[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[ossec-list] Re: Windows 2003 64-bit false positive note

To: ossec-list@xxxxxxxxxxxxxxxx
Subject: [ossec-list] Re: Windows 2003 64-bit false positive note
From: "Dave Lowe" <seclistinbox@xxxxxxxxx>
Date: Wed, 15 Aug 2007 10:42:31 +1100
Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:references; b=FmfYz5rmTCjEMrEPuzBE7Vdtialxv4V5QPaSC32Etoo91oQ0E5Q6CjAARTF9jrN+qicD0Hfy/2/sqalhIBUJTv0KGY4MbzGBfDGV4ytJ4EEYUv/mOB8eQSFI2oiaYjkJMFcuuzWHpk/UerpShk+PbgGYTqaJQREROXmPOdzDYmk=

Thanks for the report Peter.
I have added this in the bug tracker.

Dave

On 8/15/07, Peter M. Abraham < peter.m.abraham@xxxxxxxxx> wrote:

Greetings:

"Windows Malware: Possible Malware - Svchost running outside
system32."

For a future version, please take into account 64-bit Windows also
uses C:\WINDOWS\SysWOW64 as well as C:\WINDOWS\system32

Thank you.

References:
- [ossec-list] Windows 2003 64-bit false positive note
  - From: Peter M. Abraham

Prev by Date: [ossec-list] Windows 2003 64-bit false positive note
Next by Date: [ossec-list] Re: POP3 brute force rule not firing
Previous by thread: [ossec-list] Windows 2003 64-bit false positive note
Next by thread: [ossec-list] Ossec and BigBrother
Index(es):
- Date
- Thread

OSSEC home | Main Index | Thread Index

OSSEC project: www.ossec.net.
Mailling list information: http://www.ossec.net/en/mailing_lists.html.