alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP W32/GameVance Adware Server Reponse To Client Checkin"; flow:established,to_client; content:"|0d 0a 0d 0a|cfgint="; content:"cid="; within:30; content:"eus="; within:30; content:"esint="; within:30; content:"sc2dcnt="; within:30; content:"domfqcap="; within:30; content:"domtm="; within:30; content:"css="; within:30; classtype:pup-activity; sid:2014605; rev:7; metadata:created_at 2012_04_17, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_08_14;)