alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Virut Family GET"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/lgate.php?n="; pcre:"/^[0-9A-F]{12,24}/Ri"; reference:url,www.f-secure.com/v-descs/virus_w32_virut.shtml; classtype:trojan-activity; sid:2009444; rev:7; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2020_04_29;)