alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP V-Clean.com Fake AV Checkin"; flow:established,to_server; http.uri; content:"/bill_mod/bill_count.php?C_FLAG="; fast_pattern; http.user_agent; content:"Mozilla/4.0 (compatible|3b| MSIE 5.5|3b| Windows 98)"; startswith; classtype:pup-activity; sid:2008180; rev:8; metadata:created_at 2010_07_30, signature_severity Minor, updated_at 2024_03_02;)