>
     <group>automatic_attack,</group>
   </rule>
   
@@ -165,7 +167,8 @@
     <if_matched_sid>35021</if_matched_sid>
     <same_source_ip />
     <description>Infected machine with W32.Beagle.DP.</description>
-    <info>http://www.symantec.com/avcenter/venc/data/w32.beagle.dp.html</info>
+    <info type="link">http://www.symantec.com/avcenter/venc/data/w32.beagle.dp.html</info>
+    <info type="text">W32.Beagle.DP is a Worm that drops Trojan.Lodear and opens a back door on the compromised computer.</info>
   </rule>
   
   <rule id="35055" level="10" frequency="$SQUID_FREQ" timeframe="90">