alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN MS_D0wnl0ad3r Checkin"; flow:to_server,established; content:"GET"; http_method; content:".php?hwid="; http_uri; content:"Gecko/20070725 Firefox/2.0.0.6"; http_user_agent; content:"en-gb|5c|Accept"; http_header; http_header_names; content:!"Referer"; classtype:trojan-activity; sid:10003676; rev:1;)