<?xml version="1.0" encoding="UTF-8"?>
<filters>
	<filterobj clsid="{22353029-A733-4FCC-8AC0-782DA33FA464}">
		<filter id="1" name="Nimda-email" comment="Detects POP and SMTP messages which contain readme.exe or readme.eml" color="32896">
			<rootnode clsid="{D0329C21-8B27-489F-84D7-C7B783634A6A}">
				<filternode inverted="0" comment="">
					<id data="{A090DCAD-ACA7-4734-9F1C-FA7DD153F501}"/>
				</filternode>
				<andnode clsid="{47D49D7C-8219-40D5-9E5D-8ADEAACC644D}">
					<filternode inverted="0" comment="">
						<patterntype data="0"/>
						<patterndata data="726561646D652E657865"/>
						<startoffset data="-1"/>
						<endoffset data="-1"/>
						<casesensitive data="0"/>
					</filternode>
					<ornode clsid="{47D49D7C-8219-40D5-9E5D-8ADEAACC644D}">
						<filternode inverted="0" comment="">
							<patterntype data="0"/>
							<patterndata data="726561646D652E656D6C"/>
							<startoffset data="-1"/>
							<endoffset data="-1"/>
							<casesensitive data="0"/>
						</filternode>
					</ornode>
				</andnode>
			</rootnode>
		</filter>
	</filterobj>
	<filterobj clsid="{22353029-A733-4FCC-8AC0-782DA33FA464}">
		<filter id="2" name="Nimda-web" comment="Detects HTTP GETs which contain root.exe or cmd.exe" color="168">
			<rootnode clsid="{D0329C21-8B27-489F-84D7-C7B783634A6A}">
				<filternode inverted="0" comment="">
					<id data="{E2E91781-238D-4DB6-85E2-142A1EB01A7A}"/>
				</filternode>
				<andnode clsid="{47D49D7C-8219-40D5-9E5D-8ADEAACC644D}">
					<filternode inverted="0" comment="">
						<patterntype data="0"/>
						<patterndata data="636D642E657865"/>
						<startoffset data="-1"/>
						<endoffset data="-1"/>
						<casesensitive data="0"/>
					</filternode>
					<ornode clsid="{47D49D7C-8219-40D5-9E5D-8ADEAACC644D}">
						<filternode inverted="0" comment="">
							<patterntype data="0"/>
							<patterndata data="726F6F742E657865"/>
							<startoffset data="-1"/>
							<endoffset data="-1"/>
							<casesensitive data="0"/>
						</filternode>
					</ornode>
				</andnode>
			</rootnode>
		</filter>
	</filterobj>
</filters>
