alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Potential FakeAV? HTTP GET Check-IN (/check)"; flow:established,to_server; content:"GET /check HTTP/1."; nocase; content:!"|0d 0a|Referer\: "; nocase; content:"|0d 0a|User-Agent\: Microsoft Internet Explorer|0d 0a|"; nocase; classtype:trojan-activity; reference:url,www.threatexpert.com/report.aspx?md5=94e13e13c6da5e32bde00bc527475bd2; reference:url,www.malwaredomainlist.com/forums/index.php?topic=3190.420; reference:url,doc.emergingthreats.net/2010597; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Fake_AV; sid:2010597; rev:2;)

Added 2009-12-29 10:00:51 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Potential FakeAV? HTTP GET Check-IN (/check)"; flow:established,to_server; content:"GET /check HTTP/1."; nocase; content:!"|0d 0a|Referer\: "; nocase; content:"|0d 0a|User-Agent\: Microsoft Internet Explorer|0d 0a|"; nocase; classtype:trojan-activity; reference:url,www.threatexpert.com/report.aspx?md5=94e13e13c6da5e32bde00bc527475bd2; reference:url,www.malwaredomainlist.com/forums/index.php?topic=3190.420; reference:url,doc.emergingthreats.net/2010597; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Fake_AV; sid:2010597; rev:2;)

Added 2009-12-29 09:58:48 UTC