alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP CoolWebSearch Spyware (Feat)"; flow:to_server,established; http.user_agent; content:"Feat"; nocase; depth:4; pcre:"/^Feat[^\r\n]+(?:Install|Updat)er/i"; reference:url,www.spywareguide.com/product_show.php?id=599; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453075759; reference:url,www.doxdesk.com/parasite/CoolWebSearch.html; classtype:pup-activity; sid:2002160; rev:21; metadata:created_at 2010_07_30, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_10_17;)