alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32/SmartTab PUP Install Activity 2"; flow:established,to_server; http.method; content:"GET"; nocase; http.uri; content:"/v"; depth:2; content:".asp"; pcre:"/\/v\d\/[^.]+\.asp$/i"; http.user_agent; content:"Mozilla/3.0 (compatible|3b 20|Indy Library)"; fast_pattern; bsize:38; reference:md5,84fcdf1cd6dc3ee71686835f9489752c; classtype:pup-activity; sid:2022694; rev:4; metadata:created_at 2016_04_01, confidence High, signature_severity Minor, updated_at 2020_08_31;)