In answer to 1:
It sounds like a configuration change. Did you just upgrade to 3.1 or did you also run sysconfig-sensor or IDM and change the configuration at all?
You need to check the destination file on your sensor. See if CSPM destination is configured for sev 1 or sev 3 alarms. You may want to set this to sev 1.
In answer to2:
The original Klez worm propogated through an email with a audio/x-wav attachment with the name Gn.Exe.
S13 included the 3117 signature to fire on this particular propogation method.
Refer to the NSDB:
http://www.cisco.com/cgi-bin/front.x/csec/getIDSInfo.pl?SIG_ID=3117&SIG_SUB_ID=0
The problem is that the worm can be easily changed to use different file names besides Gn.Exe. The signature will not detect these variations on the filename.
Trying to write signature for all of the possible variations could be impossible.
The best method is to use the good old Virus Scanner software which analyzes the file contents. It would be very difficult to build in this level of analysis into the network IDS system, especially when there already Virus Scanners doing exactly that.
If you have a particular filename variation in your network and want to write a custom signature then you can change the 3117 signature regex to match your paritcular variation.
The 3117 signature regex is: [cC][Oo][Nn][Tt][Ee][Nn][Tt][-][tT][Yy][Pp][Ee][:]
[ \t][Aa][Uu][Dd][Ii][Oo][/\\][Xx][-][Ww][Aa][Vv][;]
[ \t][Nn][Aa][Mm][Ee][=][\x22\x27]*[Gg][Nn][.][Ee][Xx][Ee]
NOTE: The above is wrapped to multiple lines, when putting in a custom signature put this all in one line.
