# DNS conficker rules by Jack Pepper ( pepperjack@autoshun.org )
# regenerated periodically from the domains file at F-secure.com
# The URL for the f-secure site:  http://www.f-secure.com/weblog/archives/Downadup_Domain_Blocklist_February.txt
# The source URL for this   http://www.autoshun.org/downloads/conficker.rules
#
#
# Thu, 23 Jul 2009 08:04:58 -0500 
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aaadokfn.net"; content:"|08|aaadokfn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127091; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aadogtgywq.net"; content:"|0a|aadogtgywq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127092; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aaeouvcifn.cc"; content:"|0a|aaeouvcifn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127093; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aagofl.net"; content:"|06|aagofl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127094; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aagvz.net"; content:"|05|aagvz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127095; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aaklpluc.cc"; content:"|08|aaklpluc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127096; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aamkeraqwo.biz"; content:"|0a|aamkeraqwo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127097; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aaqcxvmpasm.net"; content:"|0b|aaqcxvmpasm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127098; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aaqzxqrwba.cn"; content:"|0a|aaqzxqrwba|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127099; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aauarayugo.org"; content:"|0a|aauarayugo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127100; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain abfhhibxci.cn"; content:"|0a|abfhhibxci|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127101; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain abgxadya.ws"; content:"|08|abgxadya|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127102; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain abhpxnxial.cc"; content:"|0a|abhpxnxial|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127103; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain abktvhxbmi.ws"; content:"|0a|abktvhxbmi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127104; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain abmgdht.com"; content:"|07|abmgdht|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127105; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain abnmvpa.org"; content:"|07|abnmvpa|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127106; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain abrhbln.org"; content:"|07|abrhbln|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127107; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain absizef.ws"; content:"|07|absizef|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127108; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain abvbiija.cc"; content:"|08|abvbiija|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127109; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain abvkeehxte.ws"; content:"|0a|abvkeehxte|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127110; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain abxakpu.cc"; content:"|07|abxakpu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127111; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aceljhpb.info"; content:"|08|aceljhpb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127112; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain acghygqi.cc"; content:"|08|acghygqi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127113; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain acgmebtwmmp.info"; content:"|0b|acgmebtwmmp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127114; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain acgxplen.com"; content:"|08|acgxplen|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127115; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain achrhv.cn"; content:"|06|achrhv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127116; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aclsflfvww.com"; content:"|0a|aclsflfvww|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127117; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain acmaaefk.cn"; content:"|08|acmaaefk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127118; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain acxnegug.org"; content:"|08|acxnegug|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127119; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain adboov.net"; content:"|06|adboov|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127120; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain adfjrlia.cc"; content:"|08|adfjrlia|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127121; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain adstkxadce.net"; content:"|0a|adstkxadce|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127122; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aebiwyiq.ws"; content:"|08|aebiwyiq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127123; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aebskftjgol.biz"; content:"|0b|aebskftjgol|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127124; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aeczbt.biz"; content:"|06|aeczbt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127125; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aefkbyksr.info"; content:"|09|aefkbyksr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127126; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aehrbb.net"; content:"|06|aehrbb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127127; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aejxfzsj.biz"; content:"|08|aejxfzsj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127128; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aeljwatpmat.ws"; content:"|0b|aeljwatpmat|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127129; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aeqow.cc"; content:"|05|aeqow|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127130; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aerfyhlbugi.biz"; content:"|0b|aerfyhlbugi|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127131; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aerialtldgd.ws"; content:"|0b|aerialtldgd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127132; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aeuufbtnh.com"; content:"|09|aeuufbtnh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127133; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aezlxgcx.cc"; content:"|08|aezlxgcx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127134; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain afalcxxud.cc"; content:"|09|afalcxxud|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127135; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain afgdwhnjk.cc"; content:"|09|afgdwhnjk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127136; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain afkzdxuo.org"; content:"|08|afkzdxuo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127137; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aflentvnvhe.cc"; content:"|0b|aflentvnvhe|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127138; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain afmxfrfg.cc"; content:"|08|afmxfrfg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127139; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain afslgeikq.org"; content:"|09|afslgeikq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127140; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain afxbtzjp.biz"; content:"|08|afxbtzjp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127141; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain agbbtcvhf.cc"; content:"|09|agbbtcvhf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127142; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain agbhqpqz.cn"; content:"|08|agbhqpqz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127143; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain agbwulvj.biz"; content:"|08|agbwulvj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127144; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain agfwrxilb.ws"; content:"|09|agfwrxilb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127145; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain agiqwzci.cn"; content:"|08|agiqwzci|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127146; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain agkva.org"; content:"|05|agkva|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127147; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aglfaxfw.ws"; content:"|08|aglfaxfw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127148; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain agowquk.ws"; content:"|07|agowquk|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127149; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain agoyaarjlln.cc"; content:"|0b|agoyaarjlln|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127150; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain agqwxyrnrz.org"; content:"|0a|agqwxyrnrz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127151; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain agsalfvavu.info"; content:"|0a|agsalfvavu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127152; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain agtlri.info"; content:"|06|agtlri|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127153; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain agycocmq.biz"; content:"|08|agycocmq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127154; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain agyierylu.net"; content:"|09|agyierylu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127155; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain agyzryd.cn"; content:"|07|agyzryd|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127156; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain agzcepomb.net"; content:"|09|agzcepomb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127157; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ahavzz.ws"; content:"|06|ahavzz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127158; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ahawjyscjw.net"; content:"|0a|ahawjyscjw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127159; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ahbxkicgou.net"; content:"|0a|ahbxkicgou|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127160; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ahdys.cc"; content:"|05|ahdys|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127161; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ahlxicrj.net"; content:"|08|ahlxicrj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127162; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ahmluldaxhd.info"; content:"|0b|ahmluldaxhd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127163; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ahsudvdedr.cn"; content:"|0a|ahsudvdedr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127164; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ahyrykdwjru.org"; content:"|0b|ahyrykdwjru|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127165; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ahztf.org"; content:"|05|ahztf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127166; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aiafmzva.org"; content:"|08|aiafmzva|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127167; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aiaywa.biz"; content:"|06|aiaywa|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127168; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aibhevfxtbq.net"; content:"|0b|aibhevfxtbq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127169; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aiczfzc.info"; content:"|07|aiczfzc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127170; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aidktvn.cc"; content:"|07|aidktvn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127171; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aifyuecaio.org"; content:"|0a|aifyuecaio|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127172; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aigcvzwp.cn"; content:"|08|aigcvzwp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127173; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aiguaeiiyn.net"; content:"|0a|aiguaeiiyn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127174; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aiidiucwj.biz"; content:"|09|aiidiucwj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127175; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aikdgy.org"; content:"|06|aikdgy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127176; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aimmuemd.cn"; content:"|08|aimmuemd|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127177; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ainronbzggr.ws"; content:"|0b|ainronbzggr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127178; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aiojcnip.net"; content:"|08|aiojcnip|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127179; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aipcauis.cn"; content:"|08|aipcauis|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127180; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aivkwy.cc"; content:"|06|aivkwy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127181; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aivqfzqrrdn.org"; content:"|0b|aivqfzqrrdn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127182; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aiwqogpp.biz"; content:"|08|aiwqogpp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127183; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aixduqmxb.com"; content:"|09|aixduqmxb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127184; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ajblt.cn"; content:"|05|ajblt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127185; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ajepenkux.ws"; content:"|09|ajepenkux|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127186; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ajeyelrbl.org"; content:"|09|ajeyelrbl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127187; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ajngp.cc"; content:"|05|ajngp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127188; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ajrqk.cc"; content:"|05|ajrqk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127189; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ajrtspspa.cn"; content:"|09|ajrtspspa|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127190; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ajusevkoxk.info"; content:"|0a|ajusevkoxk|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127191; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ajviqwmmr.biz"; content:"|09|ajviqwmmr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127192; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ajxjkfrj.org"; content:"|08|ajxjkfrj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127193; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ajxjyfbivbt.com"; content:"|0b|ajxjyfbivbt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127194; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ajyjsqc.com"; content:"|07|ajyjsqc|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127195; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ajztp.cc"; content:"|05|ajztp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127196; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain akadolx.com"; content:"|07|akadolx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127197; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain akdmccfs.org"; content:"|08|akdmccfs|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127198; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain akhjs.net"; content:"|05|akhjs|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127199; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain akkbnmghmgp.info"; content:"|0b|akkbnmghmgp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127200; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain akkqaxj.com"; content:"|07|akkqaxj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127201; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aklidfpe.ws"; content:"|08|aklidfpe|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127202; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain akqyndyik.ws"; content:"|09|akqyndyik|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127203; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain akugzhcjvi.info"; content:"|0a|akugzhcjvi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127204; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain akxzthho.cc"; content:"|08|akxzthho|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127205; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain akzxbye.info"; content:"|07|akzxbye|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127206; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain albfcrrxbc.net"; content:"|0a|albfcrrxbc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127207; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain albjcqgaiu.ws"; content:"|0a|albjcqgaiu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127208; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain alcflfkkcx.org"; content:"|0a|alcflfkkcx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127209; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain alcjficn.ws"; content:"|08|alcjficn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127210; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain alhdqermly.org"; content:"|0a|alhdqermly|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127211; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain alhtkmz.info"; content:"|07|alhtkmz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127212; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain alizpvlr.ws"; content:"|08|alizpvlr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127213; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aljluexo.net"; content:"|08|aljluexo|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127214; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain allheamn.biz"; content:"|08|allheamn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127215; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain alsmqnfryj.cc"; content:"|0a|alsmqnfryj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127216; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain alvfmtyl.net"; content:"|08|alvfmtyl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127217; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain alvjftba.info"; content:"|08|alvjftba|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127218; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain alxwa.biz"; content:"|05|alxwa|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127219; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain amehmkfu.cn"; content:"|08|amehmkfu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127220; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain amibfgw.net"; content:"|07|amibfgw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127221; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain amjucvfiokz.biz"; content:"|0b|amjucvfiokz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127222; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ampbgjsfvy.biz"; content:"|0a|ampbgjsfvy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127223; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain amqbqnvi.cn"; content:"|08|amqbqnvi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127224; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain amtzlrqexos.cn"; content:"|0b|amtzlrqexos|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127225; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain anhxtjewx.cn"; content:"|09|anhxtjewx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127226; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain anmcwrztn.biz"; content:"|09|anmcwrztn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127227; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain annqmrrqt.ws"; content:"|09|annqmrrqt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127228; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain anqkide.cn"; content:"|07|anqkide|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127229; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain antbgzkfc.org"; content:"|09|antbgzkfc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127230; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain anvdqm.cn"; content:"|06|anvdqm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127231; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain anwekildcr.cc"; content:"|0a|anwekildcr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127232; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain anxsmjpu.ws"; content:"|08|anxsmjpu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127233; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain anylzraford.cc"; content:"|0b|anylzraford|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127234; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain anzqeamakcm.org"; content:"|0b|anzqeamakcm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127235; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aobsamla.cn"; content:"|08|aobsamla|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127236; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aoemgmz.info"; content:"|07|aoemgmz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127237; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aoeteumgbam.cc"; content:"|0b|aoeteumgbam|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127238; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aoghxomlrd.info"; content:"|0a|aoghxomlrd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127239; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aooqrgc.info"; content:"|07|aooqrgc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127240; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aopmjpzmyh.cc"; content:"|0a|aopmjpzmyh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127241; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aoysuint.cc"; content:"|08|aoysuint|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127242; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain apaldiyo.ws"; content:"|08|apaldiyo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127243; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain apbrfihicqx.org"; content:"|0b|apbrfihicqx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127244; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain apctjvvflgm.cn"; content:"|0b|apctjvvflgm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127245; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain apeezqhw.cn"; content:"|08|apeezqhw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127246; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain apgtko.cc"; content:"|06|apgtko|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127247; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aprcn.biz"; content:"|05|aprcn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127248; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aprhlfybx.cn"; content:"|09|aprhlfybx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127249; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain apycc.info"; content:"|05|apycc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127250; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain apyyay.info"; content:"|06|apyyay|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127251; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain apzpcgrd.biz"; content:"|08|apzpcgrd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127252; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aqdozwedpoa.com"; content:"|0b|aqdozwedpoa|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127253; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aqffqxw.info"; content:"|07|aqffqxw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127254; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aqgccokv.cn"; content:"|08|aqgccokv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127255; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aqgwvklz.net"; content:"|08|aqgwvklz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127256; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aqlpxsjbi.org"; content:"|09|aqlpxsjbi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127257; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aqpuocfxei.cc"; content:"|0a|aqpuocfxei|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127258; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aqshyoourn.com"; content:"|0a|aqshyoourn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127259; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aqswtwmb.com"; content:"|08|aqswtwmb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127260; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aqxns.net"; content:"|05|aqxns|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127261; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain argbezcy.cc"; content:"|08|argbezcy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127262; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain arijiquhmai.ws"; content:"|0b|arijiquhmai|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127263; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain arinvwzila.com"; content:"|0a|arinvwzila|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127264; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain arlzzjfacbn.info"; content:"|0b|arlzzjfacbn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127265; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain arnqdil.cc"; content:"|07|arnqdil|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127266; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain arqmhc.cc"; content:"|06|arqmhc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127267; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain arsgplnlt.net"; content:"|09|arsgplnlt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127268; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain arvdr.org"; content:"|05|arvdr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127269; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aryeayxz.biz"; content:"|08|aryeayxz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127270; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ascud.cc"; content:"|05|ascud|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127271; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain asghlvkij.com"; content:"|09|asghlvkij|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127272; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain asjrnzkvnr.ws"; content:"|0a|asjrnzkvnr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127273; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain asjvcd.biz"; content:"|06|asjvcd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127274; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain asndw.net"; content:"|05|asndw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127275; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain asphrrzucpw.ws"; content:"|0b|asphrrzucpw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127276; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain asqpm.ws"; content:"|05|asqpm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127277; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain astcfropbf.info"; content:"|0a|astcfropbf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127278; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aststnvshyc.cn"; content:"|0b|aststnvshyc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127279; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain asucwrnu.cn"; content:"|08|asucwrnu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127280; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain asyff.info"; content:"|05|asyff|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127281; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain atacalvo.ws"; content:"|08|atacalvo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127282; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain atfeqisj.biz"; content:"|08|atfeqisj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127283; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain atgdx.com"; content:"|05|atgdx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127284; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain atgzobcx.cc"; content:"|08|atgzobcx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127285; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain atkpuddpw.com"; content:"|09|atkpuddpw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127286; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain atmxuvik.biz"; content:"|08|atmxuvik|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127287; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain atrpvocry.com"; content:"|09|atrpvocry|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127288; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain atryzgny.org"; content:"|08|atryzgny|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127289; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain attausv.biz"; content:"|07|attausv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127290; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain atuorecs.biz"; content:"|08|atuorecs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127291; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain atvpo.cc"; content:"|05|atvpo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127292; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain atvsrizwy.info"; content:"|09|atvsrizwy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127293; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain auaspuwdjpf.biz"; content:"|0b|auaspuwdjpf|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127294; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain auazxosspu.com"; content:"|0a|auazxosspu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127295; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain auebveer.biz"; content:"|08|auebveer|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127296; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain auhnzbf.info"; content:"|07|auhnzbf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127297; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aukacrogz.cc"; content:"|09|aukacrogz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127298; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aukrsemje.info"; content:"|09|aukrsemje|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127299; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aukthsdd.com"; content:"|08|aukthsdd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127300; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain auncnspx.cc"; content:"|08|auncnspx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127301; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ausnnt.com"; content:"|06|ausnnt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127302; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ausxpxc.cn"; content:"|07|ausxpxc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127303; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain auufar.org"; content:"|06|auufar|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127304; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain auvejsbbc.biz"; content:"|09|auvejsbbc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127305; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain auxxxxkqtwz.net"; content:"|0b|auxxxxkqtwz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127306; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain auyqegujfls.biz"; content:"|0b|auyqegujfls|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127307; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain auzxwok.biz"; content:"|07|auzxwok|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127308; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain avbhkhom.org"; content:"|08|avbhkhom|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127309; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aveplabpiog.cn"; content:"|0b|aveplabpiog|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127310; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain avgcnnac.info"; content:"|08|avgcnnac|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127311; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain avgnbjkv.biz"; content:"|08|avgnbjkv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127312; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain avikvnfw.biz"; content:"|08|avikvnfw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127313; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain avqdzen.cn"; content:"|07|avqdzen|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127314; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain avqiviqta.cc"; content:"|09|avqiviqta|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127315; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain avumhmj.cc"; content:"|07|avumhmj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127316; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain avyuzbak.com"; content:"|08|avyuzbak|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127317; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain avzjgvbyocf.com"; content:"|0b|avzjgvbyocf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127318; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain awdfazr.org"; content:"|07|awdfazr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127319; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain awdkevyh.com"; content:"|08|awdkevyh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127320; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain awfrudpz.net"; content:"|08|awfrudpz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127321; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain awgltdjkeac.org"; content:"|0b|awgltdjkeac|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127322; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain awmgizdq.cn"; content:"|08|awmgizdq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127323; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain awpuz.biz"; content:"|05|awpuz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127324; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain awtwetcc.cc"; content:"|08|awtwetcc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127325; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain axeeqhdgknw.biz"; content:"|0b|axeeqhdgknw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127326; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain axgcjvyiyo.ws"; content:"|0a|axgcjvyiyo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127327; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain axhsi.cc"; content:"|05|axhsi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127328; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain axkpp.biz"; content:"|05|axkpp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127329; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain axlpz.cc"; content:"|05|axlpz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127330; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain axlqrxaw.cc"; content:"|08|axlqrxaw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127331; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain axqaip.ws"; content:"|06|axqaip|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127332; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain axqouoy.com"; content:"|07|axqouoy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127333; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ayarzubz.biz"; content:"|08|ayarzubz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127334; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aychrjrq.net"; content:"|08|aychrjrq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127335; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ayhir.cn"; content:"|05|ayhir|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127336; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ayjkda.biz"; content:"|06|ayjkda|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127337; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ayjygtrd.org"; content:"|08|ayjygtrd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127338; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ayklhg.cc"; content:"|06|ayklhg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127339; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aywsxsnmobs.info"; content:"|0b|aywsxsnmobs|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127340; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain azdba.cc"; content:"|05|azdba|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127341; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain azgibadq.ws"; content:"|08|azgibadq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127342; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain azgqvqevw.com"; content:"|09|azgqvqevw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127343; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain azmmtjodaxs.cc"; content:"|0b|azmmtjodaxs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127344; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain aznuy.info"; content:"|05|aznuy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127345; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain azvvdkdg.cc"; content:"|08|azvvdkdg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127346; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain azwhncvwo.net"; content:"|09|azwhncvwo|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127347; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain azwwswcie.cn"; content:"|09|azwwswcie|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127348; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain azzdglq.cn"; content:"|07|azzdglq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127349; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain baaxajgd.biz"; content:"|08|baaxajgd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127350; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain balkvut.ws"; content:"|07|balkvut|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127351; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bamfj.cc"; content:"|05|bamfj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127352; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bamzgpe.cn"; content:"|07|bamzgpe|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127353; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain baohkpumf.ws"; content:"|09|baohkpumf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127354; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bauxplgjxp.org"; content:"|0a|bauxplgjxp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127355; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bazemwujt.info"; content:"|09|bazemwujt|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127356; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bbafomtuu.org"; content:"|09|bbafomtuu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127357; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bbeislnsgx.info"; content:"|0a|bbeislnsgx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127358; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bbjeyzudfy.net"; content:"|0a|bbjeyzudfy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127359; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bboihkj.com"; content:"|07|bboihkj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127360; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bbrgdejsvlz.ws"; content:"|0b|bbrgdejsvlz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127361; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bbrsl.org"; content:"|05|bbrsl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127362; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bbsktpcnfes.ws"; content:"|0b|bbsktpcnfes|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127363; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bbsobbqxoom.net"; content:"|0b|bbsobbqxoom|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127364; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bbtmxxkwo.ws"; content:"|09|bbtmxxkwo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127365; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bbxqplnjhxa.info"; content:"|0b|bbxqplnjhxa|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127366; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bcbeocx.cn"; content:"|07|bcbeocx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127367; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bcehx.biz"; content:"|05|bcehx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127368; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bclircfo.cc"; content:"|08|bclircfo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127369; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bcoihzusg.info"; content:"|09|bcoihzusg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127370; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bcqixfxlwrg.org"; content:"|0b|bcqixfxlwrg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127371; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bcqko.ws"; content:"|05|bcqko|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127372; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bcqslndj.info"; content:"|08|bcqslndj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127373; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bcriapbknlf.net"; content:"|0b|bcriapbknlf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127374; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bcrmaf.org"; content:"|06|bcrmaf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127375; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bczpr.org"; content:"|05|bczpr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127376; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bdcksudd.biz"; content:"|08|bdcksudd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127377; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bdeehxc.net"; content:"|07|bdeehxc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127378; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bdkqzegiw.com"; content:"|09|bdkqzegiw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127379; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bdovf.cc"; content:"|05|bdovf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127380; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bdpbx.net"; content:"|05|bdpbx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127381; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bdqdnndwmym.cn"; content:"|0b|bdqdnndwmym|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127382; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bdrbmxkpep.info"; content:"|0a|bdrbmxkpep|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127383; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bduksxwovl.net"; content:"|0a|bduksxwovl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127384; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bdvesixbrqu.ws"; content:"|0b|bdvesixbrqu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127385; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bdvxwgucq.net"; content:"|09|bdvxwgucq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127386; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bedjch.org"; content:"|06|bedjch|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127387; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain beeirccas.com"; content:"|09|beeirccas|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127388; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bejgihox.org"; content:"|08|bejgihox|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127389; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain belsshgn.biz"; content:"|08|belsshgn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127390; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bemleovjb.net"; content:"|09|bemleovjb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127391; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain beovhvii.cc"; content:"|08|beovhvii|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127392; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain beqbhz.info"; content:"|06|beqbhz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127393; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain beqgcdnheui.cc"; content:"|0b|beqgcdnheui|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127394; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain betrmdqibjl.org"; content:"|0b|betrmdqibjl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127395; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bevtaxpw.info"; content:"|08|bevtaxpw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127396; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain beyaggbtd.info"; content:"|09|beyaggbtd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127397; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bezipvpj.org"; content:"|08|bezipvpj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127398; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bezsvzpf.com"; content:"|08|bezsvzpf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127399; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bfamqifcpn.com"; content:"|0a|bfamqifcpn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127400; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bffka.org"; content:"|05|bffka|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127401; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bfgeenioc.net"; content:"|09|bfgeenioc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127402; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bfgzkwtsvzq.biz"; content:"|0b|bfgzkwtsvzq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127403; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bfhcq.cc"; content:"|05|bfhcq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127404; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bfjzshnjd.net"; content:"|09|bfjzshnjd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127405; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bfmkknnlcg.com"; content:"|0a|bfmkknnlcg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127406; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bfqbsfhg.biz"; content:"|08|bfqbsfhg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127407; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bfqfaqmjnxj.biz"; content:"|0b|bfqfaqmjnxj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127408; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bfqrmqbx.ws"; content:"|08|bfqrmqbx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127409; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bfqwkxts.cn"; content:"|08|bfqwkxts|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127410; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bfruay.org"; content:"|06|bfruay|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127411; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bfsjt.biz"; content:"|05|bfsjt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127412; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bfvmyjzl.net"; content:"|08|bfvmyjzl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127413; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bfxnikbhpm.info"; content:"|0a|bfxnikbhpm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127414; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bfzyk.com"; content:"|05|bfzyk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127415; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bgaydxpk.cc"; content:"|08|bgaydxpk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127416; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bggxcdbp.info"; content:"|08|bggxcdbp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127417; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bgjldcsmyqz.org"; content:"|0b|bgjldcsmyqz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127418; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bgmdcure.org"; content:"|08|bgmdcure|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127419; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bgqhrd.net"; content:"|06|bgqhrd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127420; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bgscmgzs.cc"; content:"|08|bgscmgzs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127421; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bgyjvr.ws"; content:"|06|bgyjvr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127422; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bgyrpjwag.ws"; content:"|09|bgyrpjwag|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127423; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bhauflmfn.ws"; content:"|09|bhauflmfn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127424; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bhaxe.net"; content:"|05|bhaxe|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127425; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bhbtvtbx.info"; content:"|08|bhbtvtbx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127426; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bhgxslwz.com"; content:"|08|bhgxslwz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127427; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bhikjyunn.org"; content:"|09|bhikjyunn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127428; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bhlupub.org"; content:"|07|bhlupub|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127429; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bhmrhcuz.info"; content:"|08|bhmrhcuz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127430; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bhsthnnesg.cc"; content:"|0a|bhsthnnesg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127431; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bhtmtflg.ws"; content:"|08|bhtmtflg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127432; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bibcpivt.cc"; content:"|08|bibcpivt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127433; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain biirqjf.cc"; content:"|07|biirqjf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127434; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bijtplhk.info"; content:"|08|bijtplhk|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127435; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bikirkud.cn"; content:"|08|bikirkud|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127436; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain biodqqe.cn"; content:"|07|biodqqe|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127437; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain biomzm.info"; content:"|06|biomzm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127438; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bixxvjcdzn.biz"; content:"|0a|bixxvjcdzn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127439; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bjcmziji.cn"; content:"|08|bjcmziji|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127440; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bjcwkttwbaw.cn"; content:"|0b|bjcwkttwbaw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127441; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bjdnzmqs.org"; content:"|08|bjdnzmqs|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127442; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bjentvzbw.com"; content:"|09|bjentvzbw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127443; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bjlkhd.ws"; content:"|06|bjlkhd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127444; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bjums.com"; content:"|05|bjums|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127445; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bjxckahlh.org"; content:"|09|bjxckahlh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127446; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bkbjejrh.biz"; content:"|08|bkbjejrh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127447; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bkmxkfdj.org"; content:"|08|bkmxkfdj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127448; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bknhsf.ws"; content:"|06|bknhsf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127449; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bktkrekes.cc"; content:"|09|bktkrekes|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127450; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bkwkbdyqe.cc"; content:"|09|bkwkbdyqe|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127451; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bkxuvf.cc"; content:"|06|bkxuvf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127452; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bkzsafhfrhe.cn"; content:"|0b|bkzsafhfrhe|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127453; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain blakefcokqu.biz"; content:"|0b|blakefcokqu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127454; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain blausfeud.cc"; content:"|09|blausfeud|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127455; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain blezcc.ws"; content:"|06|blezcc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127456; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain blhrzjcyp.org"; content:"|09|blhrzjcyp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127457; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bljxps.org"; content:"|06|bljxps|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127458; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain blktrhaya.cn"; content:"|09|blktrhaya|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127459; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain blojvbcbrwx.biz"; content:"|0b|blojvbcbrwx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127460; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain blvdpxjkel.cn"; content:"|0a|blvdpxjkel|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127461; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain blvdrosx.biz"; content:"|08|blvdrosx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127462; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain blvnguwjji.net"; content:"|0a|blvnguwjji|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127463; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain blwcmcjem.cn"; content:"|09|blwcmcjem|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127464; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain blwfeu.org"; content:"|06|blwfeu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127465; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain blyrsatd.info"; content:"|08|blyrsatd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127466; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bmayvsqpiih.net"; content:"|0b|bmayvsqpiih|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127467; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bmclrexdim.info"; content:"|0a|bmclrexdim|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127468; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bmimdb.biz"; content:"|06|bmimdb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127469; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bmjdjdp.com"; content:"|07|bmjdjdp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127470; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bmkom.cc"; content:"|05|bmkom|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127471; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bmmxppp.info"; content:"|07|bmmxppp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127472; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bmwby.com"; content:"|05|bmwby|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127473; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bmwewsi.ws"; content:"|07|bmwewsi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127474; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bmyhrg.net"; content:"|06|bmyhrg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127475; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bmypvq.cn"; content:"|06|bmypvq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127476; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bndhboy.cc"; content:"|07|bndhboy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127477; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bneoizhz.cc"; content:"|08|bneoizhz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127478; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bnfhiadhlr.cc"; content:"|0a|bnfhiadhlr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127479; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bnibzk.biz"; content:"|06|bnibzk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127480; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bnnbfha.cn"; content:"|07|bnnbfha|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127481; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bnpzhtyd.net"; content:"|08|bnpzhtyd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127482; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bnrgezylk.org"; content:"|09|bnrgezylk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127483; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bnsbx.net"; content:"|05|bnsbx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127484; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bnwjfbwb.org"; content:"|08|bnwjfbwb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127485; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bnzzyzvkm.cc"; content:"|09|bnzzyzvkm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127486; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bocgc.net"; content:"|05|bocgc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127487; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bofxlzjw.org"; content:"|08|bofxlzjw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127488; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain boksm.com"; content:"|05|boksm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127489; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bolqdcaoq.ws"; content:"|09|bolqdcaoq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127490; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bolqoruve.org"; content:"|09|bolqoruve|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127491; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bomjfurf.net"; content:"|08|bomjfurf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127492; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain boqhyuax.ws"; content:"|08|boqhyuax|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127493; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain borpbawx.net"; content:"|08|borpbawx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127494; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bosoqkzegp.info"; content:"|0a|bosoqkzegp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127495; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain boufkzwpy.net"; content:"|09|boufkzwpy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127496; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bouqoslqgp.cc"; content:"|0a|bouqoslqgp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127497; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bouvzjefe.info"; content:"|09|bouvzjefe|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127498; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bpaqq.cn"; content:"|05|bpaqq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127499; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bpbgpzul.cn"; content:"|08|bpbgpzul|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127500; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bpedygmscec.ws"; content:"|0b|bpedygmscec|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127501; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bpfkg.cc"; content:"|05|bpfkg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127502; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bpjdppq.cn"; content:"|07|bpjdppq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127503; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bpwjnrmefot.cc"; content:"|0b|bpwjnrmefot|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127504; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bpxquouktsz.cc"; content:"|0b|bpxquouktsz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127505; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bpzwe.org"; content:"|05|bpzwe|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127506; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bqeexwso.com"; content:"|08|bqeexwso|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127507; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bqgkritan.biz"; content:"|09|bqgkritan|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127508; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bqmbmm.biz"; content:"|06|bqmbmm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127509; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bqpqjlgm.ws"; content:"|08|bqpqjlgm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127510; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bqvgraffiax.org"; content:"|0b|bqvgraffiax|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127511; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bqwvxaes.net"; content:"|08|bqwvxaes|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127512; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain brcjp.biz"; content:"|05|brcjp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127513; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain brddnubaq.cn"; content:"|09|brddnubaq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127514; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain brfpclcnb.ws"; content:"|09|brfpclcnb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127515; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain brhusyvk.net"; content:"|08|brhusyvk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127516; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain brjqym.biz"; content:"|06|brjqym|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127517; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain brnigsmf.ws"; content:"|08|brnigsmf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127518; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain brpdvkuxuxu.org"; content:"|0b|brpdvkuxuxu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127519; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain brphzjgsvy.org"; content:"|0a|brphzjgsvy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127520; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain brpixjss.biz"; content:"|08|brpixjss|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127521; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain brwqstrm.org"; content:"|08|brwqstrm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127522; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain brwzscfs.org"; content:"|08|brwzscfs|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127523; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bsampcjxc.com"; content:"|09|bsampcjxc|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127524; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bscqfcdfqrj.net"; content:"|0b|bscqfcdfqrj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127525; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bsexdxjr.org"; content:"|08|bsexdxjr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127526; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bsmqqgck.com"; content:"|08|bsmqqgck|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127527; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bsqctomf.biz"; content:"|08|bsqctomf|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127528; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bsrsngvxx.org"; content:"|09|bsrsngvxx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127529; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bstyghgg.net"; content:"|08|bstyghgg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127530; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain btcwk.org"; content:"|05|btcwk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127531; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain btgoyr.cc"; content:"|06|btgoyr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127532; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain btiak.net"; content:"|05|btiak|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127533; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain btmhf.org"; content:"|05|btmhf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127534; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain btmtldorfa.com"; content:"|0a|btmtldorfa|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127535; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain btmzfufvi.com"; content:"|09|btmzfufvi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127536; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bttdpbp.info"; content:"|07|bttdpbp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127537; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bttyaq.info"; content:"|06|bttyaq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127538; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain btwktebh.cn"; content:"|08|btwktebh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127539; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain btxswozbfoy.cn"; content:"|0b|btxswozbfoy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127540; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain btzasl.cc"; content:"|06|btzasl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127541; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain buciscbyi.cn"; content:"|09|buciscbyi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127542; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain buczkaj.info"; content:"|07|buczkaj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127543; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain budta.cc"; content:"|05|budta|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127544; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bueybd.com"; content:"|06|bueybd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127545; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bugfeqqjphr.com"; content:"|0b|bugfeqqjphr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127546; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain buhclciem.info"; content:"|09|buhclciem|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127547; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bumlke.ws"; content:"|06|bumlke|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127548; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain buoxgakbizl.biz"; content:"|0b|buoxgakbizl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127549; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain burdyzhx.com"; content:"|08|burdyzhx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127550; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain burpqotr.net"; content:"|08|burpqotr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127551; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bvdax.cn"; content:"|05|bvdax|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127552; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bvpqliq.info"; content:"|07|bvpqliq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127553; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bvrvogcz.org"; content:"|08|bvrvogcz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127554; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bvtjbltk.org"; content:"|08|bvtjbltk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127555; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bvzqxbydh.ws"; content:"|09|bvzqxbydh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127556; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bvzsk.org"; content:"|05|bvzsk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127557; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bwatelmj.cc"; content:"|08|bwatelmj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127558; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bwbiwdpk.cn"; content:"|08|bwbiwdpk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127559; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bwczx.net"; content:"|05|bwczx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127560; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bwewk.org"; content:"|05|bwewk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127561; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bwhifrq.biz"; content:"|07|bwhifrq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127562; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bwijdj.net"; content:"|06|bwijdj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127563; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bwipiihmmmy.biz"; content:"|0b|bwipiihmmmy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127564; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bwjofsxa.cc"; content:"|08|bwjofsxa|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127565; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bwmkrv.ws"; content:"|06|bwmkrv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127566; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bwpgoeem.info"; content:"|08|bwpgoeem|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127567; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bwvesq.biz"; content:"|06|bwvesq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127568; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bwwpbsra.biz"; content:"|08|bwwpbsra|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127569; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bwyiypkkzx.info"; content:"|0a|bwyiypkkzx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127570; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bwzrj.org"; content:"|05|bwzrj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127571; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bxdnwjiswa.ws"; content:"|0a|bxdnwjiswa|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127572; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bxejv.com"; content:"|05|bxejv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127573; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bxfpbqw.ws"; content:"|07|bxfpbqw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127574; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bxgil.ws"; content:"|05|bxgil|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127575; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bxkoywd.org"; content:"|07|bxkoywd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127576; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bxlcmnyqcrc.cn"; content:"|0b|bxlcmnyqcrc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127577; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bxlxtppi.cc"; content:"|08|bxlxtppi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127578; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bxosdqtjl.info"; content:"|09|bxosdqtjl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127579; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bxoudifvqf.ws"; content:"|0a|bxoudifvqf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127580; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bxpbpvimtd.biz"; content:"|0a|bxpbpvimtd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127581; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bxrffqzecsw.biz"; content:"|0b|bxrffqzecsw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127582; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bxrupdad.org"; content:"|08|bxrupdad|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127583; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bxsmhr.info"; content:"|06|bxsmhr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127584; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bxuqjow.cc"; content:"|07|bxuqjow|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127585; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bxxnelw.cc"; content:"|07|bxxnelw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127586; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bxyhinmh.ws"; content:"|08|bxyhinmh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127587; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bydmhnmdan.ws"; content:"|0a|bydmhnmdan|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127588; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain byebkdrxln.info"; content:"|0a|byebkdrxln|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127589; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain byeqfekyr.info"; content:"|09|byeqfekyr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127590; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bygyi.ws"; content:"|05|bygyi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127591; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bykhzr.ws"; content:"|06|bykhzr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127592; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain byqabhgxpzp.ws"; content:"|0b|byqabhgxpzp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127593; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain byrzvtym.cn"; content:"|08|byrzvtym|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127594; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain byudndsh.org"; content:"|08|byudndsh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127595; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bywcuie.cn"; content:"|07|bywcuie|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127596; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain byyofp.org"; content:"|06|byyofp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127597; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain byyvat.ws"; content:"|06|byyvat|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127598; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bzcjakjlrw.org"; content:"|0a|bzcjakjlrw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127599; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bzectmxdset.com"; content:"|0b|bzectmxdset|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127600; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bzejbppve.com"; content:"|09|bzejbppve|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127601; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bzfucl.cn"; content:"|06|bzfucl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127602; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bzihpngz.com"; content:"|08|bzihpngz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127603; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bzjikokq.cc"; content:"|08|bzjikokq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127604; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bzjmrcbx.cn"; content:"|08|bzjmrcbx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127605; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bznufny.org"; content:"|07|bznufny|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127606; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bzoshunxdio.net"; content:"|0b|bzoshunxdio|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127607; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bzpsyaxu.cc"; content:"|08|bzpsyaxu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127608; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bztczfhfhfe.biz"; content:"|0b|bztczfhfhfe|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127609; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain bzvayaswy.cc"; content:"|09|bzvayaswy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127610; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain caamsw.cn"; content:"|06|caamsw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127611; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain caarb.cc"; content:"|05|caarb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127612; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cabcraxks.org"; content:"|09|cabcraxks|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127613; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cagindwldu.info"; content:"|0a|cagindwldu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127614; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cagygakbt.ws"; content:"|09|cagygakbt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127615; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cahgmk.cc"; content:"|06|cahgmk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127616; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain caorih.ws"; content:"|06|caorih|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127617; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cattgga.cc"; content:"|07|cattgga|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127618; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cawawuyi.ws"; content:"|08|cawawuyi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127619; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain caxzmxaeg.info"; content:"|09|caxzmxaeg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127620; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cbevvveqe.org"; content:"|09|cbevvveqe|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127621; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cbidz.info"; content:"|05|cbidz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127622; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cbiqsyhl.org"; content:"|08|cbiqsyhl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127623; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cbkzmxbu.com"; content:"|08|cbkzmxbu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127624; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cbrcylpk.ws"; content:"|08|cbrcylpk|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127625; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cbsmfmyeg.info"; content:"|09|cbsmfmyeg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127626; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cbwhqnt.org"; content:"|07|cbwhqnt|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127627; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cbxjbtzzil.ws"; content:"|0a|cbxjbtzzil|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127628; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cbyjmgbdz.cn"; content:"|09|cbyjmgbdz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127629; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ccdmgzf.ws"; content:"|07|ccdmgzf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127630; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ccekdbs.info"; content:"|07|ccekdbs|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127631; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ccfjpdm.cc"; content:"|07|ccfjpdm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127632; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ccida.org"; content:"|05|ccida|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127633; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cckefhvhig.cn"; content:"|0a|cckefhvhig|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127634; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cckiu.ws"; content:"|05|cckiu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127635; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ccnnv.org"; content:"|05|ccnnv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127636; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ccpegjaii.biz"; content:"|09|ccpegjaii|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127637; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ccqlg.org"; content:"|05|ccqlg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127638; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ccrxzr.biz"; content:"|06|ccrxzr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127639; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cctfj.cn"; content:"|05|cctfj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127640; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ccvlcdrt.cc"; content:"|08|ccvlcdrt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127641; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ccvtiy.cn"; content:"|06|ccvtiy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127642; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cdcsc.org"; content:"|05|cdcsc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127643; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cdeutnnc.cn"; content:"|08|cdeutnnc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127644; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cdgpatgdzj.com"; content:"|0a|cdgpatgdzj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127645; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cdiehhkvmh.cn"; content:"|0a|cdiehhkvmh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127646; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cdivowggxft.cn"; content:"|0b|cdivowggxft|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127647; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cdjfvcup.info"; content:"|08|cdjfvcup|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127648; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cdkdz.biz"; content:"|05|cdkdz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127649; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cdoieiindmj.biz"; content:"|0b|cdoieiindmj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127650; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cdpykj.cc"; content:"|06|cdpykj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127651; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cduwccteoa.cc"; content:"|0a|cduwccteoa|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127652; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cdxkduhbg.ws"; content:"|09|cdxkduhbg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127653; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cedwinlpju.org"; content:"|0a|cedwinlpju|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127654; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cepxpctejf.cc"; content:"|0a|cepxpctejf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127655; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cerwsrh.biz"; content:"|07|cerwsrh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127656; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cescytqpen.biz"; content:"|0a|cescytqpen|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127657; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ceuasyixfib.cn"; content:"|0b|ceuasyixfib|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127658; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cewijt.cn"; content:"|06|cewijt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127659; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cfducml.org"; content:"|07|cfducml|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127660; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cfebgt.biz"; content:"|06|cfebgt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127661; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cfgljwjrdj.cn"; content:"|0a|cfgljwjrdj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127662; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cfhknbqp.cn"; content:"|08|cfhknbqp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127663; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cfkwvepm.net"; content:"|08|cfkwvepm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127664; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cflzxlu.biz"; content:"|07|cflzxlu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127665; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cfmvy.cc"; content:"|05|cfmvy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127666; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cfpffwnz.com"; content:"|08|cfpffwnz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127667; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cfpmwyxx.net"; content:"|08|cfpmwyxx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127668; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cfxgmgjx.org"; content:"|08|cfxgmgjx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127669; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cgbrw.biz"; content:"|05|cgbrw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127670; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cgcvdb.net"; content:"|06|cgcvdb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127671; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cggjgahe.biz"; content:"|08|cggjgahe|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127672; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cghnx.com"; content:"|05|cghnx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127673; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cgilyjva.info"; content:"|08|cgilyjva|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127674; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cgitm.com"; content:"|05|cgitm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127675; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cgpnuliu.info"; content:"|08|cgpnuliu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127676; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cgvgv.biz"; content:"|05|cgvgv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127677; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cgwlpvonlf.cc"; content:"|0a|cgwlpvonlf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127678; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cgzstdvjvo.org"; content:"|0a|cgzstdvjvo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127679; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain chibrizzu.ws"; content:"|09|chibrizzu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127680; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain chjfnv.cc"; content:"|06|chjfnv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127681; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain chopzk.cc"; content:"|06|chopzk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127682; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain chpxy.net"; content:"|05|chpxy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127683; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain chrnk.cc"; content:"|05|chrnk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127684; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain chsxcoco.biz"; content:"|08|chsxcoco|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127685; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain chvayz.com"; content:"|06|chvayz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127686; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain chvkrte.com"; content:"|07|chvkrte|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127687; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain chwdeixwjdr.com"; content:"|0b|chwdeixwjdr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127688; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain chxwoe.org"; content:"|06|chxwoe|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127689; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cidlfq.biz"; content:"|06|cidlfq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127690; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cifjbtke.info"; content:"|08|cifjbtke|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127691; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cihijw.biz"; content:"|06|cihijw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127692; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cihocqbndf.ws"; content:"|0a|cihocqbndf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127693; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cijzeqtqo.cn"; content:"|09|cijzeqtqo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127694; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ciopwvz.com"; content:"|07|ciopwvz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127695; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cirrzmb.ws"; content:"|07|cirrzmb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127696; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ciuqkoittj.org"; content:"|0a|ciuqkoittj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127697; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cixaditon.biz"; content:"|09|cixaditon|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127698; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cixth.biz"; content:"|05|cixth|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127699; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjadofz.info"; content:"|07|cjadofz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127700; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjamwhmyaes.com"; content:"|0b|cjamwhmyaes|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127701; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjccmrlcw.net"; content:"|09|cjccmrlcw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127702; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjdscb.net"; content:"|06|cjdscb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127703; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjeaioqieyl.com"; content:"|0b|cjeaioqieyl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127704; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjfqcwit.biz"; content:"|08|cjfqcwit|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127705; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjgtivev.ws"; content:"|08|cjgtivev|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127706; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjhdky.com"; content:"|06|cjhdky|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127707; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjjohueb.cn"; content:"|08|cjjohueb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127708; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjmgrw.biz"; content:"|06|cjmgrw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127709; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjmiqx.org"; content:"|06|cjmiqx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127710; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjmivbqgmd.ws"; content:"|0a|cjmivbqgmd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127711; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjmonaopy.org"; content:"|09|cjmonaopy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127712; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjnsikblgs.ws"; content:"|0a|cjnsikblgs|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127713; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjpgwvkyost.ws"; content:"|0b|cjpgwvkyost|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127714; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjtcbdegmn.com"; content:"|0a|cjtcbdegmn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127715; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjtxdxiap.net"; content:"|09|cjtxdxiap|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127716; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjwuueox.cn"; content:"|08|cjwuueox|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127717; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjxar.cc"; content:"|05|cjxar|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127718; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjxehyzh.cn"; content:"|08|cjxehyzh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127719; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjzsnnec.info"; content:"|08|cjzsnnec|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127720; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cjzylrhnyr.net"; content:"|0a|cjzylrhnyr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127721; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ckfcuhnrn.com"; content:"|09|ckfcuhnrn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127722; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ckfkxkic.info"; content:"|08|ckfkxkic|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127723; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ckhexsd.info"; content:"|07|ckhexsd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127724; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ckmbligh.com"; content:"|08|ckmbligh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127725; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ckmku.cc"; content:"|05|ckmku|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127726; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ckmyxc.org"; content:"|06|ckmyxc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127727; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ckttlxl.org"; content:"|07|ckttlxl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127728; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ckuzoxjo.biz"; content:"|08|ckuzoxjo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127729; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ckzthglr.org"; content:"|08|ckzthglr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127730; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain claroxbkfa.biz"; content:"|0a|claroxbkfa|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127731; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain clbvcvei.com"; content:"|08|clbvcvei|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127732; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain clezfkluheh.ws"; content:"|0b|clezfkluheh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127733; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain clghvwi.cc"; content:"|07|clghvwi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127734; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain clhuso.net"; content:"|06|clhuso|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127735; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain clirv.org"; content:"|05|clirv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127736; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain clnldb.cc"; content:"|06|clnldb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127737; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cloyokykht.org"; content:"|0a|cloyokykht|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127738; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain clqfoyiqv.net"; content:"|09|clqfoyiqv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127739; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain clqysz.cc"; content:"|06|clqysz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127740; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain clwnjkpp.com"; content:"|08|clwnjkpp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127741; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain clzsuxp.net"; content:"|07|clzsuxp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127742; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cmbfwqek.com"; content:"|08|cmbfwqek|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127743; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cmfbp.ws"; content:"|05|cmfbp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127744; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cmhfojsbc.cc"; content:"|09|cmhfojsbc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127745; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cmjismw.net"; content:"|07|cmjismw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127746; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cmnnrntmpd.biz"; content:"|0a|cmnnrntmpd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127747; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cmopx.cn"; content:"|05|cmopx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127748; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cmvqqvpegel.ws"; content:"|0b|cmvqqvpegel|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127749; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cmxkls.cc"; content:"|06|cmxkls|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127750; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cneads.cc"; content:"|06|cneads|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127751; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cnhxltgtswa.net"; content:"|0b|cnhxltgtswa|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127752; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cnlqi.cn"; content:"|05|cnlqi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127753; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cnnqxjze.com"; content:"|08|cnnqxjze|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127754; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cnrqvrqkc.biz"; content:"|09|cnrqvrqkc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127755; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cnsubb.org"; content:"|06|cnsubb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127756; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cnttjrpdegq.com"; content:"|0b|cnttjrpdegq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127757; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cnvhkquz.biz"; content:"|08|cnvhkquz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127758; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cnwmnonpo.info"; content:"|09|cnwmnonpo|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127759; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cnykthi.cc"; content:"|07|cnykthi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127760; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cnzvin.biz"; content:"|06|cnzvin|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127761; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cocgxlqajcl.cc"; content:"|0b|cocgxlqajcl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127762; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cohsfwggk.com"; content:"|09|cohsfwggk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127763; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cojgbpfr.cc"; content:"|08|cojgbpfr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127764; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain copcmxvvh.info"; content:"|09|copcmxvvh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127765; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cozmpe.org"; content:"|06|cozmpe|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127766; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cozscdqh.net"; content:"|08|cozscdqh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127767; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cpagaffxj.cc"; content:"|09|cpagaffxj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127768; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cpasjcga.com"; content:"|08|cpasjcga|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127769; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cpaspyf.org"; content:"|07|cpaspyf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127770; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cpawukh.net"; content:"|07|cpawukh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127771; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cpbvv.biz"; content:"|05|cpbvv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127772; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cpealcdr.biz"; content:"|08|cpealcdr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127773; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cpgyhbfkit.biz"; content:"|0a|cpgyhbfkit|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127774; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cphjsluuspe.biz"; content:"|0b|cphjsluuspe|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127775; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cpmcd.biz"; content:"|05|cpmcd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127776; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cpuaewccn.cc"; content:"|09|cpuaewccn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127777; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cpwqgtohlk.cc"; content:"|0a|cpwqgtohlk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127778; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cpymrugh.com"; content:"|08|cpymrugh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127779; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cpyoklbzy.org"; content:"|09|cpyoklbzy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127780; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cqbihtrgy.net"; content:"|09|cqbihtrgy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127781; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cqbowjcaq.net"; content:"|09|cqbowjcaq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127782; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cqcbnse.net"; content:"|07|cqcbnse|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127783; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cqfyjgh.cc"; content:"|07|cqfyjgh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127784; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cqkyd.com"; content:"|05|cqkyd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127785; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cqorgyxhic.ws"; content:"|0a|cqorgyxhic|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127786; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cqpggyvb.ws"; content:"|08|cqpggyvb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127787; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cqrxuil.org"; content:"|07|cqrxuil|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127788; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cqtbedw.info"; content:"|07|cqtbedw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127789; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cqusiwtif.com"; content:"|09|cqusiwtif|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127790; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cqyuhwq.info"; content:"|07|cqyuhwq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127791; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cqznazwgc.cc"; content:"|09|cqznazwgc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127792; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cqzru.biz"; content:"|05|cqzru|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127793; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cralzvset.org"; content:"|09|cralzvset|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127794; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain crfahx.org"; content:"|06|crfahx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127795; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain crggrtfpf.com"; content:"|09|crggrtfpf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127796; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain criltlcrd.biz"; content:"|09|criltlcrd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127797; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain crkjjl.biz"; content:"|06|crkjjl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127798; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain crknjjsq.cn"; content:"|08|crknjjsq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127799; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain crlktqwtcg.org"; content:"|0a|crlktqwtcg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127800; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain crpgssq.cn"; content:"|07|crpgssq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127801; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain crqjnek.biz"; content:"|07|crqjnek|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127802; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain crrnoopzv.com"; content:"|09|crrnoopzv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127803; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain crrrmomocxo.info"; content:"|0b|crrrmomocxo|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127804; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain crvetqnysip.org"; content:"|0b|crvetqnysip|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127805; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain crxgmy.com"; content:"|06|crxgmy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127806; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain crzuhufb.biz"; content:"|08|crzuhufb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127807; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain csbpehua.biz"; content:"|08|csbpehua|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127808; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cscua.info"; content:"|05|cscua|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127809; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain csghxdf.com"; content:"|07|csghxdf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127810; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain csgwmmijp.cc"; content:"|09|csgwmmijp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127811; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cshlfoqv.cc"; content:"|08|cshlfoqv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127812; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cslprnm.org"; content:"|07|cslprnm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127813; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cslrwnkh.info"; content:"|08|cslrwnkh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127814; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain csozbudxtp.com"; content:"|0a|csozbudxtp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127815; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain csqrqlhrt.cn"; content:"|09|csqrqlhrt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127816; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain csuqeskliy.net"; content:"|0a|csuqeskliy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127817; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cswem.org"; content:"|05|cswem|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127818; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cswwqiy.ws"; content:"|07|cswwqiy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127819; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ctdhpwyg.biz"; content:"|08|ctdhpwyg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127820; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ctmwyygc.net"; content:"|08|ctmwyygc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127821; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ctmxojrvexc.cn"; content:"|0b|ctmxojrvexc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127822; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ctnqcgacbz.ws"; content:"|0a|ctnqcgacbz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127823; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ctogu.net"; content:"|05|ctogu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127824; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ctonlzcs.ws"; content:"|08|ctonlzcs|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127825; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ctonxrokuf.ws"; content:"|0a|ctonxrokuf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127826; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ctpakvlnsm.com"; content:"|0a|ctpakvlnsm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127827; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ctukmewyvg.cc"; content:"|0a|ctukmewyvg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127828; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cuayqea.cc"; content:"|07|cuayqea|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127829; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cuhecp.org"; content:"|06|cuhecp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127830; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cuivth.net"; content:"|06|cuivth|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127831; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cunoypematm.ws"; content:"|0b|cunoypematm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127832; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cuqtymd.info"; content:"|07|cuqtymd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127833; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain curwsdpxhf.net"; content:"|0a|curwsdpxhf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127834; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain curzktd.org"; content:"|07|curzktd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127835; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cutiaettxgb.info"; content:"|0b|cutiaettxgb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127836; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cvczg.cn"; content:"|05|cvczg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127837; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cvgdxowoy.cn"; content:"|09|cvgdxowoy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127838; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cvglolm.com"; content:"|07|cvglolm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127839; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cvgnhfhgoyk.net"; content:"|0b|cvgnhfhgoyk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127840; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cvjfxfolju.net"; content:"|0a|cvjfxfolju|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127841; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cvlkapwddjo.com"; content:"|0b|cvlkapwddjo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127842; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cvmamk.ws"; content:"|06|cvmamk|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127843; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cvngf.biz"; content:"|05|cvngf|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127844; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cvpjoz.cc"; content:"|06|cvpjoz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127845; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cvqtdgis.net"; content:"|08|cvqtdgis|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127846; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cvrykzax.info"; content:"|08|cvrykzax|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127847; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cvtzgkzy.net"; content:"|08|cvtzgkzy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127848; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cvtzsmyt.cn"; content:"|08|cvtzsmyt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127849; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cvzijyyt.com"; content:"|08|cvzijyyt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127850; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cvzlavptpn.cc"; content:"|0a|cvzlavptpn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127851; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cwdxsxgndsj.cc"; content:"|0b|cwdxsxgndsj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127852; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cwffqm.org"; content:"|06|cwffqm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127853; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cwgaepd.cc"; content:"|07|cwgaepd|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127854; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cwiyvmpvp.biz"; content:"|09|cwiyvmpvp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127855; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cwkscypway.cn"; content:"|0a|cwkscypway|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127856; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cwpjmqmgq.biz"; content:"|09|cwpjmqmgq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127857; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cwqjlwbsy.cn"; content:"|09|cwqjlwbsy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127858; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cwqwzhi.info"; content:"|07|cwqwzhi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127859; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cwtbcpdzx.com"; content:"|09|cwtbcpdzx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127860; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cwtsissho.net"; content:"|09|cwtsissho|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127861; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cwvenakhd.info"; content:"|09|cwvenakhd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127862; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cwwpfcmxrvp.net"; content:"|0b|cwwpfcmxrvp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127863; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cwytfhenjk.cc"; content:"|0a|cwytfhenjk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127864; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cxaej.org"; content:"|05|cxaej|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127865; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cxcfgyvsip.cn"; content:"|0a|cxcfgyvsip|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127866; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cxukbezv.cc"; content:"|08|cxukbezv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127867; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cxwupsmm.cn"; content:"|08|cxwupsmm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127868; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cxwyvmpzcgg.net"; content:"|0b|cxwyvmpzcgg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127869; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cxywfen.cc"; content:"|07|cxywfen|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127870; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cycgihaj.info"; content:"|08|cycgihaj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127871; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cycrsaem.net"; content:"|08|cycrsaem|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127872; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cydggz.cc"; content:"|06|cydggz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127873; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cyeayuhnnwz.cn"; content:"|0b|cyeayuhnnwz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127874; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cyxqlqetkz.info"; content:"|0a|cyxqlqetkz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127875; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain cyzbdsc.cc"; content:"|07|cyzbdsc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127876; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain czddtfetczp.cn"; content:"|0b|czddtfetczp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127877; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain czhaq.info"; content:"|05|czhaq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127878; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain czhcguic.ws"; content:"|08|czhcguic|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127879; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain czhyreyn.org"; content:"|08|czhyreyn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127880; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain czipgxg.org"; content:"|07|czipgxg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127881; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain czonus.net"; content:"|06|czonus|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127882; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain czotvdbl.info"; content:"|08|czotvdbl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127883; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dabsaqtsifs.ws"; content:"|0b|dabsaqtsifs|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127884; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dasgkbxg.ws"; content:"|08|dasgkbxg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127885; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain davus.org"; content:"|05|davus|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127886; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dawfh.cc"; content:"|05|dawfh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127887; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dawrue.cc"; content:"|06|dawrue|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127888; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain daytmnr.cn"; content:"|07|daytmnr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127889; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dazvzrdvco.org"; content:"|0a|dazvzrdvco|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127890; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dbaactx.com"; content:"|07|dbaactx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127891; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dbbcb.net"; content:"|05|dbbcb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127892; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dbeewcdrarj.org"; content:"|0b|dbeewcdrarj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127893; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dbexz.biz"; content:"|05|dbexz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127894; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dbgnqstw.cc"; content:"|08|dbgnqstw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127895; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dbhcvl.com"; content:"|06|dbhcvl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127896; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dbipvrjegvs.cc"; content:"|0b|dbipvrjegvs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127897; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dbirgrikf.ws"; content:"|09|dbirgrikf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127898; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dblxgnroeov.com"; content:"|0b|dblxgnroeov|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127899; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dblzkynqmcs.info"; content:"|0b|dblzkynqmcs|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127900; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dcfdh.biz"; content:"|05|dcfdh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127901; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dcgxqw.net"; content:"|06|dcgxqw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127902; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dcrkaxvrs.ws"; content:"|09|dcrkaxvrs|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127903; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dcwvcrgbdkw.cn"; content:"|0b|dcwvcrgbdkw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127904; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ddbkfesl.cn"; content:"|08|ddbkfesl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127905; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ddcbfvl.info"; content:"|07|ddcbfvl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127906; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dddttuhb.ws"; content:"|08|dddttuhb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127907; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ddkss.cn"; content:"|05|ddkss|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127908; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ddnjwtgxiuj.org"; content:"|0b|ddnjwtgxiuj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127909; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ddoegxjta.com"; content:"|09|ddoegxjta|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127910; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ddouvboz.org"; content:"|08|ddouvboz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127911; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ddphytane.biz"; content:"|09|ddphytane|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127912; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ddpjxlgy.biz"; content:"|08|ddpjxlgy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127913; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ddsfk.org"; content:"|05|ddsfk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127914; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ddszbzed.info"; content:"|08|ddszbzed|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127915; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ddwwmybtbpc.biz"; content:"|0b|ddwwmybtbpc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127916; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ddxmqnzze.cn"; content:"|09|ddxmqnzze|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127917; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ddyhfp.biz"; content:"|06|ddyhfp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127918; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ddzfogg.net"; content:"|07|ddzfogg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127919; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain decmxgwovp.com"; content:"|0a|decmxgwovp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127920; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dehaogphg.org"; content:"|09|dehaogphg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127921; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain deibqudfb.biz"; content:"|09|deibqudfb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127922; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain delecqmzg.cc"; content:"|09|delecqmzg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127923; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dfeomxyiead.cn"; content:"|0b|dfeomxyiead|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127924; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dffxsxdybp.cc"; content:"|0a|dffxsxdybp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127925; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dfhon.biz"; content:"|05|dfhon|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127926; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dfikuzwg.ws"; content:"|08|dfikuzwg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127927; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dfkxl.net"; content:"|05|dfkxl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127928; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dflnsspay.ws"; content:"|09|dflnsspay|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127929; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dfmjdagt.cn"; content:"|08|dfmjdagt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127930; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dfnhlqqcx.org"; content:"|09|dfnhlqqcx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127931; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dfnmnvmaor.org"; content:"|0a|dfnmnvmaor|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127932; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dfpumgiccz.cc"; content:"|0a|dfpumgiccz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127933; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dftnpeqzit.cn"; content:"|0a|dftnpeqzit|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127934; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dfublguj.biz"; content:"|08|dfublguj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127935; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dgceynjm.cc"; content:"|08|dgceynjm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127936; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dgcnyesjxer.biz"; content:"|0b|dgcnyesjxer|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127937; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dgdedndh.info"; content:"|08|dgdedndh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127938; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dgdijhiu.cn"; content:"|08|dgdijhiu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127939; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dgdiqv.cn"; content:"|06|dgdiqv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127940; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dgfezta.ws"; content:"|07|dgfezta|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127941; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dgfvk.org"; content:"|05|dgfvk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127942; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dgiaptmj.info"; content:"|08|dgiaptmj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127943; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dgjgkps.biz"; content:"|07|dgjgkps|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127944; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dgmodf.ws"; content:"|06|dgmodf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127945; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dgmwqcgdljw.net"; content:"|0b|dgmwqcgdljw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127946; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dgqut.net"; content:"|05|dgqut|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127947; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dgqwkehm.ws"; content:"|08|dgqwkehm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127948; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dgrcfoc.ws"; content:"|07|dgrcfoc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127949; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dgrizsxwt.biz"; content:"|09|dgrizsxwt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127950; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dgyvmgbtah.cc"; content:"|0a|dgyvmgbtah|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127951; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dgzbkest.info"; content:"|08|dgzbkest|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127952; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dgzmnsfbk.net"; content:"|09|dgzmnsfbk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127953; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dhbbru.biz"; content:"|06|dhbbru|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127954; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dheyrizjy.cc"; content:"|09|dheyrizjy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127955; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dhfxzitetc.cc"; content:"|0a|dhfxzitetc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127956; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dhklv.com"; content:"|05|dhklv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127957; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dhkwzgbmz.cc"; content:"|09|dhkwzgbmz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127958; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dhljymmhahb.biz"; content:"|0b|dhljymmhahb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127959; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dhpbwrktwux.cc"; content:"|0b|dhpbwrktwux|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127960; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dhrqsdbdd.net"; content:"|09|dhrqsdbdd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127961; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dhrzqajsvxh.ws"; content:"|0b|dhrzqajsvxh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127962; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dhwbzxqh.com"; content:"|08|dhwbzxqh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127963; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dhznofsg.org"; content:"|08|dhznofsg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127964; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dicio.info"; content:"|05|dicio|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127965; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain diczkdzssh.biz"; content:"|0a|diczkdzssh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127966; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain diftnyxev.info"; content:"|09|diftnyxev|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127967; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dihmyunxaz.com"; content:"|0a|dihmyunxaz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127968; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dimsobzulu.com"; content:"|0a|dimsobzulu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127969; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dirbyvdd.ws"; content:"|08|dirbyvdd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127970; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain diwrw.biz"; content:"|05|diwrw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127971; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dixfyswnmhz.biz"; content:"|0b|dixfyswnmhz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127972; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dixyw.info"; content:"|05|dixyw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127973; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain djabl.com"; content:"|05|djabl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127974; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain djaqnp.org"; content:"|06|djaqnp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127975; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain djedo.cn"; content:"|05|djedo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127976; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain djjllqkpuj.ws"; content:"|0a|djjllqkpuj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127977; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain djjvi.info"; content:"|05|djjvi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127978; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain djpisfrikq.biz"; content:"|0a|djpisfrikq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127979; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain djsayhjv.info"; content:"|08|djsayhjv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127980; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain djxwaouwk.org"; content:"|09|djxwaouwk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127981; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain djzulzibs.cn"; content:"|09|djzulzibs|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127982; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dkankfs.biz"; content:"|07|dkankfs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127983; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dkgfinbuld.cc"; content:"|0a|dkgfinbuld|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127984; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dkgluspjxy.info"; content:"|0a|dkgluspjxy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127985; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dkhanpkw.biz"; content:"|08|dkhanpkw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127986; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dkkblaw.cn"; content:"|07|dkkblaw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127987; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dkmwdevkchr.ws"; content:"|0b|dkmwdevkchr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127988; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dkxdwtutub.cn"; content:"|0a|dkxdwtutub|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127989; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dkxvwteb.net"; content:"|08|dkxvwteb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127990; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dlbuet.cc"; content:"|06|dlbuet|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127991; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dlcytpajjr.ws"; content:"|0a|dlcytpajjr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127992; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dliep.net"; content:"|05|dliep|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127993; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dlpct.info"; content:"|05|dlpct|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127994; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dlrfg.org"; content:"|05|dlrfg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127995; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dlsmvxql.net"; content:"|08|dlsmvxql|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127996; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dltjrwp.com"; content:"|07|dltjrwp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127997; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dmdentzvg.cc"; content:"|09|dmdentzvg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127998; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dmeysqcr.com"; content:"|08|dmeysqcr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1127999; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dmfhftovxy.biz"; content:"|0a|dmfhftovxy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128000; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dmglpsf.cn"; content:"|07|dmglpsf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128001; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dmgsn.biz"; content:"|05|dmgsn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128002; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dmkqedir.cn"; content:"|08|dmkqedir|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128003; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dmtmxupfeur.net"; content:"|0b|dmtmxupfeur|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128004; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dmtye.com"; content:"|05|dmtye|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128005; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dmvftgl.ws"; content:"|07|dmvftgl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128006; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dndsqg.biz"; content:"|06|dndsqg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128007; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dnepm.cn"; content:"|05|dnepm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128008; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dniin.org"; content:"|05|dniin|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128009; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dnjkvza.org"; content:"|07|dnjkvza|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128010; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dnjqhfur.com"; content:"|08|dnjqhfur|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128011; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dnkiwhp.cn"; content:"|07|dnkiwhp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128012; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dnpjgeearm.cc"; content:"|0a|dnpjgeearm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128013; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dnpsujbn.com"; content:"|08|dnpsujbn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128014; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dnufangu.com"; content:"|08|dnufangu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128015; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain doauwgl.info"; content:"|07|doauwgl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128016; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dofayzi.ws"; content:"|07|dofayzi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128017; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dogri.net"; content:"|05|dogri|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128018; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain domxrau.ws"; content:"|07|domxrau|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128019; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain doritwbdhn.com"; content:"|0a|doritwbdhn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128020; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dosejey.org"; content:"|07|dosejey|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128021; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain douamzdigf.org"; content:"|0a|douamzdigf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128022; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dpcnfgrwfai.org"; content:"|0b|dpcnfgrwfai|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128023; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dpcrgbmfgy.ws"; content:"|0a|dpcrgbmfgy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128024; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dpcwvak.ws"; content:"|07|dpcwvak|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128025; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dpies.com"; content:"|05|dpies|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128026; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dpjvgkgffa.cn"; content:"|0a|dpjvgkgffa|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128027; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dplbrjzf.biz"; content:"|08|dplbrjzf|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128028; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dploqubg.info"; content:"|08|dploqubg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128029; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dpmiil.ws"; content:"|06|dpmiil|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128030; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dpmqm.com"; content:"|05|dpmqm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128031; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dpmwr.cc"; content:"|05|dpmwr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128032; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dpuhnoqi.com"; content:"|08|dpuhnoqi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128033; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dpvgefth.biz"; content:"|08|dpvgefth|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128034; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dpvqoaef.ws"; content:"|08|dpvqoaef|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128035; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dpxauholm.net"; content:"|09|dpxauholm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128036; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dpxguvmfzr.org"; content:"|0a|dpxguvmfzr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128037; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dpyrim.com"; content:"|06|dpyrim|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128038; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dpzbdq.com"; content:"|06|dpzbdq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128039; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dpzbtccgswk.net"; content:"|0b|dpzbtccgswk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128040; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dqaep.org"; content:"|05|dqaep|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128041; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dqcwkgo.com"; content:"|07|dqcwkgo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128042; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dqcxzriyap.org"; content:"|0a|dqcxzriyap|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128043; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dqdxk.com"; content:"|05|dqdxk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128044; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dqentt.info"; content:"|06|dqentt|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128045; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dqnothvocj.net"; content:"|0a|dqnothvocj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128046; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dqnxltlia.cn"; content:"|09|dqnxltlia|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128047; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dqovyv.org"; content:"|06|dqovyv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128048; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dqstfp.cc"; content:"|06|dqstfp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128049; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dqtczxafp.ws"; content:"|09|dqtczxafp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128050; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dqvemmjsz.org"; content:"|09|dqvemmjsz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128051; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dqvtjajj.org"; content:"|08|dqvtjajj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128052; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dqwwtaywbhi.info"; content:"|0b|dqwwtaywbhi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128053; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dqxfgimcrbg.info"; content:"|0b|dqxfgimcrbg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128054; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain draitvi.cn"; content:"|07|draitvi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128055; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain drenhlkoqo.net"; content:"|0a|drenhlkoqo|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128056; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain drfeed.cc"; content:"|06|drfeed|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128057; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain drfxqjcmb.com"; content:"|09|drfxqjcmb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128058; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain drhimkgcklo.cn"; content:"|0b|drhimkgcklo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128059; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain drineksv.ws"; content:"|08|drineksv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128060; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain drjvgmfg.biz"; content:"|08|drjvgmfg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128061; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain drjwika.biz"; content:"|07|drjwika|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128062; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain drovztn.cn"; content:"|07|drovztn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128063; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain drpmvwyl.com"; content:"|08|drpmvwyl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128064; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain drspujt.info"; content:"|07|drspujt|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128065; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain drtfocskxq.com"; content:"|0a|drtfocskxq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128066; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dscugf.ws"; content:"|06|dscugf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128067; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dskprnd.info"; content:"|07|dskprnd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128068; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dskqzdfz.cc"; content:"|08|dskqzdfz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128069; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dsnte.cn"; content:"|05|dsnte|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128070; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dsonuguc.info"; content:"|08|dsonuguc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128071; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dsveywic.net"; content:"|08|dsveywic|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128072; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dsxlhkotjn.net"; content:"|0a|dsxlhkotjn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128073; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dszozhogy.cn"; content:"|09|dszozhogy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128074; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dtfrxazap.com"; content:"|09|dtfrxazap|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128075; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dtlncxfy.cc"; content:"|08|dtlncxfy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128076; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dtlufngow.cc"; content:"|09|dtlufngow|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128077; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dtnahvxy.cc"; content:"|08|dtnahvxy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128078; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dtolhzzu.cc"; content:"|08|dtolhzzu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128079; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dtpsrb.cc"; content:"|06|dtpsrb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128080; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dtpvw.org"; content:"|05|dtpvw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128081; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dtupuwa.info"; content:"|07|dtupuwa|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128082; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dtutfnw.info"; content:"|07|dtutfnw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128083; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dubxvdrbns.cn"; content:"|0a|dubxvdrbns|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128084; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dudffpbkz.cc"; content:"|09|dudffpbkz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128085; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dudwolwxopr.ws"; content:"|0b|dudwolwxopr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128086; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dugpxobq.cc"; content:"|08|dugpxobq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128087; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dujafnyxs.biz"; content:"|09|dujafnyxs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128088; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dujskwcn.info"; content:"|08|dujskwcn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128089; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dupqgxxvgc.org"; content:"|0a|dupqgxxvgc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128090; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dupslopgh.cn"; content:"|09|dupslopgh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128091; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain durvytbeuio.info"; content:"|0b|durvytbeuio|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128092; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain duvjraro.com"; content:"|08|duvjraro|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128093; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain duwcxujb.net"; content:"|08|duwcxujb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128094; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain duwwcuev.com"; content:"|08|duwwcuev|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128095; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain duzgtgqza.cc"; content:"|09|duzgtgqza|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128096; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dvaqkzfp.info"; content:"|08|dvaqkzfp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128097; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dvckjzlo.biz"; content:"|08|dvckjzlo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128098; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dveksn.org"; content:"|06|dveksn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128099; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dvikggki.cn"; content:"|08|dvikggki|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128100; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dvkyoywyepa.net"; content:"|0b|dvkyoywyepa|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128101; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dvmcibmur.info"; content:"|09|dvmcibmur|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128102; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dvmjuelyt.net"; content:"|09|dvmjuelyt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128103; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dvmpzwp.ws"; content:"|07|dvmpzwp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128104; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dvmyaskb.org"; content:"|08|dvmyaskb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128105; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dvrcyqnpklu.cc"; content:"|0b|dvrcyqnpklu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128106; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dvrpczbu.biz"; content:"|08|dvrpczbu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128107; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dvtrtcrzul.net"; content:"|0a|dvtrtcrzul|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128108; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dvwdypxp.biz"; content:"|08|dvwdypxp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128109; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dwcnxzru.net"; content:"|08|dwcnxzru|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128110; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dwitpxsrgni.cn"; content:"|0b|dwitpxsrgni|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128111; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dwlaijvr.com"; content:"|08|dwlaijvr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128112; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dwljrbjjw.com"; content:"|09|dwljrbjjw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128113; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dwmles.info"; content:"|06|dwmles|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128114; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dwmvelw.com"; content:"|07|dwmvelw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128115; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dwmxvpn.org"; content:"|07|dwmxvpn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128116; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dwnabrhzx.info"; content:"|09|dwnabrhzx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128117; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dwpwxaq.ws"; content:"|07|dwpwxaq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128118; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dwquks.org"; content:"|06|dwquks|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128119; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dwrdnt.cn"; content:"|06|dwrdnt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128120; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dwrnlkyn.cc"; content:"|08|dwrnlkyn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128121; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dwvofs.info"; content:"|06|dwvofs|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128122; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dwwbib.info"; content:"|06|dwwbib|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128123; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dxgmp.info"; content:"|05|dxgmp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128124; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dxhqp.biz"; content:"|05|dxhqp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128125; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dxiywpau.biz"; content:"|08|dxiywpau|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128126; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dxjsxqmh.ws"; content:"|08|dxjsxqmh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128127; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dxlouhuvoi.biz"; content:"|0a|dxlouhuvoi|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128128; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dxnzqgyp.cn"; content:"|08|dxnzqgyp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128129; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dxofrnjyvy.ws"; content:"|0a|dxofrnjyvy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128130; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dxolwykl.ws"; content:"|08|dxolwykl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128131; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dxtzrhiaj.ws"; content:"|09|dxtzrhiaj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128132; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dxubjjce.ws"; content:"|08|dxubjjce|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128133; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dxxtguww.cn"; content:"|08|dxxtguww|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128134; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dxzcf.info"; content:"|05|dxzcf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128135; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dydgtq.cn"; content:"|06|dydgtq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128136; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dydmrmi.ws"; content:"|07|dydmrmi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128137; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dygsgcjj.info"; content:"|08|dygsgcjj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128138; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dyhaji.org"; content:"|06|dyhaji|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128139; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dyitgyw.cn"; content:"|07|dyitgyw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128140; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dyiwpuasz.info"; content:"|09|dyiwpuasz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128141; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dyjhpn.cc"; content:"|06|dyjhpn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128142; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dykhx.info"; content:"|05|dykhx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128143; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dyoouqvd.com"; content:"|08|dyoouqvd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128144; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dypbhpx.ws"; content:"|07|dypbhpx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128145; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dysnep.cc"; content:"|06|dysnep|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128146; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dywmwe.ws"; content:"|06|dywmwe|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128147; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dyxjmxztc.info"; content:"|09|dyxjmxztc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128148; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dzgxrssz.org"; content:"|08|dzgxrssz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128149; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dzixww.biz"; content:"|06|dzixww|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128150; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dzjegfehru.net"; content:"|0a|dzjegfehru|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128151; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dzpsu.biz"; content:"|05|dzpsu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128152; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dzqnps.biz"; content:"|06|dzqnps|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128153; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dzvka.cc"; content:"|05|dzvka|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128154; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dzwwjielewg.cn"; content:"|0b|dzwwjielewg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128155; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain dzzadxgr.info"; content:"|08|dzzadxgr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128156; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eaagp.com"; content:"|05|eaagp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128157; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eafwpiaw.info"; content:"|08|eafwpiaw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128158; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eahvrdpgmgq.biz"; content:"|0b|eahvrdpgmgq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128159; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ealdor.org"; content:"|06|ealdor|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128160; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eappcljq.com"; content:"|08|eappcljq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128161; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eaqrujq.info"; content:"|07|eaqrujq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128162; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eaqzjv.com"; content:"|06|eaqzjv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128163; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain earlwwms.cc"; content:"|08|earlwwms|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128164; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eartlsihbo.cc"; content:"|0a|eartlsihbo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128165; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain earxt.cc"; content:"|05|earxt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128166; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eawzzxbg.cn"; content:"|08|eawzzxbg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128167; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eayilito.biz"; content:"|08|eayilito|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128168; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ebbuuwiyc.com"; content:"|09|ebbuuwiyc|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128169; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ebetaeo.ws"; content:"|07|ebetaeo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128170; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eblxvaso.biz"; content:"|08|eblxvaso|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128171; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ebneiezepm.info"; content:"|0a|ebneiezepm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128172; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ebocpvzeh.info"; content:"|09|ebocpvzeh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128173; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ebphfxxzp.com"; content:"|09|ebphfxxzp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128174; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ebtjondleqw.info"; content:"|0b|ebtjondleqw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128175; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ebtxxa.info"; content:"|06|ebtxxa|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128176; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ebyxxt.ws"; content:"|06|ebyxxt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128177; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ebzumivrs.net"; content:"|09|ebzumivrs|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128178; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ecaul.cn"; content:"|05|ecaul|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128179; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ecgojdrezfs.com"; content:"|0b|ecgojdrezfs|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128180; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ecjkqnas.com"; content:"|08|ecjkqnas|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128181; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eclcunxqt.net"; content:"|09|eclcunxqt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128182; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ecmxgsce.com"; content:"|08|ecmxgsce|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128183; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ecpsmjco.cn"; content:"|08|ecpsmjco|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128184; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ecrzfrhdcf.info"; content:"|0a|ecrzfrhdcf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128185; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain edagts.cn"; content:"|06|edagts|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128186; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain edesvp.ws"; content:"|06|edesvp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128187; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain edhtppnig.com"; content:"|09|edhtppnig|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128188; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain edijzgqpsgf.cn"; content:"|0b|edijzgqpsgf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128189; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain edistcvd.cn"; content:"|08|edistcvd|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128190; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain edjtst.com"; content:"|06|edjtst|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128191; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain edlkankacz.cn"; content:"|0a|edlkankacz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128192; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain edltu.net"; content:"|05|edltu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128193; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain edmgotp.info"; content:"|07|edmgotp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128194; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain edoucaxispy.cc"; content:"|0b|edoucaxispy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128195; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain edqtbltiq.info"; content:"|09|edqtbltiq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128196; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain edsnqvfb.cn"; content:"|08|edsnqvfb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128197; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain edxbacod.net"; content:"|08|edxbacod|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128198; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain edzsnhvseyz.org"; content:"|0b|edzsnhvseyz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128199; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eehpoym.ws"; content:"|07|eehpoym|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128200; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eejrtzrg.com"; content:"|08|eejrtzrg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128201; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eeokupkkv.info"; content:"|09|eeokupkkv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128202; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eeulxrk.biz"; content:"|07|eeulxrk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128203; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eexlifooo.com"; content:"|09|eexlifooo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128204; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eeyssslc.info"; content:"|08|eeyssslc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128205; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain efczmc.cc"; content:"|06|efczmc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128206; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain efenajn.cn"; content:"|07|efenajn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128207; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eferktphs.org"; content:"|09|eferktphs|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128208; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain efgduexu.biz"; content:"|08|efgduexu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128209; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain efglcyvggh.ws"; content:"|0a|efglcyvggh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128210; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain efhxcdaj.com"; content:"|08|efhxcdaj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128211; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain efiwyb.cc"; content:"|06|efiwyb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128212; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain efjyojsuqe.cn"; content:"|0a|efjyojsuqe|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128213; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain efkqpawrpy.com"; content:"|0a|efkqpawrpy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128214; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eflcewpc.cn"; content:"|08|eflcewpc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128215; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eflgeeay.ws"; content:"|08|eflgeeay|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128216; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eflqgu.biz"; content:"|06|eflqgu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128217; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain efoln.biz"; content:"|05|efoln|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128218; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain efoovbgr.biz"; content:"|08|efoovbgr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128219; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain efpznxxsa.com"; content:"|09|efpznxxsa|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128220; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain efqdv.org"; content:"|05|efqdv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128221; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain efsxbnyc.biz"; content:"|08|efsxbnyc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128222; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain efzvssfpk.cc"; content:"|09|efzvssfpk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128223; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain egbqadtrv.org"; content:"|09|egbqadtrv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128224; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain egcudvhgf.info"; content:"|09|egcudvhgf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128225; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain egdspjpfl.info"; content:"|09|egdspjpfl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128226; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eggwkmzp.biz"; content:"|08|eggwkmzp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128227; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain egiofvxk.biz"; content:"|08|egiofvxk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128228; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain egtwcsfqkyw.org"; content:"|0b|egtwcsfqkyw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128229; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain egukwpexppg.biz"; content:"|0b|egukwpexppg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128230; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain egzfxjjjtf.ws"; content:"|0a|egzfxjjjtf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128231; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain egzvdrp.net"; content:"|07|egzvdrp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128232; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain egzyupcv.cn"; content:"|08|egzyupcv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128233; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ehbeszwe.com"; content:"|08|ehbeszwe|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128234; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ehhoxk.cn"; content:"|06|ehhoxk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128235; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ehlvmrqzi.biz"; content:"|09|ehlvmrqzi|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128236; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ehuaolajj.ws"; content:"|09|ehuaolajj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128237; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ehwllke.cn"; content:"|07|ehwllke|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128238; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ehxjcvfidv.cc"; content:"|0a|ehxjcvfidv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128239; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eibzfk.org"; content:"|06|eibzfk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128240; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eifxezizxr.biz"; content:"|0a|eifxezizxr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128241; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eikansq.biz"; content:"|07|eikansq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128242; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eilaxjg.info"; content:"|07|eilaxjg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128243; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eimcckjs.net"; content:"|08|eimcckjs|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128244; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain einaznafga.org"; content:"|0a|einaznafga|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128245; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eiprau.com"; content:"|06|eiprau|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128246; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eisilpv.cc"; content:"|07|eisilpv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128247; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eivshxfc.net"; content:"|08|eivshxfc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128248; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eiyqa.net"; content:"|05|eiyqa|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128249; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ejdnhsiv.org"; content:"|08|ejdnhsiv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128250; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ejejyz.cn"; content:"|06|ejejyz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128251; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ejhgbrcnpm.biz"; content:"|0a|ejhgbrcnpm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128252; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ejjeretjii.com"; content:"|0a|ejjeretjii|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128253; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ejkvud.com"; content:"|06|ejkvud|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128254; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ejkwkosp.cc"; content:"|08|ejkwkosp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128255; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ejrcg.cc"; content:"|05|ejrcg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128256; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ejrpafnv.net"; content:"|08|ejrpafnv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128257; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ejyqmbhoi.ws"; content:"|09|ejyqmbhoi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128258; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ejysgnqeze.info"; content:"|0a|ejysgnqeze|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128259; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ekbzzrru.info"; content:"|08|ekbzzrru|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128260; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ekgcuaqx.biz"; content:"|08|ekgcuaqx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128261; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ekiiuavn.com"; content:"|08|ekiiuavn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128262; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ekjnvxtf.net"; content:"|08|ekjnvxtf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128263; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ekldfkakeil.cn"; content:"|0b|ekldfkakeil|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128264; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eknhcde.cc"; content:"|07|eknhcde|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128265; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ekocpfstso.cc"; content:"|0a|ekocpfstso|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128266; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ekqqxmkygwv.org"; content:"|0b|ekqqxmkygwv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128267; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ektvdz.org"; content:"|06|ektvdz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128268; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ekviizvdof.net"; content:"|0a|ekviizvdof|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128269; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ekxltmqrky.ws"; content:"|0a|ekxltmqrky|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128270; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain elbcqd.net"; content:"|06|elbcqd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128271; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain elbeutnj.net"; content:"|08|elbeutnj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128272; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eldbiaqa.org"; content:"|08|eldbiaqa|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128273; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eldsbh.cc"; content:"|06|eldsbh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128274; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eleamf.org"; content:"|06|eleamf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128275; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eligidtg.biz"; content:"|08|eligidtg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128276; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eljnrvvkn.biz"; content:"|09|eljnrvvkn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128277; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain elkfe.net"; content:"|05|elkfe|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128278; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ellvccimjba.cc"; content:"|0b|ellvccimjba|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128279; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ellvnv.ws"; content:"|06|ellvnv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128280; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain elncpwxyy.cn"; content:"|09|elncpwxyy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128281; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain elqdcpl.com"; content:"|07|elqdcpl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128282; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eltiufo.biz"; content:"|07|eltiufo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128283; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain elxpmemf.org"; content:"|08|elxpmemf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128284; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain emfhcurlg.info"; content:"|09|emfhcurlg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128285; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain emivbbff.com"; content:"|08|emivbbff|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128286; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain emsfoxhhdt.cc"; content:"|0a|emsfoxhhdt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128287; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain emthrek.cn"; content:"|07|emthrek|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128288; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain emwiutgowmj.cc"; content:"|0b|emwiutgowmj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128289; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain emxjo.info"; content:"|05|emxjo|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128290; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain emzvvgaxd.net"; content:"|09|emzvvgaxd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128291; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain enbjfkkbyxt.cc"; content:"|0b|enbjfkkbyxt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128292; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain enbzu.biz"; content:"|05|enbzu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128293; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain endiu.org"; content:"|05|endiu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128294; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain endrdhijx.cc"; content:"|09|endrdhijx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128295; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eneto.org"; content:"|05|eneto|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128296; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain engfnydmq.cc"; content:"|09|engfnydmq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128297; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain enlbalyp.info"; content:"|08|enlbalyp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128298; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain enmdsqmmtn.org"; content:"|0a|enmdsqmmtn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128299; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain enogzlzxd.org"; content:"|09|enogzlzxd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128300; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain enpqjqbu.com"; content:"|08|enpqjqbu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128301; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain enrsmi.cc"; content:"|06|enrsmi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128302; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain enrxsxtty.cc"; content:"|09|enrxsxtty|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128303; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ensny.ws"; content:"|05|ensny|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128304; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain entlq.org"; content:"|05|entlq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128305; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain enwznydaxv.com"; content:"|0a|enwznydaxv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128306; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eodmjysgqj.biz"; content:"|0a|eodmjysgqj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128307; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eoelvvflooz.biz"; content:"|0b|eoelvvflooz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128308; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eogpjnqs.ws"; content:"|08|eogpjnqs|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128309; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eogqo.org"; content:"|05|eogqo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128310; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eohlchnfoha.net"; content:"|0b|eohlchnfoha|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128311; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eoiep.net"; content:"|05|eoiep|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128312; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eoixsjeihsm.cc"; content:"|0b|eoixsjeihsm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128313; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eoixwdrf.net"; content:"|08|eoixwdrf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128314; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eojygumsa.com"; content:"|09|eojygumsa|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128315; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eokzmrisbw.cc"; content:"|0a|eokzmrisbw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128316; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eopkn.info"; content:"|05|eopkn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128317; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eorgnbugv.org"; content:"|09|eorgnbugv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128318; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eorpivy.info"; content:"|07|eorpivy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128319; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eoruaav.info"; content:"|07|eoruaav|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128320; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eowevoo.info"; content:"|07|eowevoo|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128321; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eozbpjuavh.org"; content:"|0a|eozbpjuavh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128322; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain epcxalbe.org"; content:"|08|epcxalbe|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128323; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain epdccupo.cc"; content:"|08|epdccupo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128324; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain epddc.biz"; content:"|05|epddc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128325; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain epghxnzcayb.com"; content:"|0b|epghxnzcayb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128326; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eponubcxi.ws"; content:"|09|eponubcxi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128327; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain epvpk.ws"; content:"|05|epvpk|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128328; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain epwkqaob.com"; content:"|08|epwkqaob|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128329; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain epwsbtes.net"; content:"|08|epwsbtes|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128330; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain epzcihpcpeg.cn"; content:"|0b|epzcihpcpeg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128331; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eqbuzdnv.cn"; content:"|08|eqbuzdnv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128332; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eqjbgwxah.org"; content:"|09|eqjbgwxah|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128333; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eqjekjexswb.cn"; content:"|0b|eqjekjexswb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128334; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eqmmhb.biz"; content:"|06|eqmmhb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128335; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eqvyc.cc"; content:"|05|eqvyc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128336; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eqwauheoyhv.biz"; content:"|0b|eqwauheoyhv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128337; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain erboymlxlcw.net"; content:"|0b|erboymlxlcw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128338; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain erhtmnyxw.ws"; content:"|09|erhtmnyxw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128339; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain erjanqsuwri.net"; content:"|0b|erjanqsuwri|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128340; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ermujhvqpk.info"; content:"|0a|ermujhvqpk|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128341; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain erpbtabj.ws"; content:"|08|erpbtabj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128342; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain erpdmffu.info"; content:"|08|erpdmffu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128343; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain erqlyllq.cc"; content:"|08|erqlyllq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128344; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ersbgkldab.cc"; content:"|0a|ersbgkldab|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128345; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain erujsjwdxah.cc"; content:"|0b|erujsjwdxah|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128346; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain erwzqexkl.net"; content:"|09|erwzqexkl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128347; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain erycpe.ws"; content:"|06|erycpe|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128348; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain escur.cc"; content:"|05|escur|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128349; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain esebdu.ws"; content:"|06|esebdu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128350; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eshplxob.org"; content:"|08|eshplxob|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128351; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eshsjmvlri.cn"; content:"|0a|eshsjmvlri|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128352; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain esiess.cn"; content:"|06|esiess|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128353; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eskgrvtw.cc"; content:"|08|eskgrvtw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128354; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eslgxrzolyu.net"; content:"|0b|eslgxrzolyu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128355; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eslyuba.org"; content:"|07|eslyuba|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128356; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain esollhnsg.cc"; content:"|09|esollhnsg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128357; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain espfjcrwmx.cn"; content:"|0a|espfjcrwmx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128358; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain esppshar.cn"; content:"|08|esppshar|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128359; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain esslegoqsd.com"; content:"|0a|esslegoqsd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128360; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain estbwdniqbs.net"; content:"|0b|estbwdniqbs|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128361; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain esumyy.biz"; content:"|06|esumyy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128362; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain esutqtvj.com"; content:"|08|esutqtvj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128363; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eswmmntu.cn"; content:"|08|eswmmntu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128364; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eswrimgr.ws"; content:"|08|eswrimgr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128365; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain esykjec.cc"; content:"|07|esykjec|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128366; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain etcssegbnvf.cn"; content:"|0b|etcssegbnvf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128367; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain etdetktoxgd.org"; content:"|0b|etdetktoxgd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128368; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain etelbhwwt.com"; content:"|09|etelbhwwt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128369; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eteldpxce.org"; content:"|09|eteldpxce|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128370; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain etfma.biz"; content:"|05|etfma|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128371; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain etiue.cn"; content:"|05|etiue|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128372; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain etotkqio.ws"; content:"|08|etotkqio|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128373; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain etpbnjhlf.org"; content:"|09|etpbnjhlf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128374; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain etrkgjsfwnc.org"; content:"|0b|etrkgjsfwnc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128375; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain etunw.com"; content:"|05|etunw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128376; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain euaflifduyc.net"; content:"|0b|euaflifduyc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128377; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eubimxqhowo.biz"; content:"|0b|eubimxqhowo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128378; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eucbqyvzmhu.org"; content:"|0b|eucbqyvzmhu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128379; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain euillfblzb.org"; content:"|0a|euillfblzb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128380; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eunwkg.ws"; content:"|06|eunwkg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128381; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain euqge.ws"; content:"|05|euqge|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128382; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain euqzgfm.net"; content:"|07|euqzgfm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128383; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eutssdv.biz"; content:"|07|eutssdv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128384; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain euuazgzb.com"; content:"|08|euuazgzb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128385; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain euvbtn.org"; content:"|06|euvbtn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128386; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain evddpm.cn"; content:"|06|evddpm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128387; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain evezwmwf.cc"; content:"|08|evezwmwf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128388; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain evfelcrrvyq.biz"; content:"|0b|evfelcrrvyq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128389; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain evhwipqkzh.cn"; content:"|0a|evhwipqkzh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128390; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain evjyoqob.ws"; content:"|08|evjyoqob|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128391; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain evnftyus.com"; content:"|08|evnftyus|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128392; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain evptchlqcfx.net"; content:"|0b|evptchlqcfx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128393; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain evrovq.ws"; content:"|06|evrovq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128394; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain evuybuexuw.info"; content:"|0a|evuybuexuw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128395; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ewcygdsezo.cn"; content:"|0a|ewcygdsezo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128396; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ewfdzzidwp.info"; content:"|0a|ewfdzzidwp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128397; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ewkedkodepr.org"; content:"|0b|ewkedkodepr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128398; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ewrrosjaeo.biz"; content:"|0a|ewrrosjaeo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128399; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ewunbboqjs.cc"; content:"|0a|ewunbboqjs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128400; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ewzzkjit.cc"; content:"|08|ewzzkjit|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128401; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain exclnfcv.org"; content:"|08|exclnfcv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128402; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain exganjex.org"; content:"|08|exganjex|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128403; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain exjerwi.info"; content:"|07|exjerwi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128404; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain exkebigz.cn"; content:"|08|exkebigz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128405; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain exkwtq.org"; content:"|06|exkwtq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128406; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain exngczg.biz"; content:"|07|exngczg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128407; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain exrphdccltk.cn"; content:"|0b|exrphdccltk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128408; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain exsqm.ws"; content:"|05|exsqm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128409; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain exuqrnur.info"; content:"|08|exuqrnur|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128410; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain exvgvv.ws"; content:"|06|exvgvv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128411; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain exwub.com"; content:"|05|exwub|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128412; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain exxnnas.org"; content:"|07|exxnnas|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128413; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain exyzcrts.com"; content:"|08|exyzcrts|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128414; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eydhiuqvjk.info"; content:"|0a|eydhiuqvjk|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128415; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eyeffipe.biz"; content:"|08|eyeffipe|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128416; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eyfepuy.net"; content:"|07|eyfepuy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128417; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eyhqabiiril.ws"; content:"|0b|eyhqabiiril|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128418; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eyhxig.cc"; content:"|06|eyhxig|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128419; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eymcq.net"; content:"|05|eymcq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128420; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eyofbcim.net"; content:"|08|eyofbcim|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128421; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eyremptj.net"; content:"|08|eyremptj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128422; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eyuqrqss.info"; content:"|08|eyuqrqss|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128423; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eyyey.ws"; content:"|05|eyyey|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128424; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ezdjyshzvr.com"; content:"|0a|ezdjyshzvr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128425; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ezlcvdd.biz"; content:"|07|ezlcvdd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128426; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ezmpxkgq.cc"; content:"|08|ezmpxkgq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128427; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ezowtdkl.cn"; content:"|08|ezowtdkl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128428; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ezpeztav.com"; content:"|08|ezpeztav|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128429; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ezsfvc.com"; content:"|06|ezsfvc|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128430; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain eztdsxh.info"; content:"|07|eztdsxh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128431; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ezxrkmqtf.biz"; content:"|09|ezxrkmqtf|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128432; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ezyrq.com"; content:"|05|ezyrq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128433; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ezznrk.biz"; content:"|06|ezznrk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128434; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ezzueuzssy.org"; content:"|0a|ezzueuzssy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128435; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain faapames.com"; content:"|08|faapames|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128436; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fabzakwz.net"; content:"|08|fabzakwz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128437; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fadeie.net"; content:"|06|fadeie|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128438; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain faekgbji.info"; content:"|08|faekgbji|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128439; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain faezuisajd.cc"; content:"|0a|faezuisajd|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128440; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fagmdmrz.net"; content:"|08|fagmdmrz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128441; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain faineadnehy.cn"; content:"|0b|faineadnehy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128442; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fanbofa.net"; content:"|07|fanbofa|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128443; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fanqha.net"; content:"|06|fanqha|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128444; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain faosoqe.com"; content:"|07|faosoqe|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128445; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain faprflntms.org"; content:"|0a|faprflntms|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128446; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fauzmpoh.net"; content:"|08|fauzmpoh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128447; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fbaluu.biz"; content:"|06|fbaluu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128448; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fbddsjiamuk.com"; content:"|0b|fbddsjiamuk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128449; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fbdqqce.biz"; content:"|07|fbdqqce|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128450; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fbhqyjtvj.biz"; content:"|09|fbhqyjtvj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128451; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fbihkota.cc"; content:"|08|fbihkota|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128452; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fblqc.net"; content:"|05|fblqc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128453; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fblwlgrnjjv.ws"; content:"|0b|fblwlgrnjjv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128454; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fbnimxodunc.cn"; content:"|0b|fbnimxodunc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128455; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fbyjvlwxyd.info"; content:"|0a|fbyjvlwxyd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128456; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fbzhayltupe.cc"; content:"|0b|fbzhayltupe|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128457; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fbzmowcs.ws"; content:"|08|fbzmowcs|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128458; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fcbueah.ws"; content:"|07|fcbueah|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128459; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fcdachwflzy.ws"; content:"|0b|fcdachwflzy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128460; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fcmsatik.net"; content:"|08|fcmsatik|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128461; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fcolzipi.ws"; content:"|08|fcolzipi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128462; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fcpbqmpfoyq.cn"; content:"|0b|fcpbqmpfoyq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128463; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fctdiqcgwb.ws"; content:"|0a|fctdiqcgwb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128464; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fctvmw.net"; content:"|06|fctvmw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128465; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fcuvh.biz"; content:"|05|fcuvh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128466; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fcxftayfp.ws"; content:"|09|fcxftayfp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128467; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fdchmgz.ws"; content:"|07|fdchmgz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128468; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fddpbfxyye.info"; content:"|0a|fddpbfxyye|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128469; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fddrxux.ws"; content:"|07|fddrxux|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128470; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fdftlwv.com"; content:"|07|fdftlwv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128471; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fdjrkoao.ws"; content:"|08|fdjrkoao|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128472; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fdkzqshlc.net"; content:"|09|fdkzqshlc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128473; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fdopslagux.com"; content:"|0a|fdopslagux|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128474; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fdrcfmmf.cn"; content:"|08|fdrcfmmf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128475; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fdvlwxoan.cn"; content:"|09|fdvlwxoan|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128476; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fdxtmsibkg.org"; content:"|0a|fdxtmsibkg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128477; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fdyhrogr.org"; content:"|08|fdyhrogr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128478; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fdyoqme.cn"; content:"|07|fdyoqme|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128479; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fdzjwbhgxii.ws"; content:"|0b|fdzjwbhgxii|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128480; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fdzonqrx.com"; content:"|08|fdzonqrx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128481; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain feagexlsrs.cc"; content:"|0a|feagexlsrs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128482; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain feahuytd.org"; content:"|08|feahuytd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128483; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain feamskduc.org"; content:"|09|feamskduc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128484; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain feborned.org"; content:"|08|feborned|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128485; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fecbhynd.info"; content:"|08|fecbhynd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128486; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fecmb.biz"; content:"|05|fecmb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128487; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fefshrvghtk.net"; content:"|0b|fefshrvghtk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128488; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain feolvfh.biz"; content:"|07|feolvfh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128489; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ferjmlsdwi.biz"; content:"|0a|ferjmlsdwi|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128490; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain feshsqumn.info"; content:"|09|feshsqumn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128491; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fevfjnzgefs.cc"; content:"|0b|fevfjnzgefs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128492; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fevjzffaebu.org"; content:"|0b|fevjzffaebu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128493; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain feyyf.info"; content:"|05|feyyf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128494; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ffcbc.biz"; content:"|05|ffcbc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128495; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ffcwvlgamx.cn"; content:"|0a|ffcwvlgamx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128496; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ffglhuufcl.org"; content:"|0a|ffglhuufcl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128497; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ffhms.cn"; content:"|05|ffhms|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128498; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ffhnifsb.cn"; content:"|08|ffhnifsb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128499; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ffjpuzmbgk.org"; content:"|0a|ffjpuzmbgk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128500; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ffqethld.org"; content:"|08|ffqethld|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128501; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ffxuf.net"; content:"|05|ffxuf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128502; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ffzcboof.com"; content:"|08|ffzcboof|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128503; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ffzxnojbfeo.biz"; content:"|0b|ffzxnojbfeo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128504; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fgassu.org"; content:"|06|fgassu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128505; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fgazzafmydl.cc"; content:"|0b|fgazzafmydl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128506; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fgdiupvv.cn"; content:"|08|fgdiupvv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128507; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fgikqowcruv.biz"; content:"|0b|fgikqowcruv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128508; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fgjispkn.info"; content:"|08|fgjispkn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128509; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fgkxiz.ws"; content:"|06|fgkxiz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128510; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fgqruc.com"; content:"|06|fgqruc|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128511; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fhfmsgixznq.net"; content:"|0b|fhfmsgixznq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128512; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fhlctjmo.com"; content:"|08|fhlctjmo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128513; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fholb.ws"; content:"|05|fholb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128514; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fhssgzqo.ws"; content:"|08|fhssgzqo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128515; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fhsstswy.com"; content:"|08|fhsstswy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128516; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fhtvnvwr.cc"; content:"|08|fhtvnvwr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128517; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fhvseyjxgyd.biz"; content:"|0b|fhvseyjxgyd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128518; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fhxfo.com"; content:"|05|fhxfo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128519; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fibdelhxw.cn"; content:"|09|fibdelhxw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128520; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fibmkcfrt.cc"; content:"|09|fibmkcfrt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128521; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ficxqhr.biz"; content:"|07|ficxqhr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128522; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fidhhjho.com"; content:"|08|fidhhjho|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128523; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain figgq.info"; content:"|05|figgq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128524; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fingwr.biz"; content:"|06|fingwr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128525; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fisggm.com"; content:"|06|fisggm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128526; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fiskbau.biz"; content:"|07|fiskbau|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128527; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fitwghtohos.cc"; content:"|0b|fitwghtohos|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128528; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fiulu.net"; content:"|05|fiulu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128529; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fiwaoora.biz"; content:"|08|fiwaoora|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128530; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fiwwgjtpzqs.biz"; content:"|0b|fiwwgjtpzqs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128531; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fiwxvx.org"; content:"|06|fiwxvx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128532; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fjbeehamlkn.ws"; content:"|0b|fjbeehamlkn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128533; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fjfaaiu.cc"; content:"|07|fjfaaiu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128534; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fjfdymmeelh.net"; content:"|0b|fjfdymmeelh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128535; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fjggkekmf.com"; content:"|09|fjggkekmf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128536; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fjivvjxomd.net"; content:"|0a|fjivvjxomd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128537; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fjjnu.com"; content:"|05|fjjnu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128538; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fjnagfxyyd.org"; content:"|0a|fjnagfxyyd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128539; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fjnqay.cc"; content:"|06|fjnqay|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128540; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fjojaqjpal.net"; content:"|0a|fjojaqjpal|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128541; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fjpvduuytn.net"; content:"|0a|fjpvduuytn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128542; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fjtyeszlwt.org"; content:"|0a|fjtyeszlwt|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128543; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fjvoiyhmwv.org"; content:"|0a|fjvoiyhmwv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128544; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fjwbg.info"; content:"|05|fjwbg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128545; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fjymrjejshu.cn"; content:"|0b|fjymrjejshu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128546; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fkeqemstlpz.cn"; content:"|0b|fkeqemstlpz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128547; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fkgonzvva.cc"; content:"|09|fkgonzvva|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128548; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fkhnoc.org"; content:"|06|fkhnoc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128549; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fkhsxgv.org"; content:"|07|fkhsxgv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128550; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fkjmsedy.cc"; content:"|08|fkjmsedy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128551; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fklqtolcx.net"; content:"|09|fklqtolcx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128552; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fkmkqgjtx.info"; content:"|09|fkmkqgjtx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128553; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fksar.org"; content:"|05|fksar|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128554; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fkskyuwk.net"; content:"|08|fkskyuwk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128555; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fksyx.cc"; content:"|05|fksyx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128556; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fkvhaijv.ws"; content:"|08|fkvhaijv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128557; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fkvoqh.net"; content:"|06|fkvoqh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128558; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fkwwjv.biz"; content:"|06|fkwwjv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128559; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain flajwrxyv.com"; content:"|09|flajwrxyv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128560; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain flanytmkyok.ws"; content:"|0b|flanytmkyok|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128561; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain flbcgigc.biz"; content:"|08|flbcgigc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128562; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain flcsn.org"; content:"|05|flcsn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128563; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain flehmqcayh.org"; content:"|0a|flehmqcayh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128564; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain flfebt.info"; content:"|06|flfebt|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128565; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain flglmiearxs.biz"; content:"|0b|flglmiearxs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128566; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fliykkar.biz"; content:"|08|fliykkar|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128567; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain flkikcd.net"; content:"|07|flkikcd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128568; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain flkmbvbvhb.biz"; content:"|0a|flkmbvbvhb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128569; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain flnrzruu.cn"; content:"|08|flnrzruu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128570; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain flnwod.cn"; content:"|06|flnwod|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128571; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain flpxdmxwf.net"; content:"|09|flpxdmxwf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128572; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain flwbsm.info"; content:"|06|flwbsm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128573; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain flyewxvj.net"; content:"|08|flyewxvj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128574; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fmambmyufd.com"; content:"|0a|fmambmyufd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128575; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fmatgosv.cn"; content:"|08|fmatgosv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128576; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fmbfotn.ws"; content:"|07|fmbfotn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128577; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fmctawpm.org"; content:"|08|fmctawpm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128578; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fmerekew.net"; content:"|08|fmerekew|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128579; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fmexsu.com"; content:"|06|fmexsu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128580; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fmjmpppo.net"; content:"|08|fmjmpppo|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128581; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fmjseeaebra.info"; content:"|0b|fmjseeaebra|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128582; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fmkluvqk.net"; content:"|08|fmkluvqk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128583; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fmmcetgu.org"; content:"|08|fmmcetgu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128584; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fmpml.cc"; content:"|05|fmpml|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128585; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fmpwuyq.cc"; content:"|07|fmpwuyq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128586; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fmrqbr.cc"; content:"|06|fmrqbr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128587; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fmteirja.com"; content:"|08|fmteirja|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128588; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fmtpjedq.biz"; content:"|08|fmtpjedq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128589; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fnesw.cn"; content:"|05|fnesw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128590; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fngjkux.cn"; content:"|07|fngjkux|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128591; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fnidfz.info"; content:"|06|fnidfz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128592; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fnmlhwdfhmo.net"; content:"|0b|fnmlhwdfhmo|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128593; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fnneldnrrk.info"; content:"|0a|fnneldnrrk|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128594; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fnofdijadj.com"; content:"|0a|fnofdijadj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128595; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fnygm.biz"; content:"|05|fnygm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128596; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fnyjibj.org"; content:"|07|fnyjibj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128597; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fobddunn.org"; content:"|08|fobddunn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128598; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fodda.biz"; content:"|05|fodda|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128599; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fodfxxwpi.cc"; content:"|09|fodfxxwpi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128600; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fogaivo.cn"; content:"|07|fogaivo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128601; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fohjgjtkg.cn"; content:"|09|fohjgjtkg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128602; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fojpmxu.cc"; content:"|07|fojpmxu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128603; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain foqhoibane.info"; content:"|0a|foqhoibane|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128604; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fosibqcgmd.info"; content:"|0a|fosibqcgmd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128605; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fotkmvaa.com"; content:"|08|fotkmvaa|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128606; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fovkywaxoy.ws"; content:"|0a|fovkywaxoy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128607; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fpcgokkf.com"; content:"|08|fpcgokkf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128608; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fpdywczbiey.org"; content:"|0b|fpdywczbiey|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128609; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fpeyvbp.cn"; content:"|07|fpeyvbp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128610; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fpfdgwdgqv.biz"; content:"|0a|fpfdgwdgqv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128611; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fpjnxrlf.ws"; content:"|08|fpjnxrlf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128612; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fplipafn.ws"; content:"|08|fplipafn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128613; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fpmtybfm.cc"; content:"|08|fpmtybfm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128614; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fprwsonuoog.info"; content:"|0b|fprwsonuoog|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128615; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fpvmss.net"; content:"|06|fpvmss|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128616; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fqbkhqvjb.net"; content:"|09|fqbkhqvjb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128617; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fqbveufj.net"; content:"|08|fqbveufj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128618; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fqfra.ws"; content:"|05|fqfra|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128619; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fqhgwgfyawr.cn"; content:"|0b|fqhgwgfyawr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128620; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fqjysdce.biz"; content:"|08|fqjysdce|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128621; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fqmzh.biz"; content:"|05|fqmzh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128622; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fquzyntd.cn"; content:"|08|fquzyntd|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128623; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fqwrb.com"; content:"|05|fqwrb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128624; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain frdmwdwn.cc"; content:"|08|frdmwdwn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128625; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain freum.biz"; content:"|05|freum|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128626; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain frjoyni.cc"; content:"|07|frjoyni|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128627; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain frmlsseyj.cc"; content:"|09|frmlsseyj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128628; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain frozkbt.net"; content:"|07|frozkbt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128629; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain frqawjlzx.cn"; content:"|09|frqawjlzx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128630; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain frqwnruo.com"; content:"|08|frqwnruo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128631; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain frrjns.biz"; content:"|06|frrjns|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128632; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain frswi.cn"; content:"|05|frswi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128633; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain frxwgpm.ws"; content:"|07|frxwgpm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128634; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain frykdnxg.biz"; content:"|08|frykdnxg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128635; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fryuy.net"; content:"|05|fryuy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128636; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fsalbmcoiz.cc"; content:"|0a|fsalbmcoiz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128637; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fsnblkgqld.cn"; content:"|0a|fsnblkgqld|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128638; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fspienu.net"; content:"|07|fspienu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128639; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ftbslbab.com"; content:"|08|ftbslbab|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128640; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ftdlqh.net"; content:"|06|ftdlqh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128641; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fteawcqph.net"; content:"|09|fteawcqph|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128642; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ftljkwkds.org"; content:"|09|ftljkwkds|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128643; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ftmilvvcyy.cc"; content:"|0a|ftmilvvcyy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128644; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ftpsrv.ws"; content:"|06|ftpsrv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128645; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ftucmdw.biz"; content:"|07|ftucmdw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128646; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ftudrbcs.biz"; content:"|08|ftudrbcs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128647; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ftupxbdb.info"; content:"|08|ftupxbdb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128648; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fujwnjem.net"; content:"|08|fujwnjem|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128649; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fupavdvgx.cn"; content:"|09|fupavdvgx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128650; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fuukzsmrm.net"; content:"|09|fuukzsmrm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128651; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fuupawbc.ws"; content:"|08|fuupawbc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128652; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fuzhimwuw.net"; content:"|09|fuzhimwuw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128653; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fuzhwrgo.biz"; content:"|08|fuzhwrgo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128654; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fvabohzyilh.info"; content:"|0b|fvabohzyilh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128655; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fvctnnkxv.biz"; content:"|09|fvctnnkxv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128656; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fvducacq.net"; content:"|08|fvducacq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128657; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fvfaqdwfkck.info"; content:"|0b|fvfaqdwfkck|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128658; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fvfoiwxi.info"; content:"|08|fvfoiwxi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128659; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fvgjyfjvh.com"; content:"|09|fvgjyfjvh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128660; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fvjtj.ws"; content:"|05|fvjtj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128661; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fvmawful.org"; content:"|08|fvmawful|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128662; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fvorxzy.net"; content:"|07|fvorxzy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128663; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fvpcbozhch.info"; content:"|0a|fvpcbozhch|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128664; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fvpuqxjf.info"; content:"|08|fvpuqxjf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128665; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fvrcqnx.biz"; content:"|07|fvrcqnx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128666; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fvtgcq.ws"; content:"|06|fvtgcq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128667; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fvtiibvf.info"; content:"|08|fvtiibvf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128668; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fwafdl.ws"; content:"|06|fwafdl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128669; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fwbvbic.biz"; content:"|07|fwbvbic|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128670; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fwdynyldqa.ws"; content:"|0a|fwdynyldqa|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128671; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fwfhumc.biz"; content:"|07|fwfhumc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128672; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fwgflj.cc"; content:"|06|fwgflj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128673; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fwisafiu.info"; content:"|08|fwisafiu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128674; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fwkvyrbkp.ws"; content:"|09|fwkvyrbkp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128675; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fwnvlja.org"; content:"|07|fwnvlja|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128676; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fwnwfqe.net"; content:"|07|fwnwfqe|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128677; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fwquo.info"; content:"|05|fwquo|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128678; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fwreacu.ws"; content:"|07|fwreacu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128679; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fwsyrar.org"; content:"|07|fwsyrar|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128680; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fwtav.info"; content:"|05|fwtav|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128681; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fxnjmuufm.net"; content:"|09|fxnjmuufm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128682; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fxpeq.net"; content:"|05|fxpeq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128683; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fxqvyuqnuh.com"; content:"|0a|fxqvyuqnuh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128684; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fxzuuqei.ws"; content:"|08|fxzuuqei|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128685; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fybhugyvb.org"; content:"|09|fybhugyvb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128686; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fyfmn.org"; content:"|05|fyfmn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128687; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fygctzbm.cc"; content:"|08|fygctzbm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128688; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fyhij.cn"; content:"|05|fyhij|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128689; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fyikjxexk.cn"; content:"|09|fyikjxexk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128690; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fymeelayvtt.ws"; content:"|0b|fymeelayvtt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128691; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fyqnxvp.com"; content:"|07|fyqnxvp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128692; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fyumy.cc"; content:"|05|fyumy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128693; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fyvjsklfn.biz"; content:"|09|fyvjsklfn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128694; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fyvwsdpbpj.com"; content:"|0a|fyvwsdpbpj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128695; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fzbehcxgzlf.org"; content:"|0b|fzbehcxgzlf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128696; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fzcflak.com"; content:"|07|fzcflak|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128697; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fzcstkaf.net"; content:"|08|fzcstkaf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128698; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fzhko.org"; content:"|05|fzhko|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128699; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fzhpkt.ws"; content:"|06|fzhpkt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128700; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fzhsrcs.biz"; content:"|07|fzhsrcs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128701; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fzjnilsx.info"; content:"|08|fzjnilsx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128702; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fznhhcpo.org"; content:"|08|fznhhcpo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128703; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fzorwpwz.biz"; content:"|08|fzorwpwz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128704; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fzuim.ws"; content:"|05|fzuim|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128705; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fzulioabkgi.ws"; content:"|0b|fzulioabkgi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128706; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fzviet.org"; content:"|06|fzviet|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128707; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain fzvvwxb.cn"; content:"|07|fzvvwxb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128708; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gabmks.com"; content:"|06|gabmks|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128709; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gacbpih.net"; content:"|07|gacbpih|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128710; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gadlzeyl.cn"; content:"|08|gadlzeyl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128711; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain galiycmj.biz"; content:"|08|galiycmj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128712; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gaquhzicul.biz"; content:"|0a|gaquhzicul|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128713; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain garuncqpqtz.ws"; content:"|0b|garuncqpqtz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128714; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gasvc.net"; content:"|05|gasvc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128715; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gayvdpcospp.cn"; content:"|0b|gayvdpcospp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128716; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gbagivkqp.biz"; content:"|09|gbagivkqp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128717; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gbffvt.cc"; content:"|06|gbffvt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128718; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gbhfyazvvdj.org"; content:"|0b|gbhfyazvvdj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128719; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gbkuc.cc"; content:"|05|gbkuc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128720; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gbkzjx.cn"; content:"|06|gbkzjx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128721; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gblsgwebyy.ws"; content:"|0a|gblsgwebyy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128722; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gbystci.org"; content:"|07|gbystci|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128723; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gcdqdb.biz"; content:"|06|gcdqdb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128724; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gcdrtajyg.com"; content:"|09|gcdrtajyg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128725; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gcdtgi.info"; content:"|06|gcdtgi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128726; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gcjjoipk.biz"; content:"|08|gcjjoipk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128727; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gcldgq.net"; content:"|06|gcldgq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128728; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gclkcjbolr.cn"; content:"|0a|gclkcjbolr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128729; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gcntlbtqmwh.com"; content:"|0b|gcntlbtqmwh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128730; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gcohhfaodt.ws"; content:"|0a|gcohhfaodt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128731; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gcorvmft.com"; content:"|08|gcorvmft|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128732; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gcrcffcy.biz"; content:"|08|gcrcffcy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128733; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gcrpu.cc"; content:"|05|gcrpu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128734; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gcunzsuv.net"; content:"|08|gcunzsuv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128735; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gczah.cn"; content:"|05|gczah|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128736; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gdatgocmhd.ws"; content:"|0a|gdatgocmhd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128737; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gdcwqcqdqse.ws"; content:"|0b|gdcwqcqdqse|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128738; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gdezvsllle.com"; content:"|0a|gdezvsllle|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128739; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gdkmlu.com"; content:"|06|gdkmlu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128740; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gdnspwtxaxs.cc"; content:"|0b|gdnspwtxaxs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128741; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gdnsz.ws"; content:"|05|gdnsz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128742; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gdppqdcc.info"; content:"|08|gdppqdcc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128743; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gdpsogumtwh.info"; content:"|0b|gdpsogumtwh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128744; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gdqhyxg.com"; content:"|07|gdqhyxg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128745; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gdrkhfni.ws"; content:"|08|gdrkhfni|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128746; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gdrvixainrz.com"; content:"|0b|gdrvixainrz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128747; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gdwnauev.ws"; content:"|08|gdwnauev|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128748; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gdwrnrxkpz.com"; content:"|0a|gdwrnrxkpz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128749; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gdyndevx.biz"; content:"|08|gdyndevx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128750; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gedtghgrip.com"; content:"|0a|gedtghgrip|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128751; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gefddvsdrw.ws"; content:"|0a|gefddvsdrw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128752; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gefeak.org"; content:"|06|gefeak|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128753; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gehutw.org"; content:"|06|gehutw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128754; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gejprnxnsb.biz"; content:"|0a|gejprnxnsb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128755; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gepdx.net"; content:"|05|gepdx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128756; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gepsnfwwwoi.cn"; content:"|0b|gepsnfwwwoi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128757; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gewassn.ws"; content:"|07|gewassn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128758; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gezfinkpsus.cn"; content:"|0b|gezfinkpsus|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128759; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gfasucmc.biz"; content:"|08|gfasucmc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128760; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gfcwpzvwuu.biz"; content:"|0a|gfcwpzvwuu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128761; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gfdpccelp.org"; content:"|09|gfdpccelp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128762; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gfeomzdkwj.org"; content:"|0a|gfeomzdkwj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128763; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gfgfsyqfbsc.info"; content:"|0b|gfgfsyqfbsc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128764; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gfhsnlop.cn"; content:"|08|gfhsnlop|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128765; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gfkkggjxde.cc"; content:"|0a|gfkkggjxde|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128766; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gfnrmquw.cn"; content:"|08|gfnrmquw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128767; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gfxdoxl.com"; content:"|07|gfxdoxl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128768; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gfzjg.com"; content:"|05|gfzjg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128769; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ggcguzg.cc"; content:"|07|ggcguzg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128770; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ggftslt.net"; content:"|07|ggftslt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128771; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ggfvjmqscc.ws"; content:"|0a|ggfvjmqscc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128772; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gggjio.cc"; content:"|06|gggjio|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128773; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ggikyl.cc"; content:"|06|ggikyl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128774; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gglaoubbyx.net"; content:"|0a|gglaoubbyx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128775; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ggodfldwxne.com"; content:"|0b|ggodfldwxne|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128776; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ggtuoy.ws"; content:"|06|ggtuoy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128777; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gguibdxrq.ws"; content:"|09|gguibdxrq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128778; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ggunool.cn"; content:"|07|ggunool|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128779; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ggwnarcef.org"; content:"|09|ggwnarcef|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128780; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ggxvzwp.ws"; content:"|07|ggxvzwp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128781; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ggzkdcpuz.cc"; content:"|09|ggzkdcpuz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128782; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ghcylxq.ws"; content:"|07|ghcylxq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128783; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ghfjjdqsb.info"; content:"|09|ghfjjdqsb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128784; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ghgvdafiwgz.ws"; content:"|0b|ghgvdafiwgz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128785; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ghhnojyeoq.cn"; content:"|0a|ghhnojyeoq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128786; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ghjcauha.net"; content:"|08|ghjcauha|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128787; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ghjdkrg.net"; content:"|07|ghjdkrg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128788; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ghkaaolhybf.com"; content:"|0b|ghkaaolhybf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128789; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ghqdijc.org"; content:"|07|ghqdijc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128790; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ghugpqichor.org"; content:"|0b|ghugpqichor|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128791; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ghvcaswhuh.net"; content:"|0a|ghvcaswhuh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128792; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ghyxdqeq.cc"; content:"|08|ghyxdqeq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128793; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain giedglnvc.info"; content:"|09|giedglnvc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128794; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gifmekgtvv.cn"; content:"|0a|gifmekgtvv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128795; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gikjztx.cc"; content:"|07|gikjztx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128796; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain giletyuffs.org"; content:"|0a|giletyuffs|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128797; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gimajjmbk.org"; content:"|09|gimajjmbk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128798; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ginpxsrw.com"; content:"|08|ginpxsrw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128799; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gioke.net"; content:"|05|gioke|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128800; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gisdnp.org"; content:"|06|gisdnp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128801; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gitskff.biz"; content:"|07|gitskff|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128802; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain givahva.ws"; content:"|07|givahva|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128803; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gival.com"; content:"|05|gival|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128804; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain givxt.cc"; content:"|05|givxt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128805; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gjffowmmkyv.ws"; content:"|0b|gjffowmmkyv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128806; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gjispmhqk.cc"; content:"|09|gjispmhqk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128807; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gjjlzpm.com"; content:"|07|gjjlzpm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128808; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gjmkkxsu.net"; content:"|08|gjmkkxsu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128809; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gjnfgxhymm.net"; content:"|0a|gjnfgxhymm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128810; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gjnxmdmvlw.cc"; content:"|0a|gjnxmdmvlw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128811; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gjxhwehosx.org"; content:"|0a|gjxhwehosx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128812; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gkbzkhwkgm.info"; content:"|0a|gkbzkhwkgm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128813; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gkbzwfcy.com"; content:"|08|gkbzwfcy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128814; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gkchfg.ws"; content:"|06|gkchfg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128815; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gkfjdzd.ws"; content:"|07|gkfjdzd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128816; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gkhaj.net"; content:"|05|gkhaj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128817; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gkhxjkbp.cn"; content:"|08|gkhxjkbp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128818; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gkkfojcc.org"; content:"|08|gkkfojcc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128819; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gknqpbccvvt.cc"; content:"|0b|gknqpbccvvt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128820; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gkobijwqopl.ws"; content:"|0b|gkobijwqopl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128821; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gkoletizbc.org"; content:"|0a|gkoletizbc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128822; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gkowe.biz"; content:"|05|gkowe|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128823; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gkrxsdgh.org"; content:"|08|gkrxsdgh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128824; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gktilxlp.cc"; content:"|08|gktilxlp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128825; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gkwhafwuk.cc"; content:"|09|gkwhafwuk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128826; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gkyhhexyz.cc"; content:"|09|gkyhhexyz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128827; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain glbmdcg.net"; content:"|07|glbmdcg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128828; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gldsbitfl.com"; content:"|09|gldsbitfl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128829; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gleccseuyxm.net"; content:"|0b|gleccseuyxm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128830; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain glemkau.org"; content:"|07|glemkau|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128831; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain glkxmcqnl.net"; content:"|09|glkxmcqnl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128832; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain glnjccmlql.cc"; content:"|0a|glnjccmlql|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128833; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gloebahum.biz"; content:"|09|gloebahum|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128834; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain glpwjfjw.cn"; content:"|08|glpwjfjw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128835; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain glshupfgoo.biz"; content:"|0a|glshupfgoo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128836; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gltjpklykaq.ws"; content:"|0b|gltjpklykaq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128837; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gltpfujkx.net"; content:"|09|gltpfujkx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128838; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain glujx.ws"; content:"|05|glujx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128839; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain glvxzywyv.org"; content:"|09|glvxzywyv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128840; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain glwcyfphg.info"; content:"|09|glwcyfphg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128841; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain glxpkaqqpng.org"; content:"|0b|glxpkaqqpng|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128842; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gmgbdit.cc"; content:"|07|gmgbdit|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128843; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gmhbyopfxop.cn"; content:"|0b|gmhbyopfxop|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128844; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gmmqq.ws"; content:"|05|gmmqq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128845; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gmmtepxl.biz"; content:"|08|gmmtepxl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128846; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gmnxhtuk.net"; content:"|08|gmnxhtuk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128847; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gmnzxonb.biz"; content:"|08|gmnzxonb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128848; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gmojbolexq.net"; content:"|0a|gmojbolexq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128849; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gmqwohjofda.net"; content:"|0b|gmqwohjofda|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128850; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gmrokgnd.ws"; content:"|08|gmrokgnd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128851; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gmtpfxsotrl.org"; content:"|0b|gmtpfxsotrl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128852; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gmuhxmcc.cc"; content:"|08|gmuhxmcc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128853; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gmvpoolv.info"; content:"|08|gmvpoolv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128854; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gmycf.info"; content:"|05|gmycf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128855; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gnevkdwk.cn"; content:"|08|gnevkdwk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128856; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gnezfcsl.com"; content:"|08|gnezfcsl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128857; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gnigqosy.com"; content:"|08|gnigqosy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128858; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gnlswyuo.cn"; content:"|08|gnlswyuo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128859; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gnmzn.cn"; content:"|05|gnmzn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128860; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gnnmz.info"; content:"|05|gnnmz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128861; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gnnzjybn.org"; content:"|08|gnnzjybn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128862; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gnomeyzb.cn"; content:"|08|gnomeyzb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128863; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gnpjhuvfw.info"; content:"|09|gnpjhuvfw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128864; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gnqtjvnz.cn"; content:"|08|gnqtjvnz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128865; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gnrkqhfv.com"; content:"|08|gnrkqhfv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128866; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gntcvjhyw.com"; content:"|09|gntcvjhyw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128867; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gnutzhvx.cc"; content:"|08|gnutzhvx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128868; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain goefxuebv.cn"; content:"|09|goefxuebv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128869; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain goevzlroqql.ws"; content:"|0b|goevzlroqql|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128870; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gokfnptwkkj.com"; content:"|0b|gokfnptwkkj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128871; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gopfgie.net"; content:"|07|gopfgie|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128872; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gotpusfxj.cn"; content:"|09|gotpusfxj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128873; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gowhx.biz"; content:"|05|gowhx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128874; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gowmyn.ws"; content:"|06|gowmyn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128875; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gpbhi.com"; content:"|05|gpbhi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128876; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gpegc.biz"; content:"|05|gpegc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128877; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gpgcp.net"; content:"|05|gpgcp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128878; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gpkfqno.org"; content:"|07|gpkfqno|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128879; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gpnpr.org"; content:"|05|gpnpr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128880; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gpqlezebv.org"; content:"|09|gpqlezebv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128881; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gpvtcczo.org"; content:"|08|gpvtcczo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128882; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gpxnut.biz"; content:"|06|gpxnut|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128883; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gpykbxvji.cn"; content:"|09|gpykbxvji|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128884; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gqbrawifat.org"; content:"|0a|gqbrawifat|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128885; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gqeerzxtgpu.biz"; content:"|0b|gqeerzxtgpu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128886; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gqjxwjgal.biz"; content:"|09|gqjxwjgal|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128887; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gqlbydk.ws"; content:"|07|gqlbydk|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128888; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gqnqagxaqyy.cc"; content:"|0b|gqnqagxaqyy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128889; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gqqddfhbdbs.cc"; content:"|0b|gqqddfhbdbs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128890; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gquyspb.ws"; content:"|07|gquyspb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128891; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gqyek.com"; content:"|05|gqyek|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128892; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gqztrfz.net"; content:"|07|gqztrfz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128893; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain grcolfqf.cc"; content:"|08|grcolfqf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128894; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain grcvdfps.info"; content:"|08|grcvdfps|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128895; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain grfjmicp.info"; content:"|08|grfjmicp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128896; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain grhpbtfu.com"; content:"|08|grhpbtfu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128897; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain grmsjmb.net"; content:"|07|grmsjmb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128898; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain groprlhvbug.net"; content:"|0b|groprlhvbug|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128899; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gropthyw.cn"; content:"|08|gropthyw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128900; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain grrvockqnmb.info"; content:"|0b|grrvockqnmb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128901; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain grvcmt.biz"; content:"|06|grvcmt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128902; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain grxoiwkl.net"; content:"|08|grxoiwkl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128903; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gryxzwjv.org"; content:"|08|gryxzwjv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128904; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gsbcgxxohz.cc"; content:"|0a|gsbcgxxohz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128905; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gsiiief.org"; content:"|07|gsiiief|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128906; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gskknoxac.org"; content:"|09|gskknoxac|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128907; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gsknspimf.cc"; content:"|09|gsknspimf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128908; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gslmyuvffxl.org"; content:"|0b|gslmyuvffxl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128909; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gslrrdn.org"; content:"|07|gslrrdn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128910; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gsnptjdwme.com"; content:"|0a|gsnptjdwme|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128911; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gsnqpx.info"; content:"|06|gsnqpx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128912; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gsrqsk.cn"; content:"|06|gsrqsk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128913; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gsrzir.cn"; content:"|06|gsrzir|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128914; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gswkhnk.ws"; content:"|07|gswkhnk|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128915; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gsxcseg.cc"; content:"|07|gsxcseg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128916; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gtdjjg.biz"; content:"|06|gtdjjg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128917; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gtfgu.cn"; content:"|05|gtfgu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128918; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gtfhpzky.biz"; content:"|08|gtfhpzky|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128919; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gtfpghtsrbm.cc"; content:"|0b|gtfpghtsrbm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128920; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gtntdfpac.info"; content:"|09|gtntdfpac|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128921; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gtrjopb.com"; content:"|07|gtrjopb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128922; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gtrxpwcdxl.cc"; content:"|0a|gtrxpwcdxl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128923; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gtubkaf.cn"; content:"|07|gtubkaf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128924; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gtvdkfdr.ws"; content:"|08|gtvdkfdr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128925; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gtxovrxwwa.cc"; content:"|0a|gtxovrxwwa|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128926; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gubportb.com"; content:"|08|gubportb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128927; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gubpsy.cn"; content:"|06|gubpsy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128928; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gueaqvefjho.com"; content:"|0b|gueaqvefjho|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128929; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gujhsyisqj.net"; content:"|0a|gujhsyisqj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128930; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gulochwlf.info"; content:"|09|gulochwlf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128931; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain guoxsxrolht.cc"; content:"|0b|guoxsxrolht|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128932; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gupwplgdi.com"; content:"|09|gupwplgdi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128933; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain guqrocqdmt.ws"; content:"|0a|guqrocqdmt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128934; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain guuazl.org"; content:"|06|guuazl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128935; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain guvsbark.cc"; content:"|08|guvsbark|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128936; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gvbjp.org"; content:"|05|gvbjp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128937; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gvdcemg.biz"; content:"|07|gvdcemg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128938; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gvemhlvsa.cc"; content:"|09|gvemhlvsa|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128939; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gvkrngljbkc.com"; content:"|0b|gvkrngljbkc|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128940; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gvlaa.info"; content:"|05|gvlaa|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128941; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gvnja.net"; content:"|05|gvnja|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128942; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gvqygpo.info"; content:"|07|gvqygpo|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128943; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gvrkul.net"; content:"|06|gvrkul|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128944; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gvsynh.org"; content:"|06|gvsynh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128945; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gvxionig.info"; content:"|08|gvxionig|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128946; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gwagzlkkqp.com"; content:"|0a|gwagzlkkqp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128947; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gwajcfdzqfh.cc"; content:"|0b|gwajcfdzqfh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128948; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gwaoohi.cn"; content:"|07|gwaoohi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128949; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gwcbfrxd.com"; content:"|08|gwcbfrxd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128950; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gwcespgov.com"; content:"|09|gwcespgov|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128951; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gwctopmqypx.org"; content:"|0b|gwctopmqypx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128952; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gwgosif.org"; content:"|07|gwgosif|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128953; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gwoypupwolv.info"; content:"|0b|gwoypupwolv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128954; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gwswmifc.ws"; content:"|08|gwswmifc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128955; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gwtvgm.biz"; content:"|06|gwtvgm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128956; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gwvflctn.info"; content:"|08|gwvflctn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128957; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gwwsfvob.cc"; content:"|08|gwwsfvob|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128958; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gwzou.com"; content:"|05|gwzou|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128959; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gxcstwr.info"; content:"|07|gxcstwr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128960; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gxgutnyf.info"; content:"|08|gxgutnyf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128961; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gxiuqigev.org"; content:"|09|gxiuqigev|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128962; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gxiuudqgksa.ws"; content:"|0b|gxiuudqgksa|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128963; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gxkchtkxx.info"; content:"|09|gxkchtkxx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128964; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gxkea.biz"; content:"|05|gxkea|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128965; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gxowbvco.org"; content:"|08|gxowbvco|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128966; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gyarxlexksc.biz"; content:"|0b|gyarxlexksc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128967; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gyatv.org"; content:"|05|gyatv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128968; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gyhpdkxuhs.ws"; content:"|0a|gyhpdkxuhs|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128969; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gyjqxz.info"; content:"|06|gyjqxz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128970; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gyostnznbn.org"; content:"|0a|gyostnznbn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128971; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gyoyfrks.net"; content:"|08|gyoyfrks|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128972; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gysdx.net"; content:"|05|gysdx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128973; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gyvskjw.ws"; content:"|07|gyvskjw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128974; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gywefqzsihy.org"; content:"|0b|gywefqzsihy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128975; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gyzfososjbn.net"; content:"|0b|gyzfososjbn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128976; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gzamvpzgr.cn"; content:"|09|gzamvpzgr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128977; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gzbuzgak.com"; content:"|08|gzbuzgak|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128978; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gzcbr.org"; content:"|05|gzcbr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128979; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gzgoltqemuh.cn"; content:"|0b|gzgoltqemuh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128980; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gzhttnxl.cc"; content:"|08|gzhttnxl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128981; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gzjddrbwy.com"; content:"|09|gzjddrbwy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128982; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gznkasvfs.biz"; content:"|09|gznkasvfs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128983; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gzntqd.ws"; content:"|06|gzntqd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128984; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gzqaxjrh.biz"; content:"|08|gzqaxjrh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128985; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gzsigac.info"; content:"|07|gzsigac|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128986; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gzslzitroz.com"; content:"|0a|gzslzitroz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128987; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gztpirfi.cc"; content:"|08|gztpirfi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128988; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gzvmkvw.cc"; content:"|07|gzvmkvw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128989; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gzxjw.net"; content:"|05|gzxjw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128990; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain gzznlmqb.ws"; content:"|08|gzznlmqb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128991; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain haanbutwuar.info"; content:"|0b|haanbutwuar|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128992; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain habreiqryje.biz"; content:"|0b|habreiqryje|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128993; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hacylwhxomp.com"; content:"|0b|hacylwhxomp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128994; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hahkghrm.cn"; content:"|08|hahkghrm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128995; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain haicqng.info"; content:"|07|haicqng|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128996; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain haipjuvizr.biz"; content:"|0a|haipjuvizr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128997; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain halwmlpn.net"; content:"|08|halwmlpn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128998; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain haoatqbljr.cn"; content:"|0a|haoatqbljr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1128999; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hapaymy.cn"; content:"|07|hapaymy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129000; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hasfjojfv.com"; content:"|09|hasfjojfv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129001; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain havvytjyew.ws"; content:"|0a|havvytjyew|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129002; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain haxojjlxkow.org"; content:"|0b|haxojjlxkow|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129003; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain haygzig.info"; content:"|07|haygzig|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129004; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hbfeogen.ws"; content:"|08|hbfeogen|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129005; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hbkvvpzo.net"; content:"|08|hbkvvpzo|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129006; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hbmnu.ws"; content:"|05|hbmnu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129007; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hbqcpqjskv.ws"; content:"|0a|hbqcpqjskv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129008; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hbrfm.biz"; content:"|05|hbrfm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129009; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hbssielgwan.ws"; content:"|0b|hbssielgwan|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129010; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hbvfi.info"; content:"|05|hbvfi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129011; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hcfjwodbxtm.cc"; content:"|0b|hcfjwodbxtm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129012; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hcfnkzxzus.ws"; content:"|0a|hcfnkzxzus|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129013; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hchhm.com"; content:"|05|hchhm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129014; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hcitmaje.info"; content:"|08|hcitmaje|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129015; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hckkibuc.cn"; content:"|08|hckkibuc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129016; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hcmimbacs.org"; content:"|09|hcmimbacs|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129017; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hcpflzmx.ws"; content:"|08|hcpflzmx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129018; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hcpvzhkj.ws"; content:"|08|hcpvzhkj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129019; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hcqqambc.biz"; content:"|08|hcqqambc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129020; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hcrwqwffsh.cc"; content:"|0a|hcrwqwffsh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129021; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hcvogsuxgg.info"; content:"|0a|hcvogsuxgg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129022; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hdaznyee.com"; content:"|08|hdaznyee|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129023; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hdgblieiumf.net"; content:"|0b|hdgblieiumf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129024; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hdhvq.info"; content:"|05|hdhvq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129025; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hdjhrzvpzi.com"; content:"|0a|hdjhrzvpzi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129026; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hdkjdc.org"; content:"|06|hdkjdc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129027; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hdkoezzfigq.cn"; content:"|0b|hdkoezzfigq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129028; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hdnjfo.com"; content:"|06|hdnjfo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129029; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hdnxgzotctb.com"; content:"|0b|hdnxgzotctb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129030; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hdpsf.com"; content:"|05|hdpsf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129031; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hdqrfbi.cn"; content:"|07|hdqrfbi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129032; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hdudipes.org"; content:"|08|hdudipes|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129033; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hdxdbjlqc.cc"; content:"|09|hdxdbjlqc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129034; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hdxxi.info"; content:"|05|hdxxi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129035; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hdydhgsn.biz"; content:"|08|hdydhgsn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129036; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hdzfw.cn"; content:"|05|hdzfw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129037; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hebptv.net"; content:"|06|hebptv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129038; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hedadqfnby.cn"; content:"|0a|hedadqfnby|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129039; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hegygawvo.info"; content:"|09|hegygawvo|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129040; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain heihtmik.cc"; content:"|08|heihtmik|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129041; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hekrmlg.org"; content:"|07|hekrmlg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129042; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain heqsokxwg.cn"; content:"|09|heqsokxwg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129043; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain herhuhszxux.biz"; content:"|0b|herhuhszxux|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129044; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain heulka.net"; content:"|06|heulka|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129045; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hewsrdodlzg.org"; content:"|0b|hewsrdodlzg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129046; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hewykckjsgg.cc"; content:"|0b|hewykckjsgg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129047; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain heygsbv.cn"; content:"|07|heygsbv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129048; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hezmeimj.cn"; content:"|08|hezmeimj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129049; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hfauaroym.cn"; content:"|09|hfauaroym|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129050; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hfdeld.cn"; content:"|06|hfdeld|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129051; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hfesgyvnf.biz"; content:"|09|hfesgyvnf|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129052; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hfhty.cc"; content:"|05|hfhty|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129053; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hfkkwmczvxb.net"; content:"|0b|hfkkwmczvxb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129054; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hflilb.cc"; content:"|06|hflilb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129055; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hfqbxujt.cn"; content:"|08|hfqbxujt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129056; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hfqxwuol.biz"; content:"|08|hfqxwuol|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129057; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hgbcc.cc"; content:"|05|hgbcc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129058; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hgcsfsrhffr.biz"; content:"|0b|hgcsfsrhffr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129059; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hgeghfac.ws"; content:"|08|hgeghfac|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129060; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hgezd.com"; content:"|05|hgezd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129061; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hgfagsl.cn"; content:"|07|hgfagsl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129062; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hgnns.cn"; content:"|05|hgnns|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129063; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hgoqepyhfxs.biz"; content:"|0b|hgoqepyhfxs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129064; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hgpwm.net"; content:"|05|hgpwm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129065; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hgqidnxgljt.com"; content:"|0b|hgqidnxgljt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129066; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hgweoimbalz.ws"; content:"|0b|hgweoimbalz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129067; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hgyobbsw.ws"; content:"|08|hgyobbsw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129068; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hhaevbxr.ws"; content:"|08|hhaevbxr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129069; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hhbuvpfq.cc"; content:"|08|hhbuvpfq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129070; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hheghnpz.biz"; content:"|08|hheghnpz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129071; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hhfufauvc.cn"; content:"|09|hhfufauvc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129072; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hhfxevk.cc"; content:"|07|hhfxevk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129073; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hhgytdmrflc.cc"; content:"|0b|hhgytdmrflc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129074; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hhmlgjutfwb.biz"; content:"|0b|hhmlgjutfwb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129075; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hhwoym.info"; content:"|06|hhwoym|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129076; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hhyfmewxqwa.ws"; content:"|0b|hhyfmewxqwa|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129077; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hhygebtt.cn"; content:"|08|hhygebtt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129078; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hianhrp.ws"; content:"|07|hianhrp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129079; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hicqkwsfgtn.cc"; content:"|0b|hicqkwsfgtn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129080; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hidyjov.net"; content:"|07|hidyjov|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129081; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain higgbpwladh.com"; content:"|0b|higgbpwladh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129082; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hinvlamb.info"; content:"|08|hinvlamb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129083; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hiqbzyfxugg.ws"; content:"|0b|hiqbzyfxugg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129084; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hisyrxosw.net"; content:"|09|hisyrxosw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129085; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hixpdvaisp.cc"; content:"|0a|hixpdvaisp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129086; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hjdsoovbn.cn"; content:"|09|hjdsoovbn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129087; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hjhfixzlou.com"; content:"|0a|hjhfixzlou|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129088; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hjtufjxj.biz"; content:"|08|hjtufjxj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129089; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hjuninikba.com"; content:"|0a|hjuninikba|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129090; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hjwwd.ws"; content:"|05|hjwwd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129091; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hjxkmma.net"; content:"|07|hjxkmma|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129092; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hkbeyklv.biz"; content:"|08|hkbeyklv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129093; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hkdvmrewie.cn"; content:"|0a|hkdvmrewie|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129094; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hkkoczgrne.cc"; content:"|0a|hkkoczgrne|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129095; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hklkvm.cn"; content:"|06|hklkvm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129096; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hkmizv.org"; content:"|06|hkmizv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129097; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hkorhz.info"; content:"|06|hkorhz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129098; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hkpimltdx.cn"; content:"|09|hkpimltdx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129099; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hkqjruehfhs.org"; content:"|0b|hkqjruehfhs|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129100; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hkrlouinuw.biz"; content:"|0a|hkrlouinuw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129101; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hksynsccig.biz"; content:"|0a|hksynsccig|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129102; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hkxqfs.org"; content:"|06|hkxqfs|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129103; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hkzsu.biz"; content:"|05|hkzsu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129104; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hlbih.org"; content:"|05|hlbih|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129105; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hlexjuht.biz"; content:"|08|hlexjuht|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129106; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hlmbhpaic.ws"; content:"|09|hlmbhpaic|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129107; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hlmcbijktk.com"; content:"|0a|hlmcbijktk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129108; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hlrigz.com"; content:"|06|hlrigz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129109; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hluriudgpxc.net"; content:"|0b|hluriudgpxc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129110; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hlwditcg.biz"; content:"|08|hlwditcg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129111; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hlxpxjfw.cc"; content:"|08|hlxpxjfw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129112; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hlxrrtzc.net"; content:"|08|hlxrrtzc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129113; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hmixpoki.com"; content:"|08|hmixpoki|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129114; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hmlks.ws"; content:"|05|hmlks|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129115; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hmrxec.ws"; content:"|06|hmrxec|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129116; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hmygaka.cc"; content:"|07|hmygaka|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129117; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hnbrkv.info"; content:"|06|hnbrkv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129118; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hnermdtkd.info"; content:"|09|hnermdtkd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129119; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hnizfyd.biz"; content:"|07|hnizfyd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129120; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hnmqwui.cc"; content:"|07|hnmqwui|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129121; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hnolgwbancf.cc"; content:"|0b|hnolgwbancf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129122; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hnoluzdobva.org"; content:"|0b|hnoluzdobva|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129123; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hnoydi.net"; content:"|06|hnoydi|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129124; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hnrajnff.info"; content:"|08|hnrajnff|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129125; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hnrlgamv.org"; content:"|08|hnrlgamv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129126; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hnrrvispp.net"; content:"|09|hnrrvispp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129127; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hnthmhci.info"; content:"|08|hnthmhci|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129128; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hntlbr.cn"; content:"|06|hntlbr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129129; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hnxhoclbg.cc"; content:"|09|hnxhoclbg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129130; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hnzfjduq.org"; content:"|08|hnzfjduq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129131; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hoiniynjkw.cc"; content:"|0a|hoiniynjkw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129132; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain holjyclxx.ws"; content:"|09|holjyclxx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129133; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain homce.info"; content:"|05|homce|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129134; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hopzspbbu.com"; content:"|09|hopzspbbu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129135; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain houqsexozo.biz"; content:"|0a|houqsexozo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129136; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hoydby.net"; content:"|06|hoydby|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129137; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hoynwfh.ws"; content:"|07|hoynwfh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129138; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hozzlvzkzfc.biz"; content:"|0b|hozzlvzkzfc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129139; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hpbtgulk.com"; content:"|08|hpbtgulk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129140; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hpcifaq.info"; content:"|07|hpcifaq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129141; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hpebchb.ws"; content:"|07|hpebchb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129142; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hphktpl.biz"; content:"|07|hphktpl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129143; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hphoghscy.cn"; content:"|09|hphoghscy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129144; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hphpzdbb.com"; content:"|08|hphpzdbb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129145; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hphvsciit.org"; content:"|09|hphvsciit|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129146; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hpidyuuw.cc"; content:"|08|hpidyuuw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129147; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hpnujgimvys.cc"; content:"|0b|hpnujgimvys|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129148; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hpxiloyfj.org"; content:"|09|hpxiloyfj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129149; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hpzehnuvyww.net"; content:"|0b|hpzehnuvyww|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129150; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hqcenmglolb.com"; content:"|0b|hqcenmglolb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129151; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hqhamuipuod.net"; content:"|0b|hqhamuipuod|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129152; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hqhrbj.org"; content:"|06|hqhrbj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129153; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hqjjd.cc"; content:"|05|hqjjd|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129154; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hqkxc.info"; content:"|05|hqkxc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129155; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hqmig.ws"; content:"|05|hqmig|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129156; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hqnhrh.ws"; content:"|06|hqnhrh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129157; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hqrgjwwrl.cn"; content:"|09|hqrgjwwrl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129158; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hquhguv.ws"; content:"|07|hquhguv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129159; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hqwcmaz.info"; content:"|07|hqwcmaz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129160; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hrbdozmoyca.org"; content:"|0b|hrbdozmoyca|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129161; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hrddmdfd.org"; content:"|08|hrddmdfd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129162; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hrmbjab.org"; content:"|07|hrmbjab|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129163; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hrmyef.info"; content:"|06|hrmyef|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129164; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hrplufz.com"; content:"|07|hrplufz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129165; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hrppkvcnrwu.biz"; content:"|0b|hrppkvcnrwu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129166; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hrqgpccyw.ws"; content:"|09|hrqgpccyw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129167; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hrwrus.net"; content:"|06|hrwrus|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129168; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hrwypfie.info"; content:"|08|hrwypfie|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129169; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hrzajnbvyp.net"; content:"|0a|hrzajnbvyp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129170; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hrzeaazfxrk.biz"; content:"|0b|hrzeaazfxrk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129171; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hscqcent.biz"; content:"|08|hscqcent|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129172; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hscymmqyuej.cc"; content:"|0b|hscymmqyuej|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129173; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hsfdkobm.net"; content:"|08|hsfdkobm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129174; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hsjrlm.biz"; content:"|06|hsjrlm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129175; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hskyfyt.net"; content:"|07|hskyfyt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129176; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hsvoxztemat.cc"; content:"|0b|hsvoxztemat|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129177; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain htaqyvwg.biz"; content:"|08|htaqyvwg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129178; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain htdxoot.com"; content:"|07|htdxoot|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129179; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain htfbkmhply.info"; content:"|0a|htfbkmhply|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129180; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain htkkojbe.cc"; content:"|08|htkkojbe|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129181; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain htmnunrxk.biz"; content:"|09|htmnunrxk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129182; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain htpwfptbu.biz"; content:"|09|htpwfptbu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129183; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain htsaur.cc"; content:"|06|htsaur|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129184; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain htxpbhty.biz"; content:"|08|htxpbhty|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129185; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain htxtpkeuu.com"; content:"|09|htxtpkeuu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129186; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hucyuub.ws"; content:"|07|hucyuub|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129187; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain huplaiubl.info"; content:"|09|huplaiubl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129188; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hupnfiuk.ws"; content:"|08|hupnfiuk|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129189; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hvbbdplo.com"; content:"|08|hvbbdplo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129190; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hvciypjrm.cc"; content:"|09|hvciypjrm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129191; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hvcthxzw.info"; content:"|08|hvcthxzw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129192; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hvdmlfvloj.org"; content:"|0a|hvdmlfvloj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129193; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hvevjvulq.cc"; content:"|09|hvevjvulq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129194; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hvhpmybb.ws"; content:"|08|hvhpmybb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129195; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hvkaf.cn"; content:"|05|hvkaf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129196; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hvwhnogvlph.com"; content:"|0b|hvwhnogvlph|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129197; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hvwqhdp.com"; content:"|07|hvwqhdp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129198; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hvxrjd.org"; content:"|06|hvxrjd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129199; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hvzgszerqn.cc"; content:"|0a|hvzgszerqn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129200; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hwevk.com"; content:"|05|hwevk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129201; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hwgdz.biz"; content:"|05|hwgdz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129202; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hwismfiyo.cc"; content:"|09|hwismfiyo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129203; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hwlaaogx.biz"; content:"|08|hwlaaogx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129204; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hwleikymxdh.cc"; content:"|0b|hwleikymxdh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129205; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hwlnydyn.ws"; content:"|08|hwlnydyn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129206; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hwmbwoms.cn"; content:"|08|hwmbwoms|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129207; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hwnpnx.cn"; content:"|06|hwnpnx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129208; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hwouq.biz"; content:"|05|hwouq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129209; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hwpawxgf.biz"; content:"|08|hwpawxgf|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129210; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hwppfw.cn"; content:"|06|hwppfw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129211; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hwqmildox.info"; content:"|09|hwqmildox|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129212; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hwruxuyrubv.cn"; content:"|0b|hwruxuyrubv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129213; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hwxsmvxtyfz.ws"; content:"|0b|hwxsmvxtyfz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129214; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hxcmauwtjsq.cc"; content:"|0b|hxcmauwtjsq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129215; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hxdhhxwcgxv.net"; content:"|0b|hxdhhxwcgxv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129216; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hxeiofq.net"; content:"|07|hxeiofq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129217; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hxelpe.ws"; content:"|06|hxelpe|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129218; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hxfdutvk.cn"; content:"|08|hxfdutvk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129219; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hxffkptp.cc"; content:"|08|hxffkptp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129220; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hxixipyxumh.org"; content:"|0b|hxixipyxumh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129221; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hxjlzumq.biz"; content:"|08|hxjlzumq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129222; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hxjzfpo.cn"; content:"|07|hxjzfpo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129223; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hxnnfsmszw.biz"; content:"|0a|hxnnfsmszw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129224; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hxqwcjkcgsf.net"; content:"|0b|hxqwcjkcgsf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129225; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hxscizozzg.biz"; content:"|0a|hxscizozzg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129226; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hxzlpqcz.net"; content:"|08|hxzlpqcz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129227; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hycprv.cn"; content:"|06|hycprv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129228; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hyims.cc"; content:"|05|hyims|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129229; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hyiqej.net"; content:"|06|hyiqej|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129230; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hymiif.cc"; content:"|06|hymiif|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129231; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hypodfu.org"; content:"|07|hypodfu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129232; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hyqhmvzjtei.cn"; content:"|0b|hyqhmvzjtei|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129233; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hyrgepvzsp.org"; content:"|0a|hyrgepvzsp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129234; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hytydhqpcu.cc"; content:"|0a|hytydhqpcu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129235; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hyuolk.info"; content:"|06|hyuolk|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129236; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hywyhvnicdy.ws"; content:"|0b|hywyhvnicdy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129237; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hzambh.biz"; content:"|06|hzambh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129238; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hzcrecio.info"; content:"|08|hzcrecio|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129239; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hzglxr.net"; content:"|06|hzglxr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129240; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hzjbn.net"; content:"|05|hzjbn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129241; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hzmev.net"; content:"|05|hzmev|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129242; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hzoyt.cn"; content:"|05|hzoyt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129243; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hzpgrnyoddf.biz"; content:"|0b|hzpgrnyoddf|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129244; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hzqyydbl.cc"; content:"|08|hzqyydbl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129245; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain hzxancitjk.org"; content:"|0a|hzxancitjk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129246; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iadwxhf.info"; content:"|07|iadwxhf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129247; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iafsjrrtuiw.cn"; content:"|0b|iafsjrrtuiw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129248; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iajnypelw.org"; content:"|09|iajnypelw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129249; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iakmgdmrrwk.ws"; content:"|0b|iakmgdmrrwk|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129250; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ialzpv.org"; content:"|06|ialzpv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129251; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iameifnjkqx.net"; content:"|0b|iameifnjkqx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129252; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iamkej.cc"; content:"|06|iamkej|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129253; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iamws.cn"; content:"|05|iamws|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129254; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ianmsx.cn"; content:"|06|ianmsx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129255; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ianwvwtdmjl.cn"; content:"|0b|ianwvwtdmjl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129256; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iaprpgsvsz.org"; content:"|0a|iaprpgsvsz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129257; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iazamxcjkd.cc"; content:"|0a|iazamxcjkd|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129258; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ibabwjh.cn"; content:"|07|ibabwjh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129259; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ibalkvjwywk.org"; content:"|0b|ibalkvjwywk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129260; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ibbivsfpz.biz"; content:"|09|ibbivsfpz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129261; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ibinyx.cn"; content:"|06|ibinyx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129262; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ibnoirv.info"; content:"|07|ibnoirv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129263; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ibrcc.com"; content:"|05|ibrcc|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129264; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ibrdykqf.ws"; content:"|08|ibrdykqf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129265; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ibsyrwfioli.com"; content:"|0b|ibsyrwfioli|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129266; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ibzoerucq.cn"; content:"|09|ibzoerucq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129267; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ichlvhk.cc"; content:"|07|ichlvhk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129268; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain icktefq.com"; content:"|07|icktefq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129269; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain icnoe.org"; content:"|05|icnoe|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129270; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iczjii.org"; content:"|06|iczjii|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129271; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain icztfixe.com"; content:"|08|icztfixe|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129272; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iczxjalk.cn"; content:"|08|iczxjalk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129273; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain idarkgrzhm.com"; content:"|0a|idarkgrzhm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129274; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain idblbcud.info"; content:"|08|idblbcud|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129275; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain idedpwz.cn"; content:"|07|idedpwz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129276; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ideetwrwy.info"; content:"|09|ideetwrwy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129277; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain idgfmfssgab.com"; content:"|0b|idgfmfssgab|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129278; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain idhiplky.cc"; content:"|08|idhiplky|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129279; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain idirtxpl.com"; content:"|08|idirtxpl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129280; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain idnvc.cc"; content:"|05|idnvc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129281; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain idpaj.com"; content:"|05|idpaj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129282; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain idvstsoh.cc"; content:"|08|idvstsoh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129283; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain idxyyslyln.org"; content:"|0a|idxyyslyln|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129284; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iebyty.biz"; content:"|06|iebyty|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129285; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ieddpvgqo.ws"; content:"|09|ieddpvgqo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129286; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iedhavtkg.ws"; content:"|09|iedhavtkg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129287; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iefflqkly.biz"; content:"|09|iefflqkly|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129288; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iefhg.cn"; content:"|05|iefhg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129289; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iefkljxai.biz"; content:"|09|iefkljxai|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129290; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iegokwqlexa.ws"; content:"|0b|iegokwqlexa|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129291; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iekamarx.cn"; content:"|08|iekamarx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129292; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ieoffqovta.info"; content:"|0a|ieoffqovta|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129293; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iewel.cc"; content:"|05|iewel|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129294; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iexzrm.com"; content:"|06|iexzrm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129295; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iezswo.ws"; content:"|06|iezswo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129296; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ifaywsqwt.net"; content:"|09|ifaywsqwt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129297; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ifecfmh.cc"; content:"|07|ifecfmh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129298; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iflda.biz"; content:"|05|iflda|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129299; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ifnnkasls.com"; content:"|09|ifnnkasls|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129300; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ifpwpjvs.cn"; content:"|08|ifpwpjvs|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129301; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ifqxprebvbi.cc"; content:"|0b|ifqxprebvbi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129302; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ifrljsxtu.ws"; content:"|09|ifrljsxtu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129303; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ifvknhxx.org"; content:"|08|ifvknhxx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129304; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ifxjx.info"; content:"|05|ifxjx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129305; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain igatihupxy.cn"; content:"|0a|igatihupxy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129306; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain igdwg.org"; content:"|05|igdwg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129307; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iggepgp.info"; content:"|07|iggepgp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129308; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain igjcqphru.net"; content:"|09|igjcqphru|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129309; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain igorkoik.com"; content:"|08|igorkoik|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129310; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain igqnysvneg.biz"; content:"|0a|igqnysvneg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129311; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain igrvkc.biz"; content:"|06|igrvkc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129312; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain igsnxavlug.cc"; content:"|0a|igsnxavlug|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129313; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ihdmxpsht.net"; content:"|09|ihdmxpsht|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129314; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ihfoykixm.cn"; content:"|09|ihfoykixm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129315; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ihgtdpee.cc"; content:"|08|ihgtdpee|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129316; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ihjevvqijgy.org"; content:"|0b|ihjevvqijgy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129317; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ihmlzcsjgf.com"; content:"|0a|ihmlzcsjgf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129318; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ihmujcfa.ws"; content:"|08|ihmujcfa|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129319; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ihngdvznq.net"; content:"|09|ihngdvznq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129320; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ihocb.net"; content:"|05|ihocb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129321; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ihqrjgfqui.com"; content:"|0a|ihqrjgfqui|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129322; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ihrwkuubg.biz"; content:"|09|ihrwkuubg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129323; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ihsgu.com"; content:"|05|ihsgu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129324; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ihszwuvxj.info"; content:"|09|ihszwuvxj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129325; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ihvyydlx.org"; content:"|08|ihvyydlx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129326; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iifibanq.cc"; content:"|08|iifibanq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129327; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iigfekefk.cc"; content:"|09|iigfekefk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129328; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iiiiuduh.cc"; content:"|08|iiiiuduh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129329; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iiipoqk.cc"; content:"|07|iiipoqk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129330; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iijvwxpgbvl.ws"; content:"|0b|iijvwxpgbvl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129331; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iinqkqbkzur.ws"; content:"|0b|iinqkqbkzur|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129332; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iinvgqqg.info"; content:"|08|iinvgqqg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129333; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iiopjpl.info"; content:"|07|iiopjpl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129334; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iioqyztv.net"; content:"|08|iioqyztv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129335; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iislvzxhn.cn"; content:"|09|iislvzxhn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129336; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iivcd.org"; content:"|05|iivcd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129337; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iiyruifshj.net"; content:"|0a|iiyruifshj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129338; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ijbzaasaf.cn"; content:"|09|ijbzaasaf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129339; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ijgxkiwg.org"; content:"|08|ijgxkiwg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129340; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ijjlghqdnfr.net"; content:"|0b|ijjlghqdnfr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129341; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ijmyjw.ws"; content:"|06|ijmyjw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129342; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ijuglzxn.ws"; content:"|08|ijuglzxn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129343; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ijwqmkdexqd.ws"; content:"|0b|ijwqmkdexqd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129344; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ikagylezdbj.cc"; content:"|0b|ikagylezdbj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129345; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ikdcsup.ws"; content:"|07|ikdcsup|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129346; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ikhljcjo.cc"; content:"|08|ikhljcjo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129347; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ikkuhgejyjq.net"; content:"|0b|ikkuhgejyjq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129348; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ikliomeyia.net"; content:"|0a|ikliomeyia|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129349; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iknybbl.com"; content:"|07|iknybbl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129350; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ikqxqpcbytu.net"; content:"|0b|ikqxqpcbytu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129351; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iksdhzy.com"; content:"|07|iksdhzy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129352; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ikvcb.org"; content:"|05|ikvcb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129353; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ilmslht.net"; content:"|07|ilmslht|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129354; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ilscytqktce.cn"; content:"|0b|ilscytqktce|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129355; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ilsfprllg.ws"; content:"|09|ilsfprllg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129356; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iltnkk.cn"; content:"|06|iltnkk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129357; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iluspqutisq.biz"; content:"|0b|iluspqutisq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129358; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ilxaoen.org"; content:"|07|ilxaoen|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129359; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ilxdhiyphqw.net"; content:"|0b|ilxdhiyphqw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129360; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain imfopvwy.net"; content:"|08|imfopvwy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129361; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain imlmvsmeqg.net"; content:"|0a|imlmvsmeqg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129362; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain imsnquvl.net"; content:"|08|imsnquvl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129363; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain imzgslvkdw.info"; content:"|0a|imzgslvkdw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129364; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain imzwbwfn.biz"; content:"|08|imzwbwfn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129365; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain indff.cc"; content:"|05|indff|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129366; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain indpmmi.ws"; content:"|07|indpmmi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129367; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain infwthxxb.cc"; content:"|09|infwthxxb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129368; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain inkkmd.net"; content:"|06|inkkmd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129369; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain inkpkjng.org"; content:"|08|inkpkjng|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129370; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain inlnjmn.biz"; content:"|07|inlnjmn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129371; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain inosdsvppzg.net"; content:"|0b|inosdsvppzg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129372; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain inpetsc.cn"; content:"|07|inpetsc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129373; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain insurlqvhvh.cn"; content:"|0b|insurlqvhvh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129374; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain inuoywdrbig.ws"; content:"|0b|inuoywdrbig|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129375; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain invpimlqjcv.cn"; content:"|0b|invpimlqjcv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129376; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iobboe.net"; content:"|06|iobboe|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129377; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iobmwd.ws"; content:"|06|iobmwd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129378; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iofwzcvyndi.com"; content:"|0b|iofwzcvyndi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129379; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iohtposyx.cn"; content:"|09|iohtposyx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129380; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iokbebrvv.ws"; content:"|09|iokbebrvv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129381; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ioltnwekp.com"; content:"|09|ioltnwekp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129382; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iolymghkq.com"; content:"|09|iolymghkq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129383; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ionhpanp.info"; content:"|08|ionhpanp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129384; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iopca.com"; content:"|05|iopca|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129385; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ipbxqjtw.cn"; content:"|08|ipbxqjtw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129386; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ipbyyd.cc"; content:"|06|ipbyyd|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129387; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ipgjm.cn"; content:"|05|ipgjm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129388; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ipnnijl.com"; content:"|07|ipnnijl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129389; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ippoztyo.biz"; content:"|08|ippoztyo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129390; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ipvrkykk.com"; content:"|08|ipvrkykk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129391; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ipvvqlg.cc"; content:"|07|ipvvqlg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129392; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ipwrtz.biz"; content:"|06|ipwrtz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129393; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ipygmwg.net"; content:"|07|ipygmwg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129394; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iqdpqfkxn.biz"; content:"|09|iqdpqfkxn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129395; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iqfjdt.ws"; content:"|06|iqfjdt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129396; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iqiinulci.biz"; content:"|09|iqiinulci|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129397; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iqjbvesw.info"; content:"|08|iqjbvesw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129398; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iqkxvqb.net"; content:"|07|iqkxvqb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129399; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iqlvjs.net"; content:"|06|iqlvjs|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129400; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iqmeoiopqnf.net"; content:"|0b|iqmeoiopqnf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129401; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iqqoxervyqe.cc"; content:"|0b|iqqoxervyqe|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129402; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iqrrzg.com"; content:"|06|iqrrzg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129403; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iqymrsnpj.info"; content:"|09|iqymrsnpj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129404; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain irbhbjtltdz.org"; content:"|0b|irbhbjtltdz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129405; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain irfinh.net"; content:"|06|irfinh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129406; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain irhqx.info"; content:"|05|irhqx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129407; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain irkiak.cn"; content:"|06|irkiak|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129408; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain irlja.net"; content:"|05|irlja|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129409; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain irmicrxdv.biz"; content:"|09|irmicrxdv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129410; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain irnfflmj.cn"; content:"|08|irnfflmj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129411; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iroknwv.cn"; content:"|07|iroknwv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129412; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain irqcrig.net"; content:"|07|irqcrig|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129413; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain irsfwpqov.net"; content:"|09|irsfwpqov|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129414; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain irtrjrulskr.cn"; content:"|0b|irtrjrulskr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129415; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iruqcswwq.org"; content:"|09|iruqcswwq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129416; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain irxjj.com"; content:"|05|irxjj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129417; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain irzfh.ws"; content:"|05|irzfh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129418; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain isgfrlexwsh.net"; content:"|0b|isgfrlexwsh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129419; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain isgzewde.org"; content:"|08|isgzewde|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129420; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ishtldtsc.ws"; content:"|09|ishtldtsc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129421; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain isjfyzwoagg.cc"; content:"|0b|isjfyzwoagg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129422; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ismqzyjyijq.cn"; content:"|0b|ismqzyjyijq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129423; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ispxs.cc"; content:"|05|ispxs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129424; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain isrdvprl.info"; content:"|08|isrdvprl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129425; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain issddaa.com"; content:"|07|issddaa|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129426; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain isvmziky.ws"; content:"|08|isvmziky|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129427; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain isxadvt.org"; content:"|07|isxadvt|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129428; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain itckr.ws"; content:"|05|itckr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129429; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain itexqhz.org"; content:"|07|itexqhz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129430; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain itfuc.ws"; content:"|05|itfuc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129431; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ithbxuynrhf.net"; content:"|0b|ithbxuynrhf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129432; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain itijqfnycgb.net"; content:"|0b|itijqfnycgb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129433; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain itkhv.net"; content:"|05|itkhv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129434; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain itsuxznqcx.cc"; content:"|0a|itsuxznqcx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129435; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain itupksabkgh.biz"; content:"|0b|itupksabkgh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129436; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain itzhyjaa.biz"; content:"|08|itzhyjaa|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129437; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iuabxcnifae.net"; content:"|0b|iuabxcnifae|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129438; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iuiwmyzfv.info"; content:"|09|iuiwmyzfv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129439; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iujoavyb.cn"; content:"|08|iujoavyb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129440; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iulje.info"; content:"|05|iulje|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129441; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iunyjiqpjck.net"; content:"|0b|iunyjiqpjck|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129442; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iuolhwia.ws"; content:"|08|iuolhwia|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129443; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ivadsjpq.ws"; content:"|08|ivadsjpq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129444; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ivaja.net"; content:"|05|ivaja|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129445; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ivckqjgu.com"; content:"|08|ivckqjgu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129446; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ivfhicbys.org"; content:"|09|ivfhicbys|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129447; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ivgctiat.cn"; content:"|08|ivgctiat|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129448; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ivghjuxg.cn"; content:"|08|ivghjuxg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129449; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ivlvqfeq.biz"; content:"|08|ivlvqfeq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129450; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ivqbhqym.ws"; content:"|08|ivqbhqym|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129451; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ivzgpxusxs.com"; content:"|0a|ivzgpxusxs|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129452; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ivzugnycsyj.ws"; content:"|0b|ivzugnycsyj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129453; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iwccyx.info"; content:"|06|iwccyx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129454; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iwernulnbj.cc"; content:"|0a|iwernulnbj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129455; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iwfdncsc.net"; content:"|08|iwfdncsc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129456; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iwgaxdscz.cn"; content:"|09|iwgaxdscz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129457; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iwhbpxlg.biz"; content:"|08|iwhbpxlg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129458; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iwiksokfc.info"; content:"|09|iwiksokfc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129459; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iwjxhlwscwz.org"; content:"|0b|iwjxhlwscwz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129460; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iwmbxoktx.ws"; content:"|09|iwmbxoktx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129461; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iwnqje.cn"; content:"|06|iwnqje|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129462; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iwqlrxk.ws"; content:"|07|iwqlrxk|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129463; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iwrbccncrch.com"; content:"|0b|iwrbccncrch|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129464; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iwtejhwq.com"; content:"|08|iwtejhwq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129465; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iwtopuo.org"; content:"|07|iwtopuo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129466; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iwvznh.com"; content:"|06|iwvznh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129467; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iwwlkvcu.biz"; content:"|08|iwwlkvcu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129468; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iwzfaiieuz.cc"; content:"|0a|iwzfaiieuz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129469; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ixbhiw.com"; content:"|06|ixbhiw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129470; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ixcvsixkbv.info"; content:"|0a|ixcvsixkbv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129471; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ixgljkrl.com"; content:"|08|ixgljkrl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129472; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ixhktokfy.net"; content:"|09|ixhktokfy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129473; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ixiwnul.biz"; content:"|07|ixiwnul|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129474; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ixmvfz.biz"; content:"|06|ixmvfz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129475; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ixnvjpkdv.info"; content:"|09|ixnvjpkdv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129476; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ixpxwhtu.ws"; content:"|08|ixpxwhtu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129477; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ixtjsbkhl.ws"; content:"|09|ixtjsbkhl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129478; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ixutcqcgx.cn"; content:"|09|ixutcqcgx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129479; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ixydnwzoypf.net"; content:"|0b|ixydnwzoypf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129480; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iyfgmqaa.ws"; content:"|08|iyfgmqaa|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129481; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iygiuyek.cc"; content:"|08|iygiuyek|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129482; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iyjlxqnd.net"; content:"|08|iyjlxqnd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129483; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iykoikpqxf.com"; content:"|0a|iykoikpqxf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129484; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iyomneyn.cn"; content:"|08|iyomneyn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129485; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iyonguda.info"; content:"|08|iyonguda|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129486; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iyqfebgsogm.cc"; content:"|0b|iyqfebgsogm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129487; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iyqkpow.info"; content:"|07|iyqkpow|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129488; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iyrnhhjiz.org"; content:"|09|iyrnhhjiz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129489; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iyyaguwfnfs.net"; content:"|0b|iyyaguwfnfs|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129490; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain izegcfcipku.cc"; content:"|0b|izegcfcipku|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129491; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain izlplv.biz"; content:"|06|izlplv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129492; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain izoqbyos.com"; content:"|08|izoqbyos|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129493; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain izrxssv.biz"; content:"|07|izrxssv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129494; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain izswl.biz"; content:"|05|izswl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129495; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain iztcjhsjjm.info"; content:"|0a|iztcjhsjjm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129496; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain izuhuq.com"; content:"|06|izuhuq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129497; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain izxzwpiep.info"; content:"|09|izxzwpiep|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129498; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain izzfmhi.net"; content:"|07|izzfmhi|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129499; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jabckeofdi.info"; content:"|0a|jabckeofdi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129500; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jabdvcqw.com"; content:"|08|jabdvcqw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129501; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jabnutnss.cn"; content:"|09|jabnutnss|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129502; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jaezjxivvyi.org"; content:"|0b|jaezjxivvyi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129503; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jaidlnhm.com"; content:"|08|jaidlnhm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129504; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jaitzdar.cn"; content:"|08|jaitzdar|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129505; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jakcuf.net"; content:"|06|jakcuf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129506; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jalhu.cn"; content:"|05|jalhu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129507; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jalicbea.cn"; content:"|08|jalicbea|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129508; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jamrozes.com"; content:"|08|jamrozes|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129509; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain japjkhjgm.net"; content:"|09|japjkhjgm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129510; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jaqxypjhv.org"; content:"|09|jaqxypjhv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129511; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jatvinicj.cc"; content:"|09|jatvinicj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129512; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jawedt.info"; content:"|06|jawedt|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129513; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jayyxq.cc"; content:"|06|jayyxq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129514; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jazament.biz"; content:"|08|jazament|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129515; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jbfpoedwquy.org"; content:"|0b|jbfpoedwquy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129516; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jbhkh.cn"; content:"|05|jbhkh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129517; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jbhkow.org"; content:"|06|jbhkow|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129518; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jbinwggpawj.ws"; content:"|0b|jbinwggpawj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129519; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jbivl.ws"; content:"|05|jbivl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129520; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jblejs.cc"; content:"|06|jblejs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129521; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jbmcj.com"; content:"|05|jbmcj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129522; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jborwznyh.ws"; content:"|09|jborwznyh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129523; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jbqylnj.org"; content:"|07|jbqylnj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129524; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jbtcwcz.net"; content:"|07|jbtcwcz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129525; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jbtdotcr.cn"; content:"|08|jbtdotcr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129526; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jbvksxuo.ws"; content:"|08|jbvksxuo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129527; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jbvozzqqb.ws"; content:"|09|jbvozzqqb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129528; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jbxvllxwrle.cc"; content:"|0b|jbxvllxwrle|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129529; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jbzqa.com"; content:"|05|jbzqa|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129530; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jccwlxvqtjv.net"; content:"|0b|jccwlxvqtjv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129531; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jcdaqcvt.ws"; content:"|08|jcdaqcvt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129532; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jcdequdjrq.cc"; content:"|0a|jcdequdjrq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129533; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jcfcvjdq.cn"; content:"|08|jcfcvjdq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129534; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jcmihq.net"; content:"|06|jcmihq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129535; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jcmzqpokh.ws"; content:"|09|jcmzqpokh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129536; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jcohbhugmr.com"; content:"|0a|jcohbhugmr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129537; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jcutnre.net"; content:"|07|jcutnre|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129538; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jcvyykdu.biz"; content:"|08|jcvyykdu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129539; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jczgbwun.com"; content:"|08|jczgbwun|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129540; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jdbcwtgm.ws"; content:"|08|jdbcwtgm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129541; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jdcyrajj.org"; content:"|08|jdcyrajj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129542; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jdibvw.com"; content:"|06|jdibvw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129543; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jditsr.info"; content:"|06|jditsr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129544; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jdjeqr.com"; content:"|06|jdjeqr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129545; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jdnfjpvhb.cc"; content:"|09|jdnfjpvhb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129546; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jdnfnkxkt.cc"; content:"|09|jdnfnkxkt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129547; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jdood.ws"; content:"|05|jdood|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129548; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jdqrpbwstbj.org"; content:"|0b|jdqrpbwstbj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129549; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jduyjssm.org"; content:"|08|jduyjssm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129550; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jdwfmswtqn.net"; content:"|0a|jdwfmswtqn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129551; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jdxwmmv.org"; content:"|07|jdxwmmv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129552; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jdycjib.com"; content:"|07|jdycjib|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129553; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jeadywp.cn"; content:"|07|jeadywp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129554; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jecsydlgmqx.com"; content:"|0b|jecsydlgmqx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129555; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jeefjz.biz"; content:"|06|jeefjz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129556; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jeerpszg.org"; content:"|08|jeerpszg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129557; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jegphgtv.org"; content:"|08|jegphgtv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129558; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jehqb.ws"; content:"|05|jehqb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129559; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jeioptflu.net"; content:"|09|jeioptflu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129560; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jejhdxwk.com"; content:"|08|jejhdxwk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129561; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jelyup.org"; content:"|06|jelyup|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129562; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jemmtihtx.org"; content:"|09|jemmtihtx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129563; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jeogvtmpkw.net"; content:"|0a|jeogvtmpkw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129564; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jepfle.biz"; content:"|06|jepfle|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129565; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jepnmsku.info"; content:"|08|jepnmsku|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129566; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jeqrdwgk.net"; content:"|08|jeqrdwgk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129567; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jevvluzpmab.biz"; content:"|0b|jevvluzpmab|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129568; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jewjpmp.net"; content:"|07|jewjpmp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129569; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jezypdb.cc"; content:"|07|jezypdb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129570; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jfdesaw.info"; content:"|07|jfdesaw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129571; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jfgcvbglub.org"; content:"|0a|jfgcvbglub|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129572; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jfkdhaqi.cc"; content:"|08|jfkdhaqi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129573; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jfplbyviw.biz"; content:"|09|jfplbyviw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129574; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jfqzhxey.com"; content:"|08|jfqzhxey|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129575; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jfweubt.ws"; content:"|07|jfweubt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129576; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jgaalkipqbg.cn"; content:"|0b|jgaalkipqbg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129577; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jgiytcv.org"; content:"|07|jgiytcv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129578; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jgknidn.ws"; content:"|07|jgknidn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129579; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jgnhmf.com"; content:"|06|jgnhmf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129580; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jgqgbl.ws"; content:"|06|jgqgbl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129581; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jgstrr.org"; content:"|06|jgstrr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129582; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jgucvhb.biz"; content:"|07|jgucvhb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129583; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jhahkyes.cn"; content:"|08|jhahkyes|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129584; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jhcxjl.net"; content:"|06|jhcxjl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129585; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jhhotv.com"; content:"|06|jhhotv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129586; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jhhqexy.biz"; content:"|07|jhhqexy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129587; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jhirru.info"; content:"|06|jhirru|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129588; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jhoued.biz"; content:"|06|jhoued|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129589; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jhqdnr.com"; content:"|06|jhqdnr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129590; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jhwkxfto.net"; content:"|08|jhwkxfto|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129591; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jhwpfsjdd.com"; content:"|09|jhwpfsjdd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129592; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jhwxuiwa.info"; content:"|08|jhwxuiwa|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129593; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jhzyi.cn"; content:"|05|jhzyi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129594; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jiakadmxgbt.org"; content:"|0b|jiakadmxgbt|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129595; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jiefexjqtuo.ws"; content:"|0b|jiefexjqtuo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129596; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jifctzetg.cn"; content:"|09|jifctzetg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129597; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jifqp.ws"; content:"|05|jifqp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129598; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jihjohensha.info"; content:"|0b|jihjohensha|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129599; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jijdlwbnzd.cc"; content:"|0a|jijdlwbnzd|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129600; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jilrxp.com"; content:"|06|jilrxp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129601; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jilslkqa.ws"; content:"|08|jilslkqa|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129602; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jimlst.com"; content:"|06|jimlst|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129603; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jioczsa.biz"; content:"|07|jioczsa|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129604; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jipbtrgm.cc"; content:"|08|jipbtrgm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129605; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jirdqocobd.org"; content:"|0a|jirdqocobd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129606; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jizujppawme.ws"; content:"|0b|jizujppawme|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129607; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jjfmemmg.com"; content:"|08|jjfmemmg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129608; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jjhudjxxo.com"; content:"|09|jjhudjxxo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129609; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jjiwi.info"; content:"|05|jjiwi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129610; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jjnbonpddws.info"; content:"|0b|jjnbonpddws|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129611; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jjrezyhyr.com"; content:"|09|jjrezyhyr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129612; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jjsrxk.cn"; content:"|06|jjsrxk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129613; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jjteatfjc.biz"; content:"|09|jjteatfjc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129614; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jjwnwottaj.cn"; content:"|0a|jjwnwottaj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129615; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jjyos.ws"; content:"|05|jjyos|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129616; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jkejhatl.com"; content:"|08|jkejhatl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129617; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jkeqnrtab.ws"; content:"|09|jkeqnrtab|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129618; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jkfvujstz.org"; content:"|09|jkfvujstz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129619; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jkjickip.info"; content:"|08|jkjickip|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129620; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jkksaiurzct.net"; content:"|0b|jkksaiurzct|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129621; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jkltoeid.info"; content:"|08|jkltoeid|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129622; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jkqofitdi.ws"; content:"|09|jkqofitdi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129623; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jktwo.org"; content:"|05|jktwo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129624; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jkynqrjvurl.cn"; content:"|0b|jkynqrjvurl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129625; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jlbhpumk.org"; content:"|08|jlbhpumk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129626; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jlbnx.biz"; content:"|05|jlbnx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129627; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jlekv.info"; content:"|05|jlekv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129628; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jlewvk.biz"; content:"|06|jlewvk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129629; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jlhvtjrqgh.info"; content:"|0a|jlhvtjrqgh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129630; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jligobnmds.ws"; content:"|0a|jligobnmds|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129631; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jljsdzjcx.ws"; content:"|09|jljsdzjcx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129632; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jlovoypgyqa.info"; content:"|0b|jlovoypgyqa|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129633; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jlqqquu.cc"; content:"|07|jlqqquu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129634; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jlrjxlw.cc"; content:"|07|jlrjxlw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129635; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jlskldbtz.com"; content:"|09|jlskldbtz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129636; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jltvge.cn"; content:"|06|jltvge|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129637; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jlzohprrsur.com"; content:"|0b|jlzohprrsur|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129638; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jmijab.org"; content:"|06|jmijab|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129639; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jmiwwtvcf.ws"; content:"|09|jmiwwtvcf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129640; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jmkdiz.cc"; content:"|06|jmkdiz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129641; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jmlkvjzokl.ws"; content:"|0a|jmlkvjzokl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129642; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jmqtcujr.ws"; content:"|08|jmqtcujr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129643; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jmtgteu.cc"; content:"|07|jmtgteu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129644; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jmvmgpng.biz"; content:"|08|jmvmgpng|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129645; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jmzbsfdi.net"; content:"|08|jmzbsfdi|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129646; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jnari.cn"; content:"|05|jnari|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129647; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jnbashdbd.cn"; content:"|09|jnbashdbd|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129648; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jnebuhti.cn"; content:"|08|jnebuhti|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129649; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jnjwpwwcorp.org"; content:"|0b|jnjwpwwcorp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129650; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jnkyq.com"; content:"|05|jnkyq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129651; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jnprfevp.cc"; content:"|08|jnprfevp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129652; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jnszzzydkb.com"; content:"|0a|jnszzzydkb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129653; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jnumcnlvyh.ws"; content:"|0a|jnumcnlvyh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129654; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jnuwkczn.com"; content:"|08|jnuwkczn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129655; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jnvdomb.net"; content:"|07|jnvdomb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129656; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jnvuoqjke.cc"; content:"|09|jnvuoqjke|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129657; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jnyojvxhu.com"; content:"|09|jnyojvxhu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129658; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jocgofoycp.ws"; content:"|0a|jocgofoycp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129659; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jofldfwigs.cc"; content:"|0a|jofldfwigs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129660; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain johgkmk.cn"; content:"|07|johgkmk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129661; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jojkqzqg.net"; content:"|08|jojkqzqg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129662; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jononzqx.net"; content:"|08|jononzqx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129663; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jopfqajgxs.org"; content:"|0a|jopfqajgxs|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129664; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jorrvqjqom.cc"; content:"|0a|jorrvqjqom|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129665; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain joyqfalat.biz"; content:"|09|joyqfalat|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129666; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jpewmsae.org"; content:"|08|jpewmsae|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129667; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jpfxuz.cc"; content:"|06|jpfxuz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129668; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jpgcu.com"; content:"|05|jpgcu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129669; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jpoazbdbxqn.net"; content:"|0b|jpoazbdbxqn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129670; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jpomdad.cc"; content:"|07|jpomdad|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129671; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jppgt.com"; content:"|05|jppgt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129672; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jppyebxcx.com"; content:"|09|jppyebxcx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129673; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jpqnubgg.com"; content:"|08|jpqnubgg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129674; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jpveivgaql.cn"; content:"|0a|jpveivgaql|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129675; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jpyagsafi.biz"; content:"|09|jpyagsafi|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129676; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jqavkuoiku.cc"; content:"|0a|jqavkuoiku|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129677; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jqbyinde.org"; content:"|08|jqbyinde|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129678; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jqdcrkmy.cn"; content:"|08|jqdcrkmy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129679; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jqfkt.biz"; content:"|05|jqfkt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129680; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jqgbvlec.org"; content:"|08|jqgbvlec|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129681; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jqgcrbsy.info"; content:"|08|jqgcrbsy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129682; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jqicrmy.com"; content:"|07|jqicrmy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129683; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jqohmoi.net"; content:"|07|jqohmoi|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129684; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jqtwgha.ws"; content:"|07|jqtwgha|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129685; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jqylzsheej.cc"; content:"|0a|jqylzsheej|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129686; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jqzrmwtj.biz"; content:"|08|jqzrmwtj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129687; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jrarnfsa.org"; content:"|08|jrarnfsa|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129688; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jremmowa.ws"; content:"|08|jremmowa|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129689; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jrhcbsuow.info"; content:"|09|jrhcbsuow|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129690; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jrhxnvof.info"; content:"|08|jrhxnvof|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129691; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jrifph.cc"; content:"|06|jrifph|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129692; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jriqggkw.cn"; content:"|08|jriqggkw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129693; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jrrlhlpd.org"; content:"|08|jrrlhlpd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129694; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jrsiwwopmoo.cc"; content:"|0b|jrsiwwopmoo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129695; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jrsjvysq.net"; content:"|08|jrsjvysq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129696; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jrtowbqzzya.com"; content:"|0b|jrtowbqzzya|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129697; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jrurvavzpqp.ws"; content:"|0b|jrurvavzpqp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129698; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jrwnfxyf.biz"; content:"|08|jrwnfxyf|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129699; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jrzjfi.org"; content:"|06|jrzjfi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129700; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jshhubvb.net"; content:"|08|jshhubvb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129701; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jshzaor.com"; content:"|07|jshzaor|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129702; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jsiwx.net"; content:"|05|jsiwx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129703; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jsoscb.org"; content:"|06|jsoscb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129704; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jsudsdqs.net"; content:"|08|jsudsdqs|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129705; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jsvsvxhhji.net"; content:"|0a|jsvsvxhhji|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129706; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jsypnhvuro.cn"; content:"|0a|jsypnhvuro|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129707; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jtbcpmafbo.org"; content:"|0a|jtbcpmafbo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129708; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jtcsiupbx.info"; content:"|09|jtcsiupbx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129709; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jtcwtgktgnq.net"; content:"|0b|jtcwtgktgnq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129710; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jtfpb.info"; content:"|05|jtfpb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129711; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jtgmsvvvi.ws"; content:"|09|jtgmsvvvi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129712; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jtgxbsjb.net"; content:"|08|jtgxbsjb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129713; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jtktu.net"; content:"|05|jtktu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129714; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jtvdd.com"; content:"|05|jtvdd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129715; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jtwnqket.cc"; content:"|08|jtwnqket|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129716; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jtydjmpz.info"; content:"|08|jtydjmpz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129717; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain juatw.biz"; content:"|05|juatw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129718; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jubsjfzlos.ws"; content:"|0a|jubsjfzlos|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129719; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain juddqhftyxs.cc"; content:"|0b|juddqhftyxs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129720; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain juefqovw.ws"; content:"|08|juefqovw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129721; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jugasdg.ws"; content:"|07|jugasdg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129722; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jugncvhre.org"; content:"|09|jugncvhre|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129723; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jumdcd.ws"; content:"|06|jumdcd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129724; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain juqsxv.biz"; content:"|06|juqsxv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129725; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jutrnpkh.cn"; content:"|08|jutrnpkh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129726; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain juuwi.org"; content:"|05|juuwi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129727; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain juwleca.org"; content:"|07|juwleca|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129728; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain juyjjdxm.com"; content:"|08|juyjjdxm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129729; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain juyzzvean.ws"; content:"|09|juyzzvean|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129730; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jvbggpns.cc"; content:"|08|jvbggpns|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129731; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jvepsoqivk.info"; content:"|0a|jvepsoqivk|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129732; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jvsrws.com"; content:"|06|jvsrws|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129733; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jvwcrgyjkh.info"; content:"|0a|jvwcrgyjkh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129734; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jvwxmd.cc"; content:"|06|jvwxmd|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129735; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jvxrlzpn.com"; content:"|08|jvxrlzpn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129736; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jwkzoouzo.cn"; content:"|09|jwkzoouzo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129737; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jwmljqpe.org"; content:"|08|jwmljqpe|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129738; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jwpzs.com"; content:"|05|jwpzs|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129739; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jwtzclvu.org"; content:"|08|jwtzclvu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129740; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jwvujgnhbcq.org"; content:"|0b|jwvujgnhbcq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129741; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jwxjma.com"; content:"|06|jwxjma|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129742; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jwztbl.info"; content:"|06|jwztbl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129743; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jxcmyiq.cc"; content:"|07|jxcmyiq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129744; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jxdyunfi.org"; content:"|08|jxdyunfi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129745; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jxevw.cn"; content:"|05|jxevw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129746; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jxfmlmocanh.net"; content:"|0b|jxfmlmocanh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129747; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jxgdvhqvuy.info"; content:"|0a|jxgdvhqvuy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129748; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jxgycvdx.biz"; content:"|08|jxgycvdx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129749; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jxklwfylki.ws"; content:"|0a|jxklwfylki|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129750; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jxnkjfj.com"; content:"|07|jxnkjfj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129751; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jxtmwtvwvr.cn"; content:"|0a|jxtmwtvwvr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129752; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jxuwdnzqnno.cc"; content:"|0b|jxuwdnzqnno|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129753; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jxxjj.cn"; content:"|05|jxxjj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129754; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jxyjbipynqw.org"; content:"|0b|jxyjbipynqw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129755; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jxyrp.ws"; content:"|05|jxyrp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129756; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jycchzeam.net"; content:"|09|jycchzeam|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129757; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jyeoz.org"; content:"|05|jyeoz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129758; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jyesywspbw.info"; content:"|0a|jyesywspbw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129759; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jyfzrdnv.info"; content:"|08|jyfzrdnv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129760; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jygotrvf.cn"; content:"|08|jygotrvf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129761; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jygsai.com"; content:"|06|jygsai|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129762; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jyikqhhkhs.org"; content:"|0a|jyikqhhkhs|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129763; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jyjxtuyh.ws"; content:"|08|jyjxtuyh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129764; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jykzkb.org"; content:"|06|jykzkb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129765; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jysgukwf.com"; content:"|08|jysgukwf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129766; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jysifldtt.com"; content:"|09|jysifldtt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129767; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jyvmjuzamc.org"; content:"|0a|jyvmjuzamc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129768; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jyypl.net"; content:"|05|jyypl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129769; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jzadxxpqo.com"; content:"|09|jzadxxpqo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129770; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jzrnk.org"; content:"|05|jzrnk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129771; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jzsgcxxzjzx.ws"; content:"|0b|jzsgcxxzjzx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129772; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jzsscmysg.biz"; content:"|09|jzsscmysg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129773; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jztdvyt.ws"; content:"|07|jztdvyt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129774; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jzvsgzz.ws"; content:"|07|jzvsgzz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129775; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jzyeqxe.ws"; content:"|07|jzyeqxe|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129776; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain jzysmmczegi.cc"; content:"|0b|jzysmmczegi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129777; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kaakdh.biz"; content:"|06|kaakdh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129778; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kabwlu.org"; content:"|06|kabwlu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129779; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kaidednpdjr.ws"; content:"|0b|kaidednpdjr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129780; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kakvak.cc"; content:"|06|kakvak|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129781; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kanoxaugeio.cn"; content:"|0b|kanoxaugeio|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129782; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kaodhbm.ws"; content:"|07|kaodhbm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129783; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kapeo.org"; content:"|05|kapeo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129784; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kaplikfu.ws"; content:"|08|kaplikfu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129785; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain karqt.biz"; content:"|05|karqt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129786; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain katifafuar.net"; content:"|0a|katifafuar|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129787; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kaxzee.cc"; content:"|06|kaxzee|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129788; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kazkesyscua.com"; content:"|0b|kazkesyscua|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129789; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kbaqzjtzq.ws"; content:"|09|kbaqzjtzq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129790; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kbcmxwrcxwx.cn"; content:"|0b|kbcmxwrcxwx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129791; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kbcnyg.info"; content:"|06|kbcnyg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129792; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kberm.org"; content:"|05|kberm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129793; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kbfgkd.net"; content:"|06|kbfgkd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129794; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kbhfjkugg.net"; content:"|09|kbhfjkugg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129795; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kbjedftxmpr.cn"; content:"|0b|kbjedftxmpr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129796; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kbkcck.info"; content:"|06|kbkcck|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129797; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kbkgdwqo.org"; content:"|08|kbkgdwqo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129798; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kblczqjp.ws"; content:"|08|kblczqjp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129799; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kbmaae.cn"; content:"|06|kbmaae|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129800; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kbnoj.com"; content:"|05|kbnoj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129801; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kbqjfej.info"; content:"|07|kbqjfej|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129802; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kbqsht.cn"; content:"|06|kbqsht|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129803; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kbtgvwkxubt.com"; content:"|0b|kbtgvwkxubt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129804; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kbyzjgjkpze.biz"; content:"|0b|kbyzjgjkpze|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129805; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kceokxnrxub.cc"; content:"|0b|kceokxnrxub|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129806; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kcfqgdj.net"; content:"|07|kcfqgdj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129807; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kcgzznepby.org"; content:"|0a|kcgzznepby|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129808; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kckwpd.org"; content:"|06|kckwpd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129809; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kcnfufr.cc"; content:"|07|kcnfufr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129810; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kcnsvrtmljc.biz"; content:"|0b|kcnsvrtmljc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129811; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kcobcizolsb.org"; content:"|0b|kcobcizolsb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129812; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kcoqaac.net"; content:"|07|kcoqaac|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129813; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kcyqqyfribr.biz"; content:"|0b|kcyqqyfribr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129814; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kcyuyqstl.org"; content:"|09|kcyuyqstl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129815; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kdanmgsc.biz"; content:"|08|kdanmgsc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129816; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kdaurf.ws"; content:"|06|kdaurf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129817; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kdbgcsdgi.info"; content:"|09|kdbgcsdgi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129818; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kdeaeh.info"; content:"|06|kdeaeh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129819; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kdidhn.org"; content:"|06|kdidhn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129820; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kdmiasze.com"; content:"|08|kdmiasze|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129821; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kdnzuuzege.info"; content:"|0a|kdnzuuzege|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129822; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kdptjjvz.cn"; content:"|08|kdptjjvz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129823; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kdrbgmtwuv.info"; content:"|0a|kdrbgmtwuv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129824; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kdrjek.info"; content:"|06|kdrjek|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129825; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kdsgsjowet.info"; content:"|0a|kdsgsjowet|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129826; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kducgq.cc"; content:"|06|kducgq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129827; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kdwojboy.net"; content:"|08|kdwojboy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129828; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kdywjcvf.net"; content:"|08|kdywjcvf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129829; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain keixqfjd.com"; content:"|08|keixqfjd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129830; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kemxyqqvwm.net"; content:"|0a|kemxyqqvwm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129831; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kepgojljz.net"; content:"|09|kepgojljz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129832; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain keqsjwbcc.ws"; content:"|09|keqsjwbcc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129833; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kervuhfmwe.com"; content:"|0a|kervuhfmwe|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129834; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kethoya.biz"; content:"|07|kethoya|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129835; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kevnbgtnqss.biz"; content:"|0b|kevnbgtnqss|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129836; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kezcessl.cc"; content:"|08|kezcessl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129837; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kezfoyqs.cc"; content:"|08|kezfoyqs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129838; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kfbijxzg.biz"; content:"|08|kfbijxzg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129839; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kfccpk.cn"; content:"|06|kfccpk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129840; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kfdbwlqhs.biz"; content:"|09|kfdbwlqhs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129841; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kffqiyleidb.info"; content:"|0b|kffqiyleidb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129842; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kfgifmqp.org"; content:"|08|kfgifmqp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129843; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kfhthppe.info"; content:"|08|kfhthppe|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129844; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kfkoikgz.com"; content:"|08|kfkoikgz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129845; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kflwlilqacz.ws"; content:"|0b|kflwlilqacz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129846; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kfmjyzee.biz"; content:"|08|kfmjyzee|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129847; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kfmxpgjsnvc.org"; content:"|0b|kfmxpgjsnvc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129848; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kfnihjmics.info"; content:"|0a|kfnihjmics|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129849; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kfnssy.ws"; content:"|06|kfnssy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129850; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kfsbaxsjz.biz"; content:"|09|kfsbaxsjz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129851; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kfskvbab.cn"; content:"|08|kfskvbab|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129852; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kfthavdmot.cc"; content:"|0a|kfthavdmot|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129853; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kfylcp.ws"; content:"|06|kfylcp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129854; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kgbdnmzvw.cc"; content:"|09|kgbdnmzvw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129855; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kggnzotkewf.com"; content:"|0b|kggnzotkewf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129856; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kghudljm.info"; content:"|08|kghudljm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129857; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kglezqgnpx.biz"; content:"|0a|kglezqgnpx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129858; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kgppjzyr.cc"; content:"|08|kgppjzyr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129859; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kgqyd.info"; content:"|05|kgqyd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129860; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kgrlhunjov.cc"; content:"|0a|kgrlhunjov|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129861; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kgssnhi.net"; content:"|07|kgssnhi|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129862; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kgteuptkgn.cc"; content:"|0a|kgteuptkgn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129863; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kgtev.com"; content:"|05|kgtev|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129864; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kgxofkwww.biz"; content:"|09|kgxofkwww|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129865; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kgyjnowjge.info"; content:"|0a|kgyjnowjge|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129866; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kgzhvssg.cc"; content:"|08|kgzhvssg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129867; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kgztwfbwna.cc"; content:"|0a|kgztwfbwna|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129868; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain khekue.cn"; content:"|06|khekue|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129869; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain khemkno.com"; content:"|07|khemkno|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129870; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain khgtkee.cc"; content:"|07|khgtkee|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129871; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain khjngshgdc.cc"; content:"|0a|khjngshgdc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129872; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain khlvzelnrw.cn"; content:"|0a|khlvzelnrw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129873; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain khqofxcesuc.com"; content:"|0b|khqofxcesuc|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129874; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain khrbs.net"; content:"|05|khrbs|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129875; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain khxcpo.info"; content:"|06|khxcpo|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129876; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain khzlbvsj.org"; content:"|08|khzlbvsj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129877; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kibzrdqbgg.cc"; content:"|0a|kibzrdqbgg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129878; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kifeimeq.com"; content:"|08|kifeimeq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129879; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kijjpvwcjm.biz"; content:"|0a|kijjpvwcjm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129880; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kikjj.ws"; content:"|05|kikjj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129881; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kinrxruowoi.cn"; content:"|0b|kinrxruowoi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129882; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kiodorozrdi.ws"; content:"|0b|kiodorozrdi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129883; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kioivj.org"; content:"|06|kioivj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129884; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kiojxtduwkx.info"; content:"|0b|kiojxtduwkx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129885; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kiqzc.com"; content:"|05|kiqzc|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129886; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kitkwkt.biz"; content:"|07|kitkwkt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129887; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kiwrta.info"; content:"|06|kiwrta|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129888; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kiyql.cc"; content:"|05|kiyql|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129889; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kizufgjwr.cn"; content:"|09|kizufgjwr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129890; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kjaiiokb.net"; content:"|08|kjaiiokb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129891; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kjddixiusgs.org"; content:"|0b|kjddixiusgs|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129892; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kjekqf.cn"; content:"|06|kjekqf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129893; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kjhmgnsj.com"; content:"|08|kjhmgnsj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129894; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kjhyjocuwc.cn"; content:"|0a|kjhyjocuwc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129895; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kjiwzfkkk.org"; content:"|09|kjiwzfkkk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129896; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kjniifil.net"; content:"|08|kjniifil|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129897; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kjnnbsgv.net"; content:"|08|kjnnbsgv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129898; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kjqkifyytlb.biz"; content:"|0b|kjqkifyytlb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129899; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kjqlf.com"; content:"|05|kjqlf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129900; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kjrvhq.cn"; content:"|06|kjrvhq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129901; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kjyoqaedp.cn"; content:"|09|kjyoqaedp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129902; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kkczuibw.org"; content:"|08|kkczuibw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129903; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kkeatzqs.cc"; content:"|08|kkeatzqs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129904; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kkgkbpzlm.org"; content:"|09|kkgkbpzlm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129905; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kkglvs.info"; content:"|06|kkglvs|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129906; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kkigwlybrcj.biz"; content:"|0b|kkigwlybrcj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129907; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kklcn.ws"; content:"|05|kklcn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129908; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kkmexb.biz"; content:"|06|kkmexb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129909; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kknbtz.com"; content:"|06|kknbtz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129910; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kkntluxogmn.cc"; content:"|0b|kkntluxogmn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129911; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kkwht.ws"; content:"|05|kkwht|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129912; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kkwyfsnm.net"; content:"|08|kkwyfsnm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129913; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kkyhuxsx.info"; content:"|08|kkyhuxsx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129914; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kkzhkyqbsa.cc"; content:"|0a|kkzhkyqbsa|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129915; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain klbzkuzv.com"; content:"|08|klbzkuzv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129916; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain klckjsuvot.com"; content:"|0a|klckjsuvot|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129917; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain klczi.info"; content:"|05|klczi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129918; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kljdmivs.net"; content:"|08|kljdmivs|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129919; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain klkmxtog.com"; content:"|08|klkmxtog|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129920; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain klngcaxuq.org"; content:"|09|klngcaxuq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129921; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain klsgwyuyni.com"; content:"|0a|klsgwyuyni|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129922; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain klsrpmfwz.net"; content:"|09|klsrpmfwz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129923; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain klvjhlqdjnt.info"; content:"|0b|klvjhlqdjnt|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129924; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain klwippuwyww.info"; content:"|0b|klwippuwyww|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129925; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kmdxvmegqnm.com"; content:"|0b|kmdxvmegqnm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129926; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kmeypjz.info"; content:"|07|kmeypjz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129927; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kmghsdkdlc.cn"; content:"|0a|kmghsdkdlc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129928; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kmioqd.com"; content:"|06|kmioqd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129929; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kmkejz.net"; content:"|06|kmkejz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129930; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kmldbkdzuq.net"; content:"|0a|kmldbkdzuq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129931; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kmmynovlf.biz"; content:"|09|kmmynovlf|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129932; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kmnaavb.info"; content:"|07|kmnaavb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129933; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kmosedju.net"; content:"|08|kmosedju|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129934; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kmqccb.cc"; content:"|06|kmqccb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129935; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kmtrnv.ws"; content:"|06|kmtrnv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129936; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kmudwd.net"; content:"|06|kmudwd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129937; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain knappoiw.com"; content:"|08|knappoiw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129938; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain knfjhsstibw.info"; content:"|0b|knfjhsstibw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129939; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain knfsfzpqlnm.ws"; content:"|0b|knfsfzpqlnm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129940; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kngoyei.ws"; content:"|07|kngoyei|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129941; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain knkli.org"; content:"|05|knkli|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129942; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain knmas.cc"; content:"|05|knmas|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129943; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain knoxewxx.cc"; content:"|08|knoxewxx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129944; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain knsoyz.com"; content:"|06|knsoyz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129945; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kntkt.biz"; content:"|05|kntkt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129946; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain knxjt.net"; content:"|05|knxjt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129947; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain knykcmzgtvi.org"; content:"|0b|knykcmzgtvi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129948; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain knzezxln.com"; content:"|08|knzezxln|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129949; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain koaznx.cc"; content:"|06|koaznx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129950; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kobsus.info"; content:"|06|kobsus|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129951; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain koflrayvm.org"; content:"|09|koflrayvm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129952; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kogpc.org"; content:"|05|kogpc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129953; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kohjdc.org"; content:"|06|kohjdc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129954; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kojvkur.com"; content:"|07|kojvkur|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129955; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain korbrc.net"; content:"|06|korbrc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129956; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kpcuzgrvc.org"; content:"|09|kpcuzgrvc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129957; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kpfczebeqy.biz"; content:"|0a|kpfczebeqy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129958; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kphfru.org"; content:"|06|kphfru|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129959; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kpiajdeig.cn"; content:"|09|kpiajdeig|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129960; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kprejxre.net"; content:"|08|kprejxre|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129961; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kpuco.org"; content:"|05|kpuco|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129962; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kpuxelzixhf.cn"; content:"|0b|kpuxelzixhf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129963; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kpwus.net"; content:"|05|kpwus|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129964; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kpxblyge.org"; content:"|08|kpxblyge|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129965; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kpznavaza.cn"; content:"|09|kpznavaza|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129966; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kqafq.cn"; content:"|05|kqafq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129967; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kqciogecta.net"; content:"|0a|kqciogecta|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129968; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kqctexogkt.cn"; content:"|0a|kqctexogkt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129969; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kqdxqoozork.ws"; content:"|0b|kqdxqoozork|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129970; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kqefnaxx.com"; content:"|08|kqefnaxx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129971; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kqeitee.org"; content:"|07|kqeitee|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129972; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kqfjjrcrs.info"; content:"|09|kqfjjrcrs|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129973; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kqhfjxcaxb.ws"; content:"|0a|kqhfjxcaxb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129974; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kqigshunns.info"; content:"|0a|kqigshunns|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129975; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kqixatuuvmx.cn"; content:"|0b|kqixatuuvmx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129976; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kqlzfodpxt.cn"; content:"|0a|kqlzfodpxt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129977; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kqnwlqc.ws"; content:"|07|kqnwlqc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129978; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kquxcv.info"; content:"|06|kquxcv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129979; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kqzsks.cn"; content:"|06|kqzsks|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129980; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain krcping.cc"; content:"|07|krcping|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129981; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain krffyfbjum.cn"; content:"|0a|krffyfbjum|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129982; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain krgtlwvon.com"; content:"|09|krgtlwvon|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129983; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain krhtb.net"; content:"|05|krhtb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129984; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain krkomjnjvdm.org"; content:"|0b|krkomjnjvdm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129985; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain krkxsfnewph.net"; content:"|0b|krkxsfnewph|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129986; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain krkyolxxori.info"; content:"|0b|krkyolxxori|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129987; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain krplb.cn"; content:"|05|krplb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129988; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain krpucnkn.info"; content:"|08|krpucnkn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129989; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain krsbiqkxu.ws"; content:"|09|krsbiqkxu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129990; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain krzzebiokxn.biz"; content:"|0b|krzzebiokxn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129991; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ksdirtszwm.biz"; content:"|0a|ksdirtszwm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129992; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ksdwngsj.info"; content:"|08|ksdwngsj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129993; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ksezal.org"; content:"|06|ksezal|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129994; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ksiskjsfmpw.biz"; content:"|0b|ksiskjsfmpw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129995; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kskqtgp.cn"; content:"|07|kskqtgp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129996; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ksluv.org"; content:"|05|ksluv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129997; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kslyqhld.biz"; content:"|08|kslyqhld|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129998; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ksoae.com"; content:"|05|ksoae|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1129999; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ksulw.cn"; content:"|05|ksulw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130000; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ktagernat.cc"; content:"|09|ktagernat|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130001; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ktcxiwz.org"; content:"|07|ktcxiwz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130002; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ktecbbfcd.net"; content:"|09|ktecbbfcd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130003; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ktetadil.cc"; content:"|08|ktetadil|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130004; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ktuipkox.info"; content:"|08|ktuipkox|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130005; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ktzewdtw.cn"; content:"|08|ktzewdtw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130006; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kueosxtp.net"; content:"|08|kueosxtp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130007; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kuesazza.biz"; content:"|08|kuesazza|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130008; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kujggnorxq.biz"; content:"|0a|kujggnorxq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130009; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kuklv.net"; content:"|05|kuklv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130010; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kulsvon.info"; content:"|07|kulsvon|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130011; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kuonxhmii.cc"; content:"|09|kuonxhmii|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130012; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kuoyqqzv.biz"; content:"|08|kuoyqqzv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130013; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kvalczyrqx.net"; content:"|0a|kvalczyrqx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130014; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kvcvw.org"; content:"|05|kvcvw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130015; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kvdlfcmvdtw.com"; content:"|0b|kvdlfcmvdtw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130016; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kvfvpszaxv.biz"; content:"|0a|kvfvpszaxv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130017; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kvgfibjs.cn"; content:"|08|kvgfibjs|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130018; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kvhowuxsrgv.info"; content:"|0b|kvhowuxsrgv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130019; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kvjdwaticz.biz"; content:"|0a|kvjdwaticz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130020; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kvmjsceq.ws"; content:"|08|kvmjsceq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130021; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kvnrzofj.cc"; content:"|08|kvnrzofj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130022; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kvnvwkah.biz"; content:"|08|kvnvwkah|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130023; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kvquwwr.com"; content:"|07|kvquwwr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130024; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kvuyljpi.biz"; content:"|08|kvuyljpi|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130025; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kvwjrhbizco.com"; content:"|0b|kvwjrhbizco|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130026; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kvxqioqbtlt.cn"; content:"|0b|kvxqioqbtlt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130027; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kvzqusr.cn"; content:"|07|kvzqusr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130028; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kwfnwepb.cc"; content:"|08|kwfnwepb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130029; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kwggzmqdyy.info"; content:"|0a|kwggzmqdyy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130030; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kwnnmpfu.ws"; content:"|08|kwnnmpfu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130031; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kwsdx.cn"; content:"|05|kwsdx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130032; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kwsrgoee.cn"; content:"|08|kwsrgoee|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130033; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kwvjag.com"; content:"|06|kwvjag|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130034; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kwwct.ws"; content:"|05|kwwct|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130035; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kwzspahcrj.cc"; content:"|0a|kwzspahcrj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130036; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kxkkh.info"; content:"|05|kxkkh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130037; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kxnfjgrob.cc"; content:"|09|kxnfjgrob|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130038; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kxorgujdni.cn"; content:"|0a|kxorgujdni|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130039; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kyfftsec.cc"; content:"|08|kyfftsec|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130040; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kyilqhaevt.biz"; content:"|0a|kyilqhaevt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130041; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kyiyfagnz.biz"; content:"|09|kyiyfagnz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130042; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kylkzice.cc"; content:"|08|kylkzice|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130043; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kylolwnmj.org"; content:"|09|kylolwnmj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130044; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kymuzqkr.cn"; content:"|08|kymuzqkr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130045; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kyouuzjw.info"; content:"|08|kyouuzjw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130046; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kyphofer.com"; content:"|08|kyphofer|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130047; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kypjuqrhlz.cc"; content:"|0a|kypjuqrhlz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130048; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kyvccblhttl.com"; content:"|0b|kyvccblhttl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130049; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kzccgbcb.net"; content:"|08|kzccgbcb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130050; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kzcovjoobnl.net"; content:"|0b|kzcovjoobnl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130051; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kzecvfp.cc"; content:"|07|kzecvfp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130052; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kzlqfkcupqk.biz"; content:"|0b|kzlqfkcupqk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130053; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kzlrpv.com"; content:"|06|kzlrpv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130054; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kznbxxjl.info"; content:"|08|kznbxxjl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130055; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kznpfaks.net"; content:"|08|kznpfaks|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130056; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kzqfmvht.ws"; content:"|08|kzqfmvht|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130057; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kzrhezfoszp.com"; content:"|0b|kzrhezfoszp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130058; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kzunuz.cc"; content:"|06|kzunuz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130059; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kzwiabol.cc"; content:"|08|kzwiabol|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130060; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kzwzlubo.ws"; content:"|08|kzwzlubo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130061; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain kzzkemba.biz"; content:"|08|kzzkemba|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130062; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain laavtvp.ws"; content:"|07|laavtvp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130063; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain labswbl.info"; content:"|07|labswbl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130064; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lacxit.com"; content:"|06|lacxit|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130065; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lamhplpadkn.biz"; content:"|0b|lamhplpadkn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130066; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lapfhaip.org"; content:"|08|lapfhaip|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130067; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lapqqhkh.cc"; content:"|08|lapqqhkh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130068; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain laqbfukn.biz"; content:"|08|laqbfukn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130069; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain laszjkmr.biz"; content:"|08|laszjkmr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130070; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain latovxref.ws"; content:"|09|latovxref|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130071; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lavvtyw.org"; content:"|07|lavvtyw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130072; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lawserfp.biz"; content:"|08|lawserfp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130073; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain layxzdlrsmk.net"; content:"|0b|layxzdlrsmk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130074; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lbadyevykqa.biz"; content:"|0b|lbadyevykqa|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130075; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lbbgspxcapv.com"; content:"|0b|lbbgspxcapv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130076; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lbcdyiaf.net"; content:"|08|lbcdyiaf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130077; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lbetgwwshrf.biz"; content:"|0b|lbetgwwshrf|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130078; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lbiacffzyq.com"; content:"|0a|lbiacffzyq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130079; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lbjuztui.cn"; content:"|08|lbjuztui|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130080; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lbpkpo.com"; content:"|06|lbpkpo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130081; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lbqcxvl.org"; content:"|07|lbqcxvl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130082; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lbsdttye.net"; content:"|08|lbsdttye|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130083; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lbukbh.cc"; content:"|06|lbukbh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130084; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lbviyjpawyb.org"; content:"|0b|lbviyjpawyb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130085; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lbxxncoun.biz"; content:"|09|lbxxncoun|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130086; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lbzhloql.info"; content:"|08|lbzhloql|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130087; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lcacrfgplm.org"; content:"|0a|lcacrfgplm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130088; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lceya.org"; content:"|05|lceya|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130089; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lchcghpdki.org"; content:"|0a|lchcghpdki|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130090; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lclzxcgyoqm.com"; content:"|0b|lclzxcgyoqm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130091; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lcnomkjdmhe.com"; content:"|0b|lcnomkjdmhe|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130092; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lcotclj.biz"; content:"|07|lcotclj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130093; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lcqricmzgbv.org"; content:"|0b|lcqricmzgbv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130094; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lctbfosxawh.cn"; content:"|0b|lctbfosxawh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130095; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ldeoxmn.cc"; content:"|07|ldeoxmn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130096; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ldfvnlxp.cn"; content:"|08|ldfvnlxp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130097; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ldhhxmyjow.com"; content:"|0a|ldhhxmyjow|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130098; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ldjadfao.info"; content:"|08|ldjadfao|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130099; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ldlllczroy.cn"; content:"|0a|ldlllczroy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130100; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ldnlnovmr.cn"; content:"|09|ldnlnovmr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130101; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ldttpgbn.net"; content:"|08|ldttpgbn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130102; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ldwbkwx.cc"; content:"|07|ldwbkwx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130103; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ldxsrges.cn"; content:"|08|ldxsrges|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130104; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ldziqmb.biz"; content:"|07|ldziqmb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130105; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain leamcwl.org"; content:"|07|leamcwl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130106; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lefphevoo.info"; content:"|09|lefphevoo|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130107; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain leilbiao.cn"; content:"|08|leilbiao|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130108; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lejfuw.com"; content:"|06|lejfuw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130109; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lemfbgsj.cc"; content:"|08|lemfbgsj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130110; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lepgqph.cc"; content:"|07|lepgqph|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130111; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lepguwufg.cc"; content:"|09|lepguwufg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130112; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain leplvkseal.biz"; content:"|0a|leplvkseal|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130113; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lesxnjput.biz"; content:"|09|lesxnjput|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130114; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain leukhhw.ws"; content:"|07|leukhhw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130115; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain leuqwylx.ws"; content:"|08|leuqwylx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130116; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain levdit.org"; content:"|06|levdit|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130117; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain levkkxfx.info"; content:"|08|levkkxfx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130118; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain levtcezncju.cc"; content:"|0b|levtcezncju|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130119; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lezftefv.biz"; content:"|08|lezftefv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130120; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lfbhhsmfb.biz"; content:"|09|lfbhhsmfb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130121; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lfcaxwpgvfx.net"; content:"|0b|lfcaxwpgvfx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130122; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lfdsvxv.ws"; content:"|07|lfdsvxv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130123; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lfhfip.info"; content:"|06|lfhfip|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130124; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lfhkc.ws"; content:"|05|lfhkc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130125; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lfopgqmwzkr.org"; content:"|0b|lfopgqmwzkr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130126; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lfraw.cc"; content:"|05|lfraw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130127; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lftaypcw.com"; content:"|08|lftaypcw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130128; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lfudaptg.biz"; content:"|08|lfudaptg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130129; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lfwcsuov.ws"; content:"|08|lfwcsuov|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130130; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lfwknnsae.net"; content:"|09|lfwknnsae|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130131; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lgbjsbsouxx.cn"; content:"|0b|lgbjsbsouxx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130132; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lgcef.ws"; content:"|05|lgcef|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130133; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lgdfxrjl.org"; content:"|08|lgdfxrjl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130134; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lgeqvhecc.com"; content:"|09|lgeqvhecc|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130135; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lgfqxup.cc"; content:"|07|lgfqxup|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130136; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lgpwfrtwg.info"; content:"|09|lgpwfrtwg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130137; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lgrhkzke.cn"; content:"|08|lgrhkzke|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130138; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lgxzctv.com"; content:"|07|lgxzctv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130139; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lgydzbrf.com"; content:"|08|lgydzbrf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130140; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lgyqllchsv.biz"; content:"|0a|lgyqllchsv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130141; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lgyzi.net"; content:"|05|lgyzi|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130142; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lhckzqsav.org"; content:"|09|lhckzqsav|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130143; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lhdtyww.cn"; content:"|07|lhdtyww|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130144; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lhgwx.net"; content:"|05|lhgwx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130145; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lhscgxy.cc"; content:"|07|lhscgxy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130146; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lhtptyaqbzw.biz"; content:"|0b|lhtptyaqbzw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130147; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lhujhva.biz"; content:"|07|lhujhva|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130148; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lhxgjjrve.com"; content:"|09|lhxgjjrve|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130149; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lhxtzh.cn"; content:"|06|lhxtzh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130150; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lhyxnywc.org"; content:"|08|lhyxnywc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130151; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain libau.info"; content:"|05|libau|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130152; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain licvefkyv.biz"; content:"|09|licvefkyv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130153; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain licvt.com"; content:"|05|licvt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130154; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ligztnjq.cn"; content:"|08|ligztnjq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130155; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lihwxrb.net"; content:"|07|lihwxrb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130156; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lijalqz.cc"; content:"|07|lijalqz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130157; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lilaqgzv.info"; content:"|08|lilaqgzv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130158; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lilvmg.info"; content:"|06|lilvmg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130159; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain limvvft.cn"; content:"|07|limvvft|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130160; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lismx.com"; content:"|05|lismx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130161; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lisqdbpp.info"; content:"|08|lisqdbpp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130162; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain liwpt.biz"; content:"|05|liwpt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130163; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain liylpe.net"; content:"|06|liylpe|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130164; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ljagwg.info"; content:"|06|ljagwg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130165; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ljeyoqc.org"; content:"|07|ljeyoqc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130166; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ljlod.net"; content:"|05|ljlod|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130167; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ljrbkqcrqi.com"; content:"|0a|ljrbkqcrqi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130168; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ljumoy.ws"; content:"|06|ljumoy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130169; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ljwvjzaugyq.cn"; content:"|0b|ljwvjzaugyq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130170; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ljykxh.ws"; content:"|06|ljykxh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130171; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lkagyesmorz.cc"; content:"|0b|lkagyesmorz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130172; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lkgthytparf.org"; content:"|0b|lkgthytparf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130173; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lkkkyv.org"; content:"|06|lkkkyv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130174; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lknkaotkis.biz"; content:"|0a|lknkaotkis|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130175; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lkprlw.org"; content:"|06|lkprlw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130176; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lkscwmd.org"; content:"|07|lkscwmd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130177; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lksuvvj.ws"; content:"|07|lksuvvj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130178; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lkvfxxja.cc"; content:"|08|lkvfxxja|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130179; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lkzdwqes.ws"; content:"|08|lkzdwqes|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130180; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain llbifif.org"; content:"|07|llbifif|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130181; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain llbqhwaa.net"; content:"|08|llbqhwaa|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130182; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain llgkffu.cn"; content:"|07|llgkffu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130183; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain llhvgqnfgbp.biz"; content:"|0b|llhvgqnfgbp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130184; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lljuaywj.net"; content:"|08|lljuaywj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130185; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain llmsbubdlo.org"; content:"|0a|llmsbubdlo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130186; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain llpklfnfkq.org"; content:"|0a|llpklfnfkq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130187; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain llqkvwuwjn.net"; content:"|0a|llqkvwuwjn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130188; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain llvbscv.ws"; content:"|07|llvbscv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130189; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain llybsti.net"; content:"|07|llybsti|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130190; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain llzeiptp.info"; content:"|08|llzeiptp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130191; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lmdxyqjklje.cc"; content:"|0b|lmdxyqjklje|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130192; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lmieabyz.cc"; content:"|08|lmieabyz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130193; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lmmqxqsz.biz"; content:"|08|lmmqxqsz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130194; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lmvvxbwwi.cn"; content:"|09|lmvvxbwwi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130195; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lnaiwrwq.cc"; content:"|08|lnaiwrwq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130196; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lnfjl.net"; content:"|05|lnfjl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130197; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lngrvapo.org"; content:"|08|lngrvapo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130198; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lnindbrozr.org"; content:"|0a|lnindbrozr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130199; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lnldlbgh.com"; content:"|08|lnldlbgh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130200; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lnnffu.net"; content:"|06|lnnffu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130201; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lntimtmspd.com"; content:"|0a|lntimtmspd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130202; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lnyzxnau.info"; content:"|08|lnyzxnau|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130203; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lnznoplv.net"; content:"|08|lnznoplv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130204; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lobbsr.ws"; content:"|06|lobbsr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130205; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lokfjm.info"; content:"|06|lokfjm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130206; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain loqixmtww.cn"; content:"|09|loqixmtww|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130207; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain loswpqt.com"; content:"|07|loswpqt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130208; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain loyzloynwrh.net"; content:"|0b|loyzloynwrh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130209; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lpcjlpaa.net"; content:"|08|lpcjlpaa|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130210; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lpjks.org"; content:"|05|lpjks|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130211; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lpjuvnrtz.cc"; content:"|09|lpjuvnrtz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130212; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lpqhbjxh.ws"; content:"|08|lpqhbjxh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130213; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lpqnuhjbay.biz"; content:"|0a|lpqnuhjbay|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130214; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lptzfueg.cn"; content:"|08|lptzfueg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130215; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lpwtdzbvm.info"; content:"|09|lpwtdzbvm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130216; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lqacxgic.cn"; content:"|08|lqacxgic|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130217; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lqbcjdegrrf.com"; content:"|0b|lqbcjdegrrf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130218; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lqcmuqj.com"; content:"|07|lqcmuqj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130219; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lqfhtgxj.biz"; content:"|08|lqfhtgxj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130220; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lqjofntbgtn.cc"; content:"|0b|lqjofntbgtn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130221; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lqpmoou.info"; content:"|07|lqpmoou|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130222; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lqqksbh.info"; content:"|07|lqqksbh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130223; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lqvlqs.info"; content:"|06|lqvlqs|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130224; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lqwapn.biz"; content:"|06|lqwapn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130225; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lqzjyqgadrr.org"; content:"|0b|lqzjyqgadrr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130226; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lraimnezh.info"; content:"|09|lraimnezh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130227; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lrbmaqo.biz"; content:"|07|lrbmaqo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130228; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lrcrdqob.com"; content:"|08|lrcrdqob|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130229; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lrdpygr.com"; content:"|07|lrdpygr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130230; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lrebbebg.net"; content:"|08|lrebbebg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130231; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lrfbslewzb.org"; content:"|0a|lrfbslewzb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130232; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lrmmciju.org"; content:"|08|lrmmciju|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130233; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lrmvadlzz.cn"; content:"|09|lrmvadlzz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130234; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lrpopiir.info"; content:"|08|lrpopiir|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130235; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lrrfeazw.cn"; content:"|08|lrrfeazw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130236; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lrrkcmirgqz.net"; content:"|0b|lrrkcmirgqz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130237; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lruhrk.org"; content:"|06|lruhrk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130238; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lrveyml.net"; content:"|07|lrveyml|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130239; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lrvgboat.ws"; content:"|08|lrvgboat|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130240; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lrvqf.net"; content:"|05|lrvqf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130241; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lryqydo.ws"; content:"|07|lryqydo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130242; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lrzdbdi.cn"; content:"|07|lrzdbdi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130243; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lsamtfbq.ws"; content:"|08|lsamtfbq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130244; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lsdbo.org"; content:"|05|lsdbo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130245; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lsesjtcyie.ws"; content:"|0a|lsesjtcyie|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130246; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lsjarjt.net"; content:"|07|lsjarjt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130247; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lslboxexyt.cn"; content:"|0a|lslboxexyt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130248; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lsmentxo.com"; content:"|08|lsmentxo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130249; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lspeupro.org"; content:"|08|lspeupro|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130250; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lsqkxxcdn.net"; content:"|09|lsqkxxcdn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130251; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lssulgcm.cn"; content:"|08|lssulgcm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130252; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lsvppptj.info"; content:"|08|lsvppptj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130253; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ltawctpzslx.net"; content:"|0b|ltawctpzslx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130254; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ltawdivtyy.biz"; content:"|0a|ltawdivtyy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130255; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ltbnatvp.cn"; content:"|08|ltbnatvp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130256; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ltctylng.org"; content:"|08|ltctylng|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130257; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ltdqw.ws"; content:"|05|ltdqw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130258; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lteiz.biz"; content:"|05|lteiz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130259; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ltfrxqm.org"; content:"|07|ltfrxqm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130260; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ltgdjtnj.cn"; content:"|08|ltgdjtnj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130261; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ltjlvuhh.org"; content:"|08|ltjlvuhh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130262; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ltltrqrf.net"; content:"|08|ltltrqrf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130263; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ltmewvkv.info"; content:"|08|ltmewvkv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130264; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ltocgoztntx.com"; content:"|0b|ltocgoztntx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130265; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ltptp.info"; content:"|05|ltptp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130266; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ltrfbd.ws"; content:"|06|ltrfbd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130267; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lttulxd.biz"; content:"|07|lttulxd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130268; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ltwwvbyorw.info"; content:"|0a|ltwwvbyorw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130269; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ltztfnxblmo.cn"; content:"|0b|ltztfnxblmo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130270; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lucwagmlpm.biz"; content:"|0a|lucwagmlpm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130271; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain luhiivbou.info"; content:"|09|luhiivbou|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130272; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain luhkv.cn"; content:"|05|luhkv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130273; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain luhwerfsm.com"; content:"|09|luhwerfsm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130274; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lukufcsgrn.cn"; content:"|0a|lukufcsgrn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130275; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lulpoqrtqm.org"; content:"|0a|lulpoqrtqm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130276; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lumubdwc.com"; content:"|08|lumubdwc|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130277; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain luprzhe.ws"; content:"|07|luprzhe|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130278; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain luurq.cc"; content:"|05|luurq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130279; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain luvffoalh.cc"; content:"|09|luvffoalh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130280; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain luvml.net"; content:"|05|luvml|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130281; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain luyfytecc.cn"; content:"|09|luyfytecc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130282; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lvawhes.cn"; content:"|07|lvawhes|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130283; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lvfmopm.ws"; content:"|07|lvfmopm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130284; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lvihum.net"; content:"|06|lvihum|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130285; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lvizng.ws"; content:"|06|lvizng|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130286; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lvknkzxc.cn"; content:"|08|lvknkzxc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130287; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lvoefbgi.cn"; content:"|08|lvoefbgi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130288; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lvwgbr.biz"; content:"|06|lvwgbr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130289; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lvwump.ws"; content:"|06|lvwump|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130290; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lwaeuuvymi.cc"; content:"|0a|lwaeuuvymi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130291; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lwdrbfzp.org"; content:"|08|lwdrbfzp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130292; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lwedvgbhff.ws"; content:"|0a|lwedvgbhff|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130293; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lwktihsz.biz"; content:"|08|lwktihsz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130294; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lwncni.biz"; content:"|06|lwncni|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130295; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lwperm.com"; content:"|06|lwperm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130296; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lwuldrah.net"; content:"|08|lwuldrah|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130297; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lwybwpjr.ws"; content:"|08|lwybwpjr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130298; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lxdlenc.net"; content:"|07|lxdlenc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130299; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lxerzody.biz"; content:"|08|lxerzody|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130300; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lxevnowwpz.ws"; content:"|0a|lxevnowwpz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130301; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lxfacgnj.info"; content:"|08|lxfacgnj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130302; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lxgebl.info"; content:"|06|lxgebl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130303; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lxidnjd.org"; content:"|07|lxidnjd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130304; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lxijqgcudv.biz"; content:"|0a|lxijqgcudv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130305; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lxmxwti.com"; content:"|07|lxmxwti|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130306; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lxnqt.info"; content:"|05|lxnqt|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130307; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lxpdehemrtw.cn"; content:"|0b|lxpdehemrtw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130308; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lxqtljlcht.info"; content:"|0a|lxqtljlcht|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130309; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lxrjqrhshsb.ws"; content:"|0b|lxrjqrhshsb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130310; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lxtoihiqr.biz"; content:"|09|lxtoihiqr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130311; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lxvulvmvk.biz"; content:"|09|lxvulvmvk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130312; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lxwcgsuz.com"; content:"|08|lxwcgsuz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130313; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lxyafyer.biz"; content:"|08|lxyafyer|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130314; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lybewksz.biz"; content:"|08|lybewksz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130315; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lydjdghk.net"; content:"|08|lydjdghk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130316; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lyeab.org"; content:"|05|lyeab|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130317; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lyedqacpfn.cc"; content:"|0a|lyedqacpfn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130318; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lyguudv.info"; content:"|07|lyguudv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130319; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lymysnsgmfy.com"; content:"|0b|lymysnsgmfy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130320; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lyosgrojluf.info"; content:"|0b|lyosgrojluf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130321; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lyqxnsl.info"; content:"|07|lyqxnsl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130322; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lyrgukfxv.biz"; content:"|09|lyrgukfxv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130323; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lysepw.cn"; content:"|06|lysepw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130324; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lysjzdzeij.cc"; content:"|0a|lysjzdzeij|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130325; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lyujfjg.biz"; content:"|07|lyujfjg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130326; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lywxdl.net"; content:"|06|lywxdl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130327; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lyxbaas.com"; content:"|07|lyxbaas|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130328; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lyxyugie.com"; content:"|08|lyxyugie|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130329; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lzdfoxnxr.cc"; content:"|09|lzdfoxnxr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130330; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lzjvpm.net"; content:"|06|lzjvpm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130331; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lzlwgyrk.cn"; content:"|08|lzlwgyrk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130332; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lznfzvab.cc"; content:"|08|lznfzvab|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130333; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lzuqkzfcxu.com"; content:"|0a|lzuqkzfcxu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130334; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lzvqagvtvp.info"; content:"|0a|lzvqagvtvp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130335; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lzzuzpkqdmf.org"; content:"|0b|lzzuzpkqdmf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130336; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lzzwlkzz.cc"; content:"|08|lzzwlkzz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130337; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain lzzyb.info"; content:"|05|lzzyb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130338; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mabacgdzoa.com"; content:"|0a|mabacgdzoa|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130339; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain madkhgqkh.cn"; content:"|09|madkhgqkh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130340; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain makbw.net"; content:"|05|makbw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130341; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain malbdjkx.net"; content:"|08|malbdjkx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130342; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mapwk.ws"; content:"|05|mapwk|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130343; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain maslnqqwe.com"; content:"|09|maslnqqwe|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130344; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain matlmuftmd.cn"; content:"|0a|matlmuftmd|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130345; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mavfhy.org"; content:"|06|mavfhy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130346; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mavihsapw.org"; content:"|09|mavihsapw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130347; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mavpaa.ws"; content:"|06|mavpaa|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130348; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain maznkkspwni.com"; content:"|0b|maznkkspwni|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130349; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mbjededa.cc"; content:"|08|mbjededa|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130350; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mbjerulb.ws"; content:"|08|mbjerulb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130351; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mblydu.cc"; content:"|06|mblydu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130352; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mbnkmhmyyaw.com"; content:"|0b|mbnkmhmyyaw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130353; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mbnzawmwrt.com"; content:"|0a|mbnzawmwrt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130354; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mbohntaue.ws"; content:"|09|mbohntaue|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130355; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mbpgqm.info"; content:"|06|mbpgqm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130356; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mbspx.biz"; content:"|05|mbspx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130357; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mbvcslynaj.net"; content:"|0a|mbvcslynaj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130358; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mbxzufyc.ws"; content:"|08|mbxzufyc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130359; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mbyzncpg.com"; content:"|08|mbyzncpg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130360; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mcbcalew.cn"; content:"|08|mcbcalew|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130361; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mcddeko.biz"; content:"|07|mcddeko|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130362; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mcduar.ws"; content:"|06|mcduar|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130363; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mcftdle.info"; content:"|07|mcftdle|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130364; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mcipw.info"; content:"|05|mcipw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130365; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mcjayjvcr.org"; content:"|09|mcjayjvcr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130366; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mclnm.org"; content:"|05|mclnm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130367; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mcoil.cc"; content:"|05|mcoil|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130368; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mcpkgybyakw.biz"; content:"|0b|mcpkgybyakw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130369; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mcqsebxv.org"; content:"|08|mcqsebxv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130370; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mctwlunma.ws"; content:"|09|mctwlunma|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130371; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mcwpxpdz.info"; content:"|08|mcwpxpdz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130372; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mcysvdydq.org"; content:"|09|mcysvdydq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130373; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mczmfuucs.org"; content:"|09|mczmfuucs|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130374; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mdaav.info"; content:"|05|mdaav|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130375; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mddvrltt.ws"; content:"|08|mddvrltt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130376; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mdfwiy.com"; content:"|06|mdfwiy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130377; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mdjywdrouxp.biz"; content:"|0b|mdjywdrouxp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130378; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mdmdo.cc"; content:"|05|mdmdo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130379; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mdndmze.info"; content:"|07|mdndmze|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130380; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mdofmvbdf.com"; content:"|09|mdofmvbdf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130381; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mdqdb.net"; content:"|05|mdqdb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130382; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mdqjopxpqll.cn"; content:"|0b|mdqjopxpqll|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130383; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mdroinxk.org"; content:"|08|mdroinxk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130384; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mdxoyy.ws"; content:"|06|mdxoyy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130385; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mdzzukorvc.net"; content:"|0a|mdzzukorvc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130386; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain meckm.cc"; content:"|05|meckm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130387; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain medmk.com"; content:"|05|medmk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130388; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mejjfudw.biz"; content:"|08|mejjfudw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130389; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain meknebefh.org"; content:"|09|meknebefh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130390; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mekrnegq.org"; content:"|08|mekrnegq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130391; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain melerqenkh.com"; content:"|0a|melerqenkh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130392; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain melmu.info"; content:"|05|melmu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130393; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mepnhjbg.ws"; content:"|08|mepnhjbg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130394; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mepoe.net"; content:"|05|mepoe|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130395; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain meqdksbpwwk.com"; content:"|0b|meqdksbpwwk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130396; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain metxonkwm.com"; content:"|09|metxonkwm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130397; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mexiwgyu.net"; content:"|08|mexiwgyu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130398; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mexnww.cn"; content:"|06|mexnww|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130399; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mexxn.com"; content:"|05|mexxn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130400; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mezuqgrj.cc"; content:"|08|mezuqgrj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130401; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mfkmwbx.biz"; content:"|07|mfkmwbx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130402; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mfmaivwv.net"; content:"|08|mfmaivwv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130403; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mfutamkisyt.cn"; content:"|0b|mfutamkisyt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130404; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mfuvsyglt.info"; content:"|09|mfuvsyglt|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130405; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mfvtiudwwi.info"; content:"|0a|mfvtiudwwi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130406; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mfzxmdimdwf.net"; content:"|0b|mfzxmdimdwf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130407; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mgbfexsezhd.net"; content:"|0b|mgbfexsezhd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130408; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mgbipb.net"; content:"|06|mgbipb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130409; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mgdqpmyd.net"; content:"|08|mgdqpmyd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130410; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mgepx.cn"; content:"|05|mgepx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130411; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mgfzdmbc.info"; content:"|08|mgfzdmbc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130412; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mggssvur.org"; content:"|08|mggssvur|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130413; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mghjnz.ws"; content:"|06|mghjnz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130414; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mghzbrm.ws"; content:"|07|mghzbrm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130415; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mgikfg.biz"; content:"|06|mgikfg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130416; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mgkqlrlb.com"; content:"|08|mgkqlrlb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130417; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mglxjh.ws"; content:"|06|mglxjh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130418; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mgmounaoe.biz"; content:"|09|mgmounaoe|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130419; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mgmrr.cc"; content:"|05|mgmrr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130420; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mgnslenjfpf.info"; content:"|0b|mgnslenjfpf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130421; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mgnxc.org"; content:"|05|mgnxc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130422; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mguurdduja.com"; content:"|0a|mguurdduja|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130423; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mgvji.biz"; content:"|05|mgvji|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130424; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mgvjk.com"; content:"|05|mgvjk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130425; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mgvxfadyf.cc"; content:"|09|mgvxfadyf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130426; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mgxngnwgy.ws"; content:"|09|mgxngnwgy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130427; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mgxzmlwxdk.com"; content:"|0a|mgxzmlwxdk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130428; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mgyeqxmja.cn"; content:"|09|mgyeqxmja|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130429; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mgylumwcw.biz"; content:"|09|mgylumwcw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130430; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mhagnskau.org"; content:"|09|mhagnskau|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130431; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mhdgmupo.net"; content:"|08|mhdgmupo|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130432; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mhdngy.net"; content:"|06|mhdngy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130433; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mhhmw.cn"; content:"|05|mhhmw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130434; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mhiyluence.com"; content:"|0a|mhiyluence|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130435; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mhlnizfu.cc"; content:"|08|mhlnizfu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130436; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mhofzwquj.cn"; content:"|09|mhofzwquj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130437; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mhpdlmpivsz.info"; content:"|0b|mhpdlmpivsz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130438; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mhqmwrwz.net"; content:"|08|mhqmwrwz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130439; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mhqtofwt.net"; content:"|08|mhqtofwt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130440; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mhsis.info"; content:"|05|mhsis|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130441; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mhzhhw.info"; content:"|06|mhzhhw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130442; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mhztcumwlu.info"; content:"|0a|mhztcumwlu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130443; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain midph.org"; content:"|05|midph|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130444; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain midvttnwkam.ws"; content:"|0b|midvttnwkam|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130445; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain miecvcvpwtw.ws"; content:"|0b|miecvcvpwtw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130446; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain miojere.net"; content:"|07|miojere|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130447; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mivxruy.com"; content:"|07|mivxruy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130448; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain miwdfajlua.org"; content:"|0a|miwdfajlua|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130449; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mixliwh.ws"; content:"|07|mixliwh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130450; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mjbowx.cc"; content:"|06|mjbowx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130451; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mjgfk.cn"; content:"|05|mjgfk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130452; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mjiawe.net"; content:"|06|mjiawe|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130453; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mjqicajd.info"; content:"|08|mjqicajd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130454; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mjwnoybbf.com"; content:"|09|mjwnoybbf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130455; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mjyyuhljsay.cc"; content:"|0b|mjyyuhljsay|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130456; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mkdzgisjk.com"; content:"|09|mkdzgisjk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130457; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mkkdx.cc"; content:"|05|mkkdx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130458; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mkncvambqb.cn"; content:"|0a|mkncvambqb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130459; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mkzwv.cn"; content:"|05|mkzwv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130460; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mlbur.org"; content:"|05|mlbur|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130461; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mlbyarvpy.org"; content:"|09|mlbyarvpy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130462; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mlhoniua.cn"; content:"|08|mlhoniua|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130463; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mlilkizb.net"; content:"|08|mlilkizb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130464; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mlpwttj.cn"; content:"|07|mlpwttj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130465; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mlqrtrdn.info"; content:"|08|mlqrtrdn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130466; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mlrsqe.cc"; content:"|06|mlrsqe|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130467; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mltmrgzr.org"; content:"|08|mltmrgzr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130468; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mltqzt.net"; content:"|06|mltqzt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130469; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mlxqtmq.biz"; content:"|07|mlxqtmq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130470; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mlyeem.net"; content:"|06|mlyeem|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130471; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mlyffffy.info"; content:"|08|mlyffffy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130472; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mmdcvkyiyh.biz"; content:"|0a|mmdcvkyiyh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130473; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mmffanql.cc"; content:"|08|mmffanql|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130474; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mmghogm.net"; content:"|07|mmghogm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130475; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mmiddag.biz"; content:"|07|mmiddag|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130476; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mmjofewfbz.cn"; content:"|0a|mmjofewfbz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130477; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mmlpp.cc"; content:"|05|mmlpp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130478; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mmoczybprb.com"; content:"|0a|mmoczybprb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130479; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mmrnq.cc"; content:"|05|mmrnq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130480; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mmucsu.org"; content:"|06|mmucsu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130481; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mmvapxzg.org"; content:"|08|mmvapxzg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130482; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mmxht.ws"; content:"|05|mmxht|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130483; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mnauqgvvwtg.biz"; content:"|0b|mnauqgvvwtg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130484; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mncoksdofb.cc"; content:"|0a|mncoksdofb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130485; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mnensoa.biz"; content:"|07|mnensoa|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130486; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mnextjl.biz"; content:"|07|mnextjl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130487; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mnfvha.org"; content:"|06|mnfvha|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130488; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mnkjinla.com"; content:"|08|mnkjinla|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130489; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mnllujfn.org"; content:"|08|mnllujfn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130490; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mnvfztxkw.net"; content:"|09|mnvfztxkw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130491; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mnvxuk.com"; content:"|06|mnvxuk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130492; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mnwnakghxo.net"; content:"|0a|mnwnakghxo|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130493; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain moftrbtjjl.cn"; content:"|0a|moftrbtjjl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130494; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain molyifjjy.biz"; content:"|09|molyifjjy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130495; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain momisnkipr.cc"; content:"|0a|momisnkipr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130496; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain momkvzbskyw.net"; content:"|0b|momkvzbskyw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130497; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain moqijeuu.org"; content:"|08|moqijeuu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130498; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain moquzkex.cn"; content:"|08|moquzkex|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130499; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain moscej.info"; content:"|06|moscej|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130500; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mosoigh.biz"; content:"|07|mosoigh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130501; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain motdurqq.biz"; content:"|08|motdurqq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130502; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mpkjde.com"; content:"|06|mpkjde|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130503; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mpndzra.org"; content:"|07|mpndzra|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130504; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mpqrbpzzt.org"; content:"|09|mpqrbpzzt|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130505; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mprcsk.org"; content:"|06|mprcsk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130506; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mprfyqyr.com"; content:"|08|mprfyqyr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130507; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mprmj.com"; content:"|05|mprmj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130508; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mpvygak.biz"; content:"|07|mpvygak|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130509; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mpyoutvhks.cn"; content:"|0a|mpyoutvhks|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130510; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mqcxc.net"; content:"|05|mqcxc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130511; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mqeqdad.org"; content:"|07|mqeqdad|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130512; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mqfckmenudy.ws"; content:"|0b|mqfckmenudy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130513; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mqgqmwvlno.cn"; content:"|0a|mqgqmwvlno|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130514; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mqklzodtzq.com"; content:"|0a|mqklzodtzq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130515; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mqozqzag.info"; content:"|08|mqozqzag|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130516; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mquyktp.cc"; content:"|07|mquyktp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130517; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrbqvtx.biz"; content:"|07|mrbqvtx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130518; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrcgikc.net"; content:"|07|mrcgikc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130519; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mredzrnm.org"; content:"|08|mredzrnm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130520; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrfhrji.org"; content:"|07|mrfhrji|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130521; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrfpor.cn"; content:"|06|mrfpor|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130522; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrgesqhwko.info"; content:"|0a|mrgesqhwko|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130523; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrgmvjxq.com"; content:"|08|mrgmvjxq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130524; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrjaz.cc"; content:"|05|mrjaz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130525; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrjjsa.org"; content:"|06|mrjjsa|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130526; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrklmakknn.net"; content:"|0a|mrklmakknn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130527; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrkvlvkcs.info"; content:"|09|mrkvlvkcs|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130528; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrllufm.cn"; content:"|07|mrllufm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130529; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrpojwbgnt.cc"; content:"|0a|mrpojwbgnt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130530; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrpwsrceckb.net"; content:"|0b|mrpwsrceckb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130531; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrqfkgjhotr.org"; content:"|0b|mrqfkgjhotr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130532; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrvtte.ws"; content:"|06|mrvtte|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130533; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrvwayvvi.info"; content:"|09|mrvwayvvi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130534; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrvzqme.cc"; content:"|07|mrvzqme|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130535; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrygdnlqk.cn"; content:"|09|mrygdnlqk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130536; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mrykgkhn.cn"; content:"|08|mrykgkhn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130537; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain msbtvnlm.info"; content:"|08|msbtvnlm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130538; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mserrqhaxws.cc"; content:"|0b|mserrqhaxws|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130539; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain msexzr.net"; content:"|06|msexzr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130540; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain msihysybfca.org"; content:"|0b|msihysybfca|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130541; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain msjsyhsjgfu.ws"; content:"|0b|msjsyhsjgfu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130542; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain msjzongmj.cc"; content:"|09|msjzongmj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130543; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mskrf.cc"; content:"|05|mskrf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130544; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain msqibulnes.info"; content:"|0a|msqibulnes|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130545; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain msqkrrbl.cn"; content:"|08|msqkrrbl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130546; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain msrdyogbsk.com"; content:"|0a|msrdyogbsk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130547; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain msrvpbpchw.cc"; content:"|0a|msrvpbpchw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130548; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mstpa.com"; content:"|05|mstpa|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130549; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain msvbau.biz"; content:"|06|msvbau|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130550; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain msxeexip.info"; content:"|08|msxeexip|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130551; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mtbbiuqwyf.cc"; content:"|0a|mtbbiuqwyf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130552; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mtdztaiapu.org"; content:"|0a|mtdztaiapu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130553; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mtevsuyj.cc"; content:"|08|mtevsuyj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130554; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mtfbqyygsa.org"; content:"|0a|mtfbqyygsa|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130555; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mtikx.info"; content:"|05|mtikx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130556; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mtjdqobmf.info"; content:"|09|mtjdqobmf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130557; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mtoaxs.ws"; content:"|06|mtoaxs|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130558; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mtrlxdiz.org"; content:"|08|mtrlxdiz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130559; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mtxxzzxw.ws"; content:"|08|mtxxzzxw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130560; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mubyeytzvqb.cc"; content:"|0b|mubyeytzvqb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130561; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mufqf.cn"; content:"|05|mufqf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130562; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mujuxgtsfu.cc"; content:"|0a|mujuxgtsfu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130563; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mujvbaqi.cn"; content:"|08|mujvbaqi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130564; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mukmktbs.com"; content:"|08|mukmktbs|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130565; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mukmrmno.cc"; content:"|08|mukmrmno|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130566; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mulcgtwc.cn"; content:"|08|mulcgtwc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130567; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain muowrkoz.net"; content:"|08|muowrkoz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130568; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain muujffay.biz"; content:"|08|muujffay|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130569; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain muxkdepx.info"; content:"|08|muxkdepx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130570; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain muztrkxmb.ws"; content:"|09|muztrkxmb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130571; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mvaoffeoif.ws"; content:"|0a|mvaoffeoif|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130572; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mvbposr.cn"; content:"|07|mvbposr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130573; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mvdblavup.org"; content:"|09|mvdblavup|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130574; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mvflrtre.cc"; content:"|08|mvflrtre|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130575; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mvfvj.net"; content:"|05|mvfvj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130576; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mvglvs.info"; content:"|06|mvglvs|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130577; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mvirshx.ws"; content:"|07|mvirshx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130578; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mvkkpkuhb.com"; content:"|09|mvkkpkuhb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130579; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mvsslocb.cc"; content:"|08|mvsslocb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130580; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mvtjesvan.com"; content:"|09|mvtjesvan|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130581; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mvujps.info"; content:"|06|mvujps|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130582; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mvusjwyuqvb.cn"; content:"|0b|mvusjwyuqvb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130583; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mwcurnaancd.biz"; content:"|0b|mwcurnaancd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130584; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mwgtd.ws"; content:"|05|mwgtd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130585; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mwjlsssawr.net"; content:"|0a|mwjlsssawr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130586; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mwkcflh.biz"; content:"|07|mwkcflh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130587; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mwlmvtvs.biz"; content:"|08|mwlmvtvs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130588; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mwrqsaw.cn"; content:"|07|mwrqsaw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130589; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mwsoqwp.info"; content:"|07|mwsoqwp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130590; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mwvyukdo.cn"; content:"|08|mwvyukdo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130591; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mwzdozwwei.cn"; content:"|0a|mwzdozwwei|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130592; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mwznmxlggg.net"; content:"|0a|mwznmxlggg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130593; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mxbanxbmuxw.cc"; content:"|0b|mxbanxbmuxw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130594; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mxbspyeh.ws"; content:"|08|mxbspyeh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130595; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mxgqm.org"; content:"|05|mxgqm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130596; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mxhhgn.ws"; content:"|06|mxhhgn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130597; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mxkrwbyzsax.cn"; content:"|0b|mxkrwbyzsax|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130598; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mxlinrsbi.net"; content:"|09|mxlinrsbi|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130599; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mxmqjzhyqdw.info"; content:"|0b|mxmqjzhyqdw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130600; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mxqbv.org"; content:"|05|mxqbv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130601; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mxussdjldq.cc"; content:"|0a|mxussdjldq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130602; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mxxbclpy.info"; content:"|08|mxxbclpy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130603; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mxyelfolbvk.cc"; content:"|0b|mxyelfolbvk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130604; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mxyfinzpx.ws"; content:"|09|mxyfinzpx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130605; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mydvx.net"; content:"|05|mydvx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130606; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mylecqfa.cn"; content:"|08|mylecqfa|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130607; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mymuunbe.cn"; content:"|08|mymuunbe|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130608; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mytzttva.info"; content:"|08|mytzttva|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130609; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain myvgh.com"; content:"|05|myvgh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130610; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain myvthpfzrfg.biz"; content:"|0b|myvthpfzrfg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130611; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain myvyp.ws"; content:"|05|myvyp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130612; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mywakxfa.ws"; content:"|08|mywakxfa|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130613; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mzbakypyzlm.cn"; content:"|0b|mzbakypyzlm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130614; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mzcypzn.cn"; content:"|07|mzcypzn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130615; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mzeeudnf.cc"; content:"|08|mzeeudnf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130616; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mzhzufjj.ws"; content:"|08|mzhzufjj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130617; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mziqk.biz"; content:"|05|mziqk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130618; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mzjchh.info"; content:"|06|mzjchh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130619; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mzkxera.org"; content:"|07|mzkxera|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130620; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mzordemi.org"; content:"|08|mzordemi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130621; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mzozrvtfqe.info"; content:"|0a|mzozrvtfqe|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130622; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mztxwzgrwr.org"; content:"|0a|mztxwzgrwr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130623; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mzunech.biz"; content:"|07|mzunech|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130624; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain mzustn.org"; content:"|06|mzustn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130625; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nabncyuw.cn"; content:"|08|nabncyuw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130626; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain naefajswurq.net"; content:"|0b|naefajswurq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130627; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain naibinjb.org"; content:"|08|naibinjb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130628; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain najrp.net"; content:"|05|najrp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130629; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nalutjyfwpu.ws"; content:"|0b|nalutjyfwpu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130630; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain namamiowq.cc"; content:"|09|namamiowq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130631; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nanvar.info"; content:"|06|nanvar|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130632; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain napxvtggip.cn"; content:"|0a|napxvtggip|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130633; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nasprbydngk.info"; content:"|0b|nasprbydngk|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130634; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nasyo.cn"; content:"|05|nasyo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130635; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nbaljxublq.biz"; content:"|0a|nbaljxublq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130636; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nbckhzf.cc"; content:"|07|nbckhzf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130637; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nbefdslmjk.ws"; content:"|0a|nbefdslmjk|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130638; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nbftpalrld.com"; content:"|0a|nbftpalrld|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130639; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nbkjvivknp.cn"; content:"|0a|nbkjvivknp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130640; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nbkwhmii.ws"; content:"|08|nbkwhmii|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130641; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nbljxmys.cc"; content:"|08|nbljxmys|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130642; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nbnbhgj.ws"; content:"|07|nbnbhgj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130643; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nboegmfwt.cn"; content:"|09|nboegmfwt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130644; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nbpvdelb.info"; content:"|08|nbpvdelb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130645; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nbqneusf.info"; content:"|08|nbqneusf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130646; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nbrdtgtfbkd.biz"; content:"|0b|nbrdtgtfbkd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130647; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nbupy.net"; content:"|05|nbupy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130648; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nbwijmcrv.info"; content:"|09|nbwijmcrv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130649; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nbwuozs.info"; content:"|07|nbwuozs|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130650; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nbxgmngk.cn"; content:"|08|nbxgmngk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130651; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nbzhnxj.biz"; content:"|07|nbzhnxj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130652; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ncbvyulo.org"; content:"|08|ncbvyulo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130653; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nccjotfkcs.cc"; content:"|0a|nccjotfkcs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130654; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ncefmsid.info"; content:"|08|ncefmsid|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130655; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ncfbxpvx.biz"; content:"|08|ncfbxpvx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130656; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ncjxuiltfq.cc"; content:"|0a|ncjxuiltfq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130657; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nckzk.net"; content:"|05|nckzk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130658; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ncljrxz.org"; content:"|07|ncljrxz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130659; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ncodjj.info"; content:"|06|ncodjj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130660; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ncoowydqaqe.info"; content:"|0b|ncoowydqaqe|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130661; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ncqipwoxf.net"; content:"|09|ncqipwoxf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130662; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ncxas.org"; content:"|05|ncxas|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130663; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ncxupghplol.cn"; content:"|0b|ncxupghplol|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130664; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ndbps.org"; content:"|05|ndbps|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130665; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nddnwpae.net"; content:"|08|nddnwpae|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130666; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ndgbk.org"; content:"|05|ndgbk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130667; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ndjvtcsyrd.net"; content:"|0a|ndjvtcsyrd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130668; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ndlrqtjo.net"; content:"|08|ndlrqtjo|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130669; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ndyxkxaxvd.biz"; content:"|0a|ndyxkxaxvd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130670; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ndzfkrxwrfx.org"; content:"|0b|ndzfkrxwrfx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130671; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nehruxvu.cc"; content:"|08|nehruxvu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130672; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nekwcep.biz"; content:"|07|nekwcep|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130673; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain neoqvxrvfr.net"; content:"|0a|neoqvxrvfr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130674; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain neqnpqzy.cc"; content:"|08|neqnpqzy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130675; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nerzxzsabdl.ws"; content:"|0b|nerzxzsabdl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130676; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain netjblirr.ws"; content:"|09|netjblirr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130677; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain newemwkafz.com"; content:"|0a|newemwkafz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130678; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain newyvspvfwa.cc"; content:"|0b|newyvspvfwa|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130679; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nfdcndk.com"; content:"|07|nfdcndk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130680; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nfgjxdvpfqz.info"; content:"|0b|nfgjxdvpfqz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130681; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nfjzkmykw.cc"; content:"|09|nfjzkmykw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130682; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nfkzzpk.biz"; content:"|07|nfkzzpk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130683; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nfmkwlm.com"; content:"|07|nfmkwlm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130684; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nfnbjraf.ws"; content:"|08|nfnbjraf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130685; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nfpmleaq.cn"; content:"|08|nfpmleaq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130686; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nfptpczbf.ws"; content:"|09|nfptpczbf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130687; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nfqptcqdw.biz"; content:"|09|nfqptcqdw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130688; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nfqwfjjthe.org"; content:"|0a|nfqwfjjthe|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130689; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nfrwfqp.org"; content:"|07|nfrwfqp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130690; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nfvrhoina.biz"; content:"|09|nfvrhoina|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130691; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nfwilivcyo.org"; content:"|0a|nfwilivcyo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130692; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ngagvhudmle.cn"; content:"|0b|ngagvhudmle|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130693; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ngbpwz.cn"; content:"|06|ngbpwz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130694; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ngcrxsu.net"; content:"|07|ngcrxsu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130695; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ngfgzrwwrf.cn"; content:"|0a|ngfgzrwwrf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130696; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ngiredqlifv.org"; content:"|0b|ngiredqlifv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130697; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ngknrlga.info"; content:"|08|ngknrlga|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130698; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ngkut.org"; content:"|05|ngkut|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130699; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ngnnxyvdjri.info"; content:"|0b|ngnnxyvdjri|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130700; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ngnoumvclz.com"; content:"|0a|ngnoumvclz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130701; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ngofma.com"; content:"|06|ngofma|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130702; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ngukkkjnxd.cn"; content:"|0a|ngukkkjnxd|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130703; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ngwottm.cn"; content:"|07|ngwottm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130704; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nhajj.biz"; content:"|05|nhajj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130705; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nhdjajobu.net"; content:"|09|nhdjajobu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130706; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nhiquwoe.org"; content:"|08|nhiquwoe|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130707; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nhkko.org"; content:"|05|nhkko|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130708; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nhkrds.info"; content:"|06|nhkrds|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130709; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nhkzdzh.cn"; content:"|07|nhkzdzh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130710; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nhlhb.biz"; content:"|05|nhlhb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130711; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nhmhpsal.cc"; content:"|08|nhmhpsal|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130712; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nhpytflz.cn"; content:"|08|nhpytflz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130713; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nhteuyuoogk.info"; content:"|0b|nhteuyuoogk|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130714; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nhvsxbrvo.info"; content:"|09|nhvsxbrvo|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130715; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nhzfuv.biz"; content:"|06|nhzfuv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130716; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nibfscsrke.cn"; content:"|0a|nibfscsrke|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130717; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nidlnyceyrl.info"; content:"|0b|nidlnyceyrl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130718; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nijhtaox.com"; content:"|08|nijhtaox|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130719; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nimngju.org"; content:"|07|nimngju|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130720; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ninefa.biz"; content:"|06|ninefa|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130721; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain niqcvqrbjc.info"; content:"|0a|niqcvqrbjc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130722; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain niroiwro.ws"; content:"|08|niroiwro|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130723; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nirywy.com"; content:"|06|nirywy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130724; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nivldfg.com"; content:"|07|nivldfg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130725; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nizqrgyragb.ws"; content:"|0b|nizqrgyragb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130726; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nizwodmqxhq.com"; content:"|0b|nizwodmqxhq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130727; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain njaccaekcq.cc"; content:"|0a|njaccaekcq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130728; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain njkmwgqqxuj.cc"; content:"|0b|njkmwgqqxuj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130729; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain njmiygto.com"; content:"|08|njmiygto|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130730; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain njonpfjp.com"; content:"|08|njonpfjp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130731; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain njowau.biz"; content:"|06|njowau|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130732; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nkctdt.biz"; content:"|06|nkctdt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130733; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nkedchqy.com"; content:"|08|nkedchqy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130734; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nkelxhu.net"; content:"|07|nkelxhu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130735; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nkgdszv.biz"; content:"|07|nkgdszv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130736; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nkiduf.cn"; content:"|06|nkiduf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130737; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nkieqoufoh.ws"; content:"|0a|nkieqoufoh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130738; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nkkhqbbv.info"; content:"|08|nkkhqbbv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130739; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nklljcuj.biz"; content:"|08|nklljcuj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130740; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nkloe.cc"; content:"|05|nkloe|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130741; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nknnj.biz"; content:"|05|nknnj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130742; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nkpaqup.org"; content:"|07|nkpaqup|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130743; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nkqloscbgig.ws"; content:"|0b|nkqloscbgig|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130744; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nkttqnz.info"; content:"|07|nkttqnz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130745; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nkzlsppd.info"; content:"|08|nkzlsppd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130746; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nlcjxekmp.org"; content:"|09|nlcjxekmp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130747; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nlggvh.cn"; content:"|06|nlggvh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130748; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nlknizuti.net"; content:"|09|nlknizuti|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130749; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nlmknu.org"; content:"|06|nlmknu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130750; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nlplac.cc"; content:"|06|nlplac|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130751; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nmczivabshy.com"; content:"|0b|nmczivabshy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130752; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nmnjmwgy.info"; content:"|08|nmnjmwgy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130753; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nmnxiglh.com"; content:"|08|nmnxiglh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130754; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nmpaybkjqje.cc"; content:"|0b|nmpaybkjqje|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130755; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nmsfpoo.cn"; content:"|07|nmsfpoo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130756; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nmwxfs.info"; content:"|06|nmwxfs|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130757; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nmxnzldj.biz"; content:"|08|nmxnzldj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130758; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nmxtrtmqytd.com"; content:"|0b|nmxtrtmqytd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130759; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nmyqyz.net"; content:"|06|nmyqyz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130760; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nnbjppf.info"; content:"|07|nnbjppf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130761; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nnhccewb.org"; content:"|08|nnhccewb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130762; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nnigqsyy.com"; content:"|08|nnigqsyy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130763; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nnjtk.com"; content:"|05|nnjtk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130764; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nnkaaqsi.biz"; content:"|08|nnkaaqsi|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130765; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nnkcvg.cc"; content:"|06|nnkcvg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130766; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nnlyehjnjxb.org"; content:"|0b|nnlyehjnjxb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130767; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nnlzvmxye.biz"; content:"|09|nnlzvmxye|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130768; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nnmkuzok.net"; content:"|08|nnmkuzok|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130769; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nnthrgfwp.info"; content:"|09|nnthrgfwp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130770; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nnvyztjs.cc"; content:"|08|nnvyztjs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130771; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nnwyw.cn"; content:"|05|nnwyw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130772; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nnxxojcp.biz"; content:"|08|nnxxojcp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130773; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain noccgv.org"; content:"|06|noccgv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130774; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain noefynik.cn"; content:"|08|noefynik|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130775; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nohdybzjf.info"; content:"|09|nohdybzjf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130776; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nohhdnluqje.ws"; content:"|0b|nohhdnluqje|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130777; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nohspyuc.org"; content:"|08|nohspyuc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130778; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nomefzvl.net"; content:"|08|nomefzvl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130779; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain norelvuzfe.net"; content:"|0a|norelvuzfe|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130780; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain notdfjkf.ws"; content:"|08|notdfjkf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130781; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain notmtlszuac.cc"; content:"|0b|notmtlszuac|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130782; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nowlk.biz"; content:"|05|nowlk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130783; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain npdbblym.biz"; content:"|08|npdbblym|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130784; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain npeeqka.info"; content:"|07|npeeqka|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130785; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain npgemnrft.ws"; content:"|09|npgemnrft|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130786; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nphnr.cn"; content:"|05|nphnr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130787; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain npjlmsd.com"; content:"|07|npjlmsd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130788; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain npleg.cc"; content:"|05|npleg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130789; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain npolnmpu.ws"; content:"|08|npolnmpu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130790; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain npuelamonq.info"; content:"|0a|npuelamonq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130791; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain npwyxhr.com"; content:"|07|npwyxhr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130792; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain npzqkj.net"; content:"|06|npzqkj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130793; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nqbmeswl.cc"; content:"|08|nqbmeswl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130794; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nqcct.info"; content:"|05|nqcct|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130795; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nqfww.cc"; content:"|05|nqfww|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130796; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nqhnthklobr.net"; content:"|0b|nqhnthklobr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130797; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nqjhourq.net"; content:"|08|nqjhourq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130798; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nqksaycz.ws"; content:"|08|nqksaycz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130799; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nqkyy.info"; content:"|05|nqkyy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130800; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nqlzonlldoi.com"; content:"|0b|nqlzonlldoi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130801; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nqpcjzylew.org"; content:"|0a|nqpcjzylew|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130802; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nqpeffcnrz.net"; content:"|0a|nqpeffcnrz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130803; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nqpgjq.ws"; content:"|06|nqpgjq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130804; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nqwqqrzt.ws"; content:"|08|nqwqqrzt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130805; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nrajlflbs.net"; content:"|09|nrajlflbs|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130806; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nrexxafiger.biz"; content:"|0b|nrexxafiger|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130807; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nrjsiqfj.cn"; content:"|08|nrjsiqfj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130808; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nrlwg.net"; content:"|05|nrlwg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130809; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nrrqqbmrqhl.biz"; content:"|0b|nrrqqbmrqhl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130810; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nruitnwcb.org"; content:"|09|nruitnwcb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130811; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nrxfabbe.org"; content:"|08|nrxfabbe|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130812; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nrymqjhc.net"; content:"|08|nrymqjhc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130813; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nsanoz.cn"; content:"|06|nsanoz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130814; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nscep.ws"; content:"|05|nscep|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130815; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nshrbhct.biz"; content:"|08|nshrbhct|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130816; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nsles.biz"; content:"|05|nsles|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130817; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nsllitjh.cc"; content:"|08|nsllitjh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130818; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nspsfmty.net"; content:"|08|nspsfmty|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130819; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nssqcoqj.cn"; content:"|08|nssqcoqj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130820; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nsswxruk.cn"; content:"|08|nsswxruk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130821; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nsteqzugfr.biz"; content:"|0a|nsteqzugfr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130822; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nsvzvw.net"; content:"|06|nsvzvw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130823; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nszeqidjr.cn"; content:"|09|nszeqidjr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130824; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nszjv.cc"; content:"|05|nszjv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130825; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ntblx.com"; content:"|05|ntblx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130826; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ntciq.org"; content:"|05|ntciq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130827; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ntjxesyrhsy.info"; content:"|0b|ntjxesyrhsy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130828; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ntnsdavk.cc"; content:"|08|ntnsdavk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130829; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ntpqwjq.info"; content:"|07|ntpqwjq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130830; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ntrieugsqmu.info"; content:"|0b|ntrieugsqmu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130831; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ntsbd.net"; content:"|05|ntsbd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130832; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ntsfib.ws"; content:"|06|ntsfib|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130833; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ntsmrlecsnz.cc"; content:"|0b|ntsmrlecsnz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130834; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ntyrmvae.info"; content:"|08|ntyrmvae|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130835; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ntzrvwpz.net"; content:"|08|ntzrvwpz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130836; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nuaavsdpf.cc"; content:"|09|nuaavsdpf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130837; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nucafmjngza.org"; content:"|0b|nucafmjngza|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130838; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nuesjksh.info"; content:"|08|nuesjksh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130839; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nufzrletsj.ws"; content:"|0a|nufzrletsj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130840; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nuhfpcccvd.cn"; content:"|0a|nuhfpcccvd|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130841; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nuklxlmrl.info"; content:"|09|nuklxlmrl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130842; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nupwbkhkgj.ws"; content:"|0a|nupwbkhkgj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130843; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nupydh.cc"; content:"|06|nupydh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130844; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nuqpq.info"; content:"|05|nuqpq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130845; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nurvxpjzpkr.net"; content:"|0b|nurvxpjzpkr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130846; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nuxkievael.com"; content:"|0a|nuxkievael|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130847; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nvify.org"; content:"|05|nvify|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130848; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nvixb.ws"; content:"|05|nvixb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130849; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nvlcot.ws"; content:"|06|nvlcot|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130850; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nvqfsypomx.cn"; content:"|0a|nvqfsypomx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130851; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nvrbm.org"; content:"|05|nvrbm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130852; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nvuttbh.cc"; content:"|07|nvuttbh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130853; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nvvqskhb.info"; content:"|08|nvvqskhb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130854; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nvvqyds.cn"; content:"|07|nvvqyds|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130855; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nvxsyr.com"; content:"|06|nvxsyr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130856; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nvyoiw.org"; content:"|06|nvyoiw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130857; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nvzfsmbd.org"; content:"|08|nvzfsmbd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130858; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nvzjmlxnrp.ws"; content:"|0a|nvzjmlxnrp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130859; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nwahq.net"; content:"|05|nwahq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130860; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nwech.com"; content:"|05|nwech|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130861; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nwgct.cc"; content:"|05|nwgct|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130862; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nwhiqjmb.ws"; content:"|08|nwhiqjmb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130863; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nwmetnxe.net"; content:"|08|nwmetnxe|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130864; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nwrfldb.cn"; content:"|07|nwrfldb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130865; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nwrunarxn.net"; content:"|09|nwrunarxn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130866; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nwtsonnmvja.ws"; content:"|0b|nwtsonnmvja|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130867; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nwwlszv.ws"; content:"|07|nwwlszv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130868; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nwynlwamyi.biz"; content:"|0a|nwynlwamyi|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130869; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nxcdfvoa.ws"; content:"|08|nxcdfvoa|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130870; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nxdcxseb.ws"; content:"|08|nxdcxseb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130871; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nxenwxmte.ws"; content:"|09|nxenwxmte|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130872; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nxmgwgby.com"; content:"|08|nxmgwgby|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130873; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nxwgxuhc.org"; content:"|08|nxwgxuhc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130874; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nxxhkgbbdf.cc"; content:"|0a|nxxhkgbbdf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130875; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nxxvvfjwrf.info"; content:"|0a|nxxvvfjwrf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130876; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nyczxutmuy.biz"; content:"|0a|nyczxutmuy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130877; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nyfeqvhhq.info"; content:"|09|nyfeqvhhq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130878; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nyhfo.biz"; content:"|05|nyhfo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130879; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nyjhbwe.biz"; content:"|07|nyjhbwe|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130880; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nynyxuvfqqh.org"; content:"|0b|nynyxuvfqqh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130881; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nzajrrx.com"; content:"|07|nzajrrx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130882; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nzhchgibx.cc"; content:"|09|nzhchgibx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130883; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nzlklaul.cc"; content:"|08|nzlklaul|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130884; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nzmglfzml.biz"; content:"|09|nzmglfzml|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130885; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nznqxf.net"; content:"|06|nznqxf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130886; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nzomay.net"; content:"|06|nzomay|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130887; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nzpeuqudl.net"; content:"|09|nzpeuqudl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130888; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nzznpge.info"; content:"|07|nzznpge|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130889; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain nzzxgfprfb.org"; content:"|0a|nzzxgfprfb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130890; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oabtmbqo.org"; content:"|08|oabtmbqo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130891; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oafqvrtv.ws"; content:"|08|oafqvrtv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130892; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oakimf.com"; content:"|06|oakimf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130893; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oalvvdzcvn.biz"; content:"|0a|oalvvdzcvn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130894; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oalwqc.cn"; content:"|06|oalwqc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130895; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oanpghncr.info"; content:"|09|oanpghncr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130896; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oaosoomm.org"; content:"|08|oaosoomm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130897; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oatct.cc"; content:"|05|oatct|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130898; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oaztenc.net"; content:"|07|oaztenc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130899; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain obaddg.cn"; content:"|06|obaddg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130900; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain obapte.info"; content:"|06|obapte|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130901; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain obehqyl.info"; content:"|07|obehqyl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130902; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain obghnl.com"; content:"|06|obghnl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130903; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain obhkvusv.com"; content:"|08|obhkvusv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130904; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain obhmpfi.net"; content:"|07|obhmpfi|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130905; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain obidhyeckde.info"; content:"|0b|obidhyeckde|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130906; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oblystkuckq.net"; content:"|0b|oblystkuckq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130907; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain obmaqa.biz"; content:"|06|obmaqa|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130908; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oboaioob.org"; content:"|08|oboaioob|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130909; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain obrwroqr.net"; content:"|08|obrwroqr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130910; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain obuifmafnt.biz"; content:"|0a|obuifmafnt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130911; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain obytnn.ws"; content:"|06|obytnn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130912; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ocbwwbujl.net"; content:"|09|ocbwwbujl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130913; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ocfwxn.cc"; content:"|06|ocfwxn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130914; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ocjaccv.ws"; content:"|07|ocjaccv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130915; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ockoow.ws"; content:"|06|ockoow|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130916; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ocloqgxd.net"; content:"|08|ocloqgxd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130917; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ocnuutdc.cc"; content:"|08|ocnuutdc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130918; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ocrelli.net"; content:"|07|ocrelli|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130919; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ocrxectd.ws"; content:"|08|ocrxectd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130920; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ocsngf.ws"; content:"|06|ocsngf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130921; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain odcwsqr.ws"; content:"|07|odcwsqr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130922; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain odhnvc.org"; content:"|06|odhnvc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130923; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain odhtvaylwe.com"; content:"|0a|odhtvaylwe|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130924; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain odkhgyrnfa.cc"; content:"|0a|odkhgyrnfa|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130925; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain odpdqroawc.cc"; content:"|0a|odpdqroawc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130926; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain odroramzprf.info"; content:"|0b|odroramzprf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130927; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain odtla.cc"; content:"|05|odtla|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130928; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain odwlzsdyayb.net"; content:"|0b|odwlzsdyayb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130929; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oedunyrouek.cc"; content:"|0b|oedunyrouek|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130930; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oedydjnb.ws"; content:"|08|oedydjnb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130931; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oeekevbz.cc"; content:"|08|oeekevbz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130932; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oefdwwuj.info"; content:"|08|oefdwwuj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130933; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oegayrau.com"; content:"|08|oegayrau|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130934; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oeknyt.ws"; content:"|06|oeknyt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130935; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oeomsuurff.cc"; content:"|0a|oeomsuurff|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130936; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oeoxgylsur.org"; content:"|0a|oeoxgylsur|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130937; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oepmoayf.cc"; content:"|08|oepmoayf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130938; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oepokblako.org"; content:"|0a|oepokblako|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130939; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oerxjqni.org"; content:"|08|oerxjqni|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130940; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oexsfppc.net"; content:"|08|oexsfppc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130941; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oeysrnzp.cn"; content:"|08|oeysrnzp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130942; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ofcmy.cc"; content:"|05|ofcmy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130943; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ofdrkim.info"; content:"|07|ofdrkim|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130944; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain offgvtenzcn.cc"; content:"|0b|offgvtenzcn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130945; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain offhbdylm.ws"; content:"|09|offhbdylm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130946; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ofgjfbrb.info"; content:"|08|ofgjfbrb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130947; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ofitamlaefv.ws"; content:"|0b|ofitamlaefv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130948; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ofkrzffsnlj.net"; content:"|0b|ofkrzffsnlj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130949; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oflglxmm.org"; content:"|08|oflglxmm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130950; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ofnjghd.com"; content:"|07|ofnjghd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130951; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ofqyhhp.com"; content:"|07|ofqyhhp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130952; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ofqzymikmvd.ws"; content:"|0b|ofqzymikmvd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130953; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oftdrssvhz.net"; content:"|0a|oftdrssvhz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130954; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ofupwdeoe.cn"; content:"|09|ofupwdeoe|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130955; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ofuvcfiw.cn"; content:"|08|ofuvcfiw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130956; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ofvafnn.net"; content:"|07|ofvafnn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130957; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ofyfhbhq.com"; content:"|08|ofyfhbhq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130958; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ogfgrlsggb.cn"; content:"|0a|ogfgrlsggb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130959; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ogfsjpnpq.net"; content:"|09|ogfsjpnpq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130960; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oggojd.net"; content:"|06|oggojd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130961; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ogjrlaoiqy.ws"; content:"|0a|ogjrlaoiqy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130962; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oglyuu.biz"; content:"|06|oglyuu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130963; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ogmzriu.biz"; content:"|07|ogmzriu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130964; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ogzdqsmyb.net"; content:"|09|ogzdqsmyb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130965; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ohbuqevllgb.net"; content:"|0b|ohbuqevllgb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130966; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ohetniiy.cn"; content:"|08|ohetniiy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130967; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ohidtymkyn.com"; content:"|0a|ohidtymkyn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130968; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ohnuaru.com"; content:"|07|ohnuaru|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130969; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ohqdrovfzf.org"; content:"|0a|ohqdrovfzf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130970; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ohtvfslpnqy.biz"; content:"|0b|ohtvfslpnqy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130971; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oidysqqpnk.com"; content:"|0a|oidysqqpnk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130972; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oifthutacvk.cn"; content:"|0b|oifthutacvk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130973; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oikbyktfted.biz"; content:"|0b|oikbyktfted|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130974; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oilofxlwa.cn"; content:"|09|oilofxlwa|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130975; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oipppcuoivl.ws"; content:"|0b|oipppcuoivl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130976; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oiqeyv.cn"; content:"|06|oiqeyv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130977; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oirrxu.cn"; content:"|06|oirrxu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130978; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oitbytoeqfx.cn"; content:"|0b|oitbytoeqfx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130979; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oivaqvfad.ws"; content:"|09|oivaqvfad|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130980; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oiwrqviazhu.cc"; content:"|0b|oiwrqviazhu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130981; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oixjuxchk.cn"; content:"|09|oixjuxchk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130982; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oixtgyuercx.info"; content:"|0b|oixtgyuercx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130983; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oizfxbzc.cn"; content:"|08|oizfxbzc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130984; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ojajhzzdyk.biz"; content:"|0a|ojajhzzdyk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130985; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ojarz.org"; content:"|05|ojarz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130986; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ojchbr.net"; content:"|06|ojchbr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130987; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ojeoa.cn"; content:"|05|ojeoa|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130988; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ojhlsq.net"; content:"|06|ojhlsq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130989; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ojhzoa.cn"; content:"|06|ojhzoa|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130990; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ojnzagowqiy.cc"; content:"|0b|ojnzagowqiy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130991; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ojpxsaq.info"; content:"|07|ojpxsaq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130992; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ojrnbm.info"; content:"|06|ojrnbm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130993; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ojtjddkp.com"; content:"|08|ojtjddkp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130994; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ojzimrxe.cn"; content:"|08|ojzimrxe|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130995; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ojzwxutn.org"; content:"|08|ojzwxutn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130996; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain okatg.net"; content:"|05|okatg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130997; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain okikx.org"; content:"|05|okikx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130998; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain okkdsvolpkq.info"; content:"|0b|okkdsvolpkq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1130999; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oktijqy.biz"; content:"|07|oktijqy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131000; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain okyshm.ws"; content:"|06|okyshm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131001; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain okzfucipyr.info"; content:"|0a|okzfucipyr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131002; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain olcgrgnztxu.ws"; content:"|0b|olcgrgnztxu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131003; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain olhqilfe.com"; content:"|08|olhqilfe|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131004; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oljiaiz.cc"; content:"|07|oljiaiz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131005; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oljmclqg.com"; content:"|08|oljmclqg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131006; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain olmkazop.org"; content:"|08|olmkazop|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131007; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain olnikuwd.org"; content:"|08|olnikuwd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131008; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain olorb.cc"; content:"|05|olorb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131009; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain olpebcxu.cc"; content:"|08|olpebcxu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131010; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain olrutghdiaw.info"; content:"|0b|olrutghdiaw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131011; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain olultbfvq.cc"; content:"|09|olultbfvq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131012; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain olvmjhie.info"; content:"|08|olvmjhie|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131013; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain olwewzl.net"; content:"|07|olwewzl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131014; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain olyyesgmgv.ws"; content:"|0a|olyyesgmgv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131015; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain omajejfm.cn"; content:"|08|omajejfm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131016; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain omakefd.biz"; content:"|07|omakefd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131017; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain omfjmvk.com"; content:"|07|omfjmvk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131018; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain omfrygsv.biz"; content:"|08|omfrygsv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131019; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain omgzhckz.cn"; content:"|08|omgzhckz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131020; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain omkjznou.org"; content:"|08|omkjznou|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131021; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ommse.info"; content:"|05|ommse|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131022; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain omrdbojp.biz"; content:"|08|omrdbojp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131023; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain omurycnumd.ws"; content:"|0a|omurycnumd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131024; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain omwyymh.biz"; content:"|07|omwyymh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131025; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain omyblwst.net"; content:"|08|omyblwst|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131026; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain onaet.biz"; content:"|05|onaet|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131027; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain onapcsjyfqo.info"; content:"|0b|onapcsjyfqo|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131028; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain onbvqkoj.com"; content:"|08|onbvqkoj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131029; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ongdt.org"; content:"|05|ongdt|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131030; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain onlscvma.com"; content:"|08|onlscvma|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131031; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain onodrptvs.cc"; content:"|09|onodrptvs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131032; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain onpvphk.biz"; content:"|07|onpvphk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131033; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain onrehh.cc"; content:"|06|onrehh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131034; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ontbzuscdkq.org"; content:"|0b|ontbzuscdkq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131035; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain onvgc.biz"; content:"|05|onvgc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131036; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain onwiegcvz.com"; content:"|09|onwiegcvz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131037; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain onwkyhvs.biz"; content:"|08|onwkyhvs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131038; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain onxatx.cn"; content:"|06|onxatx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131039; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain onxhwefxi.cc"; content:"|09|onxhwefxi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131040; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oodpsikbhx.info"; content:"|0a|oodpsikbhx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131041; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ooenjbdp.net"; content:"|08|ooenjbdp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131042; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ooeszoohgf.cc"; content:"|0a|ooeszoohgf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131043; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oogqgycqss.info"; content:"|0a|oogqgycqss|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131044; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ooiteqa.info"; content:"|07|ooiteqa|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131045; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oojjzsgnctp.cc"; content:"|0b|oojjzsgnctp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131046; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oojxabfn.cn"; content:"|08|oojxabfn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131047; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ookovwml.net"; content:"|08|ookovwml|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131048; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ooqorl.org"; content:"|06|ooqorl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131049; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ooruewrmlpn.org"; content:"|0b|ooruewrmlpn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131050; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ootmtqae.com"; content:"|08|ootmtqae|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131051; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ooxkgg.cn"; content:"|06|ooxkgg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131052; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oozamywwi.info"; content:"|09|oozamywwi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131053; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain opgbuuq.info"; content:"|07|opgbuuq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131054; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ophnhozx.org"; content:"|08|ophnhozx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131055; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ophvslekqkr.ws"; content:"|0b|ophvslekqkr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131056; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain opnnugxf.cc"; content:"|08|opnnugxf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131057; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oppknctrddk.ws"; content:"|0b|oppknctrddk|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131058; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oppzriiqtm.info"; content:"|0a|oppzriiqtm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131059; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain opsqtiryy.net"; content:"|09|opsqtiryy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131060; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain opuifiqlgaj.info"; content:"|0b|opuifiqlgaj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131061; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain opvdnyjp.org"; content:"|08|opvdnyjp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131062; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oqchexbc.cc"; content:"|08|oqchexbc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131063; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oqdnlrv.net"; content:"|07|oqdnlrv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131064; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oqedfns.info"; content:"|07|oqedfns|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131065; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oqnaj.net"; content:"|05|oqnaj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131066; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oqodnnuux.info"; content:"|09|oqodnnuux|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131067; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oqoyswtg.cn"; content:"|08|oqoyswtg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131068; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oqrhxreiuvj.net"; content:"|0b|oqrhxreiuvj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131069; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oqshl.net"; content:"|05|oqshl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131070; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oqurpucmfv.cc"; content:"|0a|oqurpucmfv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131071; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oqvdckpq.com"; content:"|08|oqvdckpq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131072; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oqvnrbpo.info"; content:"|08|oqvnrbpo|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131073; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oqwrflyhrh.net"; content:"|0a|oqwrflyhrh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131074; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oqxjh.com"; content:"|05|oqxjh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131075; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oqyik.com"; content:"|05|oqyik|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131076; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain orexgraxdrl.cc"; content:"|0b|orexgraxdrl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131077; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain orhaumsxfk.biz"; content:"|0a|orhaumsxfk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131078; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain orkjzzetp.net"; content:"|09|orkjzzetp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131079; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain orncsbe.cc"; content:"|07|orncsbe|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131080; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain orpahn.com"; content:"|06|orpahn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131081; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain orpemlcudgx.net"; content:"|0b|orpemlcudgx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131082; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain orrpuexbmpy.com"; content:"|0b|orrpuexbmpy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131083; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain orxxuegoe.biz"; content:"|09|orxxuegoe|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131084; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain osawq.com"; content:"|05|osawq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131085; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oskggydzpr.cc"; content:"|0a|oskggydzpr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131086; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain osqya.net"; content:"|05|osqya|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131087; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain osyzzoh.net"; content:"|07|osyzzoh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131088; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oszpum.org"; content:"|06|oszpum|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131089; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain otcyhpx.net"; content:"|07|otcyhpx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131090; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain otptmxbfspk.biz"; content:"|0b|otptmxbfspk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131091; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain otuogchca.ws"; content:"|09|otuogchca|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131092; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain otyqlgj.cn"; content:"|07|otyqlgj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131093; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ouegyd.cn"; content:"|06|ouegyd|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131094; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oufrgpzaqjn.cc"; content:"|0b|oufrgpzaqjn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131095; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ougqp.net"; content:"|05|ougqp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131096; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ougxb.net"; content:"|05|ougxb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131097; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oujtlm.cc"; content:"|06|oujtlm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131098; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oukvulmdvrf.ws"; content:"|0b|oukvulmdvrf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131099; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ouowibpyojx.org"; content:"|0b|ouowibpyojx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131100; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ouvtxea.biz"; content:"|07|ouvtxea|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131101; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ouyjpvjp.cc"; content:"|08|ouyjpvjp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131102; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ouyxmpiqhc.ws"; content:"|0a|ouyxmpiqhc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131103; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ouzpfcr.ws"; content:"|07|ouzpfcr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131104; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ovcdhzcjr.cc"; content:"|09|ovcdhzcjr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131105; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ovlnnan.net"; content:"|07|ovlnnan|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131106; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ovlunzuwh.ws"; content:"|09|ovlunzuwh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131107; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ovsjypz.com"; content:"|07|ovsjypz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131108; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ovthwzd.net"; content:"|07|ovthwzd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131109; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ovtntisdr.net"; content:"|09|ovtntisdr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131110; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ovxffupv.net"; content:"|08|ovxffupv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131111; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ovybjclfiix.biz"; content:"|0b|ovybjclfiix|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131112; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ovyokyeoa.net"; content:"|09|ovyokyeoa|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131113; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain owcpa.biz"; content:"|05|owcpa|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131114; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain owdbff.cn"; content:"|06|owdbff|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131115; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain owjawshaih.net"; content:"|0a|owjawshaih|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131116; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain owmfpfr.net"; content:"|07|owmfpfr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131117; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain owzhzjjbm.cc"; content:"|09|owzhzjjbm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131118; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oxeaqcqj.cc"; content:"|08|oxeaqcqj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131119; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oxhtvqggeeu.com"; content:"|0b|oxhtvqggeeu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131120; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oxlvyfe.net"; content:"|07|oxlvyfe|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131121; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oxpuoootny.net"; content:"|0a|oxpuoootny|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131122; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oxrgugolf.com"; content:"|09|oxrgugolf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131123; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oxshpfhj.info"; content:"|08|oxshpfhj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131124; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oxucdsstx.info"; content:"|09|oxucdsstx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131125; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oxukct.cn"; content:"|06|oxukct|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131126; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oxzpkitp.com"; content:"|08|oxzpkitp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131127; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oxzwsd.org"; content:"|06|oxzwsd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131128; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oyanhrxu.info"; content:"|08|oyanhrxu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131129; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oyfrzvkj.ws"; content:"|08|oyfrzvkj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131130; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oyfxnj.org"; content:"|06|oyfxnj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131131; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oynqfu.cn"; content:"|06|oynqfu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131132; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oypjnyo.info"; content:"|07|oypjnyo|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131133; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain oyqduhbmbyi.cc"; content:"|0b|oyqduhbmbyi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131134; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ozavyhc.org"; content:"|07|ozavyhc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131135; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ozfzumjzm.cn"; content:"|09|ozfzumjzm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131136; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ozopqj.org"; content:"|06|ozopqj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131137; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ozrrpjpw.cn"; content:"|08|ozrrpjpw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131138; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain paffnukz.org"; content:"|08|paffnukz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131139; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain paglo.ws"; content:"|05|paglo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131140; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pamyfcdjozl.cc"; content:"|0b|pamyfcdjozl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131141; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain panlxsvs.net"; content:"|08|panlxsvs|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131142; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pavjzde.cn"; content:"|07|pavjzde|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131143; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain paykdzee.cc"; content:"|08|paykdzee|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131144; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pazndc.info"; content:"|06|pazndc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131145; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pbbdxcunuq.net"; content:"|0a|pbbdxcunuq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131146; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pbdjrpkk.com"; content:"|08|pbdjrpkk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131147; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pbesk.info"; content:"|05|pbesk|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131148; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pbfbqs.com"; content:"|06|pbfbqs|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131149; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pbgvtmvtqcv.com"; content:"|0b|pbgvtmvtqcv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131150; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pbhxxcmzwpa.org"; content:"|0b|pbhxxcmzwpa|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131151; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pbkcnrcn.cn"; content:"|08|pbkcnrcn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131152; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pcbhkevecqk.ws"; content:"|0b|pcbhkevecqk|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131153; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pccjfb.cc"; content:"|06|pccjfb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131154; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pcdce.org"; content:"|05|pcdce|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131155; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pceszjhtt.ws"; content:"|09|pceszjhtt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131156; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pcezpmk.net"; content:"|07|pcezpmk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131157; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pcirpm.com"; content:"|06|pcirpm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131158; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pcmoqgkdm.biz"; content:"|09|pcmoqgkdm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131159; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pcohieyq.com"; content:"|08|pcohieyq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131160; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pcrdqkvw.biz"; content:"|08|pcrdqkvw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131161; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pcsuhbgb.org"; content:"|08|pcsuhbgb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131162; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pcsvjvcd.com"; content:"|08|pcsvjvcd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131163; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pcvruhhxcq.org"; content:"|0a|pcvruhhxcq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131164; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pczlmwy.cc"; content:"|07|pczlmwy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131165; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pdeifrv.cn"; content:"|07|pdeifrv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131166; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pdejiu.biz"; content:"|06|pdejiu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131167; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pdjxefs.biz"; content:"|07|pdjxefs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131168; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pdjzexzylce.org"; content:"|0b|pdjzexzylce|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131169; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pdmcgvo.cn"; content:"|07|pdmcgvo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131170; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pdnayfcardt.com"; content:"|0b|pdnayfcardt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131171; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pdyyz.biz"; content:"|05|pdyyz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131172; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain peapwpxmka.org"; content:"|0a|peapwpxmka|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131173; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain peaqloyo.ws"; content:"|08|peaqloyo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131174; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pecqlpx.ws"; content:"|07|pecqlpx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131175; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pecsj.cc"; content:"|05|pecsj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131176; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pedab.info"; content:"|05|pedab|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131177; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pefyiob.org"; content:"|07|pefyiob|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131178; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pegqgierv.org"; content:"|09|pegqgierv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131179; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain peqsw.info"; content:"|05|peqsw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131180; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pesfnk.cc"; content:"|06|pesfnk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131181; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pewjtmzr.com"; content:"|08|pewjtmzr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131182; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pewqzaglwd.org"; content:"|0a|pewqzaglwd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131183; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain peyou.info"; content:"|05|peyou|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131184; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pezwyu.cc"; content:"|06|pezwyu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131185; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pezzxftfnl.com"; content:"|0a|pezzxftfnl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131186; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pfdgmi.biz"; content:"|06|pfdgmi|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131187; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pffthvezbf.biz"; content:"|0a|pffthvezbf|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131188; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pfieqvml.ws"; content:"|08|pfieqvml|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131189; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pfntajhsyim.net"; content:"|0b|pfntajhsyim|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131190; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pftpsgkh.cc"; content:"|08|pftpsgkh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131191; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pfugqitztjn.org"; content:"|0b|pfugqitztjn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131192; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pfumtonmbj.ws"; content:"|0a|pfumtonmbj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131193; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pfvzu.biz"; content:"|05|pfvzu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131194; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pfwjd.com"; content:"|05|pfwjd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131195; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pfxhr.net"; content:"|05|pfxhr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131196; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pfzkp.com"; content:"|05|pfzkp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131197; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pgajclfqw.com"; content:"|09|pgajclfqw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131198; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pgciiv.ws"; content:"|06|pgciiv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131199; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pgcuxsrjgpd.cn"; content:"|0b|pgcuxsrjgpd|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131200; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pgkgqqvso.com"; content:"|09|pgkgqqvso|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131201; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pgnztnin.com"; content:"|08|pgnztnin|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131202; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pgupikjt.cn"; content:"|08|pgupikjt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131203; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pgvmdwi.com"; content:"|07|pgvmdwi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131204; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pgxao.ws"; content:"|05|pgxao|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131205; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain phhqibjf.info"; content:"|08|phhqibjf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131206; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain phionhdql.com"; content:"|09|phionhdql|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131207; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain phjosxji.biz"; content:"|08|phjosxji|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131208; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain phkajemq.cc"; content:"|08|phkajemq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131209; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain phlmpb.com"; content:"|06|phlmpb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131210; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain phtkpcx.org"; content:"|07|phtkpcx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131211; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain phvvfa.com"; content:"|06|phvvfa|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131212; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pibroopgkl.biz"; content:"|0a|pibroopgkl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131213; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pibtjbfio.cn"; content:"|09|pibtjbfio|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131214; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pifedkvwz.info"; content:"|09|pifedkvwz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131215; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pifme.info"; content:"|05|pifme|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131216; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pifvbcnerk.info"; content:"|0a|pifvbcnerk|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131217; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pigmhukf.org"; content:"|08|pigmhukf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131218; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pigwshfcze.info"; content:"|0a|pigwshfcze|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131219; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pilai.biz"; content:"|05|pilai|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131220; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pimmke.ws"; content:"|06|pimmke|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131221; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pimqvsyxbgf.net"; content:"|0b|pimqvsyxbgf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131222; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain piutixv.biz"; content:"|07|piutixv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131223; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pjebusno.cn"; content:"|08|pjebusno|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131224; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pjgnxa.org"; content:"|06|pjgnxa|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131225; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pjjjamzy.net"; content:"|08|pjjjamzy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131226; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pjjqp.biz"; content:"|05|pjjqp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131227; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pjmdtn.cc"; content:"|06|pjmdtn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131228; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pjmggaxx.cn"; content:"|08|pjmggaxx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131229; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pjnevopquf.net"; content:"|0a|pjnevopquf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131230; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pjrauosyz.cc"; content:"|09|pjrauosyz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131231; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pjwetixp.com"; content:"|08|pjwetixp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131232; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pjxiglmb.net"; content:"|08|pjxiglmb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131233; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pjylqv.ws"; content:"|06|pjylqv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131234; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pjyugshvrh.cc"; content:"|0a|pjyugshvrh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131235; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pkedutyz.net"; content:"|08|pkedutyz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131236; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pkgknwbj.ws"; content:"|08|pkgknwbj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131237; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pkhwqbtgnax.biz"; content:"|0b|pkhwqbtgnax|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131238; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pkmkvipu.ws"; content:"|08|pkmkvipu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131239; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pknmjtjcxc.net"; content:"|0a|pknmjtjcxc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131240; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pktlyyxwc.cc"; content:"|09|pktlyyxwc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131241; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pkvcrldepy.biz"; content:"|0a|pkvcrldepy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131242; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pkvnhhuajbx.org"; content:"|0b|pkvnhhuajbx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131243; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain plafeaw.info"; content:"|07|plafeaw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131244; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain plbdwipvxmu.cc"; content:"|0b|plbdwipvxmu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131245; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain plcptcqjl.com"; content:"|09|plcptcqjl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131246; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pleicphsrz.cc"; content:"|0a|pleicphsrz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131247; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain plepbobz.ws"; content:"|08|plepbobz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131248; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain plggejcsni.biz"; content:"|0a|plggejcsni|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131249; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain plihtv.info"; content:"|06|plihtv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131250; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain plkbb.org"; content:"|05|plkbb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131251; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pllph.com"; content:"|05|pllph|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131252; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain plmyoskqb.com"; content:"|09|plmyoskqb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131253; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain plnct.biz"; content:"|05|plnct|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131254; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain plprt.cn"; content:"|05|plprt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131255; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain plunhhbgqr.com"; content:"|0a|plunhhbgqr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131256; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain plycxep.ws"; content:"|07|plycxep|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131257; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pmecvyb.net"; content:"|07|pmecvyb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131258; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pmeggbpduug.biz"; content:"|0b|pmeggbpduug|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131259; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pmhrtxu.org"; content:"|07|pmhrtxu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131260; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pmppml.com"; content:"|06|pmppml|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131261; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pmqcjvvbj.ws"; content:"|09|pmqcjvvbj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131262; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pmriiidb.net"; content:"|08|pmriiidb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131263; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pmulwmzcew.cc"; content:"|0a|pmulwmzcew|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131264; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pmuudafit.org"; content:"|09|pmuudafit|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131265; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pmxymhvom.cc"; content:"|09|pmxymhvom|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131266; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pmzznlgwls.info"; content:"|0a|pmzznlgwls|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131267; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pnblolbzbj.ws"; content:"|0a|pnblolbzbj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131268; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pndkr.ws"; content:"|05|pndkr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131269; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pngjlp.com"; content:"|06|pngjlp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131270; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pnjsc.com"; content:"|05|pnjsc|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131271; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pnkioypwjcw.cn"; content:"|0b|pnkioypwjcw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131272; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pnlcxpqwj.ws"; content:"|09|pnlcxpqwj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131273; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pnldwlxihka.biz"; content:"|0b|pnldwlxihka|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131274; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pnmglysn.info"; content:"|08|pnmglysn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131275; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pnowaayxr.com"; content:"|09|pnowaayxr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131276; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pnqaliunq.cn"; content:"|09|pnqaliunq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131277; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pntwu.net"; content:"|05|pntwu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131278; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pnvekrsi.net"; content:"|08|pnvekrsi|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131279; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pnvkyvti.cc"; content:"|08|pnvkyvti|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131280; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pnvmelx.biz"; content:"|07|pnvmelx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131281; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pnxtgaz.com"; content:"|07|pnxtgaz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131282; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain poanzsug.net"; content:"|08|poanzsug|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131283; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain poiuklft.info"; content:"|08|poiuklft|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131284; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pojhbuws.cn"; content:"|08|pojhbuws|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131285; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pokguqaip.cc"; content:"|09|pokguqaip|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131286; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain poqbxybyl.org"; content:"|09|poqbxybyl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131287; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain potzxw.cn"; content:"|06|potzxw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131288; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pousjtvx.cn"; content:"|08|pousjtvx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131289; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain poyzizdi.cc"; content:"|08|poyzizdi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131290; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ppfsimy.biz"; content:"|07|ppfsimy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131291; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ppgaiqbb.org"; content:"|08|ppgaiqbb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131292; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ppjkkyfz.com"; content:"|08|ppjkkyfz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131293; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ppkpjeu.net"; content:"|07|ppkpjeu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131294; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ppoosnzawk.cc"; content:"|0a|ppoosnzawk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131295; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pppwovlwg.cc"; content:"|09|pppwovlwg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131296; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ppvedbv.ws"; content:"|07|ppvedbv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131297; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pqaroidl.net"; content:"|08|pqaroidl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131298; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pqbvq.com"; content:"|05|pqbvq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131299; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pqhhhkwxhx.cn"; content:"|0a|pqhhhkwxhx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131300; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pqhomof.cc"; content:"|07|pqhomof|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131301; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pqllrolt.org"; content:"|08|pqllrolt|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131302; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pqovrf.info"; content:"|06|pqovrf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131303; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pqqmkuaa.ws"; content:"|08|pqqmkuaa|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131304; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pqrmtwarzgo.ws"; content:"|0b|pqrmtwarzgo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131305; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pqujjjqz.cc"; content:"|08|pqujjjqz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131306; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pqumck.cn"; content:"|06|pqumck|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131307; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pqusxwlx.org"; content:"|08|pqusxwlx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131308; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pralfura.cn"; content:"|08|pralfura|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131309; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain praumhoxlft.ws"; content:"|0b|praumhoxlft|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131310; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain prdmjc.org"; content:"|06|prdmjc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131311; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pregr.info"; content:"|05|pregr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131312; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain prjjtzvu.info"; content:"|08|prjjtzvu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131313; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain prjxytaz.info"; content:"|08|prjxytaz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131314; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain prkfpvwgq.net"; content:"|09|prkfpvwgq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131315; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain prrwxpdujtg.cc"; content:"|0b|prrwxpdujtg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131316; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain prxkdfhuko.cn"; content:"|0a|prxkdfhuko|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131317; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain prxsexgxb.com"; content:"|09|prxsexgxb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131318; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain psbmqr.cc"; content:"|06|psbmqr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131319; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain psiommmawqw.biz"; content:"|0b|psiommmawqw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131320; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pskjnr.com"; content:"|06|pskjnr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131321; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pslyfarvil.net"; content:"|0a|pslyfarvil|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131322; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain psowcm.info"; content:"|06|psowcm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131323; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pswjxdfeu.com"; content:"|09|pswjxdfeu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131324; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pszasugv.net"; content:"|08|pszasugv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131325; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pszyrt.com"; content:"|06|pszyrt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131326; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ptafuh.info"; content:"|06|ptafuh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131327; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ptajknqazsg.info"; content:"|0b|ptajknqazsg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131328; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ptdjiasqf.com"; content:"|09|ptdjiasqf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131329; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ptdpket.com"; content:"|07|ptdpket|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131330; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ptfburxw.biz"; content:"|08|ptfburxw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131331; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ptfpsyzzunr.org"; content:"|0b|ptfpsyzzunr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131332; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ptlbnukuex.org"; content:"|0a|ptlbnukuex|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131333; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ptnldwav.cn"; content:"|08|ptnldwav|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131334; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ptpgteqrzl.info"; content:"|0a|ptpgteqrzl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131335; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ptratbfswi.net"; content:"|0a|ptratbfswi|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131336; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pttryvuhfpl.info"; content:"|0b|pttryvuhfpl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131337; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ptxasmae.com"; content:"|08|ptxasmae|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131338; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ptxphpezq.cn"; content:"|09|ptxphpezq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131339; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ptyvhhmc.org"; content:"|08|ptyvhhmc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131340; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pugtlizpukh.info"; content:"|0b|pugtlizpukh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131341; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain puhgwpk.org"; content:"|07|puhgwpk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131342; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain puimofzpcl.cn"; content:"|0a|puimofzpcl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131343; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain puimtlqhzd.com"; content:"|0a|puimtlqhzd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131344; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pulpmpy.info"; content:"|07|pulpmpy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131345; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain puoypy.org"; content:"|06|puoypy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131346; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain puqellke.ws"; content:"|08|puqellke|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131347; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain puvjauzak.cn"; content:"|09|puvjauzak|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131348; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain puvrduzqas.cn"; content:"|0a|puvrduzqas|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131349; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain puyzhtxdn.ws"; content:"|09|puyzhtxdn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131350; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain puzarmbvpam.org"; content:"|0b|puzarmbvpam|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131351; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pvacxvec.org"; content:"|08|pvacxvec|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131352; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pvbbml.biz"; content:"|06|pvbbml|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131353; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pvdewrpl.com"; content:"|08|pvdewrpl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131354; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pveervbudc.net"; content:"|0a|pveervbudc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131355; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pvgwblseru.biz"; content:"|0a|pvgwblseru|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131356; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pvitfu.cn"; content:"|06|pvitfu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131357; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pvmhqcxxur.cc"; content:"|0a|pvmhqcxxur|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131358; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pvmoswihh.org"; content:"|09|pvmoswihh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131359; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pvvixs.biz"; content:"|06|pvvixs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131360; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pvwgrbgev.ws"; content:"|09|pvwgrbgev|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131361; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pvwhx.cn"; content:"|05|pvwhx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131362; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pwgimx.info"; content:"|06|pwgimx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131363; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pwgojac.biz"; content:"|07|pwgojac|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131364; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pwnflyff.org"; content:"|08|pwnflyff|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131365; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pwpjyed.com"; content:"|07|pwpjyed|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131366; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pwrdlvf.info"; content:"|07|pwrdlvf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131367; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pwurarmh.cc"; content:"|08|pwurarmh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131368; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pwvvilbyu.ws"; content:"|09|pwvvilbyu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131369; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pwyktiugsl.net"; content:"|0a|pwyktiugsl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131370; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pxfngolf.ws"; content:"|08|pxfngolf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131371; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pxvkhdd.cn"; content:"|07|pxvkhdd|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131372; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pxvus.biz"; content:"|05|pxvus|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131373; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pybsxwqz.info"; content:"|08|pybsxwqz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131374; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pyevutb.org"; content:"|07|pyevutb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131375; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pyfuwi.cc"; content:"|06|pyfuwi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131376; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pymssfad.net"; content:"|08|pymssfad|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131377; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pynlnnyxrl.biz"; content:"|0a|pynlnnyxrl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131378; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pywett.info"; content:"|06|pywett|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131379; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pywyrxsoyo.net"; content:"|0a|pywyrxsoyo|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131380; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pyyfqtsc.cc"; content:"|08|pyyfqtsc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131381; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pzbtwhrky.biz"; content:"|09|pzbtwhrky|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131382; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pzdivk.biz"; content:"|06|pzdivk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131383; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pzfnc.cn"; content:"|05|pzfnc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131384; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pzjlgd.cc"; content:"|06|pzjlgd|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131385; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pzstbb.com"; content:"|06|pzstbb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131386; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pzszkeqw.info"; content:"|08|pzszkeqw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131387; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pztjzmfjnbp.org"; content:"|0b|pztjzmfjnbp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131388; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pztvqgjmf.com"; content:"|09|pztvqgjmf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131389; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pzuvoz.cc"; content:"|06|pzuvoz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131390; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pzvjejamkv.biz"; content:"|0a|pzvjejamkv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131391; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pzwgh.cc"; content:"|05|pzwgh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131392; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pzxqqydsfd.cc"; content:"|0a|pzxqqydsfd|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131393; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain pzzlnb.com"; content:"|06|pzzlnb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131394; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qaaumeimjgn.net"; content:"|0b|qaaumeimjgn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131395; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qabktvp.cc"; content:"|07|qabktvp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131396; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qabmrvnvnl.org"; content:"|0a|qabmrvnvnl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131397; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qadgtwfqhj.cc"; content:"|0a|qadgtwfqhj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131398; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qaftkr.net"; content:"|06|qaftkr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131399; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qaqwmfjynmk.cn"; content:"|0b|qaqwmfjynmk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131400; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qasjficq.biz"; content:"|08|qasjficq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131401; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qaskyfvghpv.net"; content:"|0b|qaskyfvghpv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131402; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qasxda.net"; content:"|06|qasxda|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131403; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qautntgf.cn"; content:"|08|qautntgf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131404; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qbbbnwkpmy.ws"; content:"|0a|qbbbnwkpmy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131405; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qbjeznsdcwf.info"; content:"|0b|qbjeznsdcwf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131406; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qbkvqkjj.biz"; content:"|08|qbkvqkjj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131407; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qbrtoc.net"; content:"|06|qbrtoc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131408; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qbthaorwbw.ws"; content:"|0a|qbthaorwbw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131409; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qbupwqpp.net"; content:"|08|qbupwqpp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131410; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qbwwzr.cc"; content:"|06|qbwwzr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131411; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qbxfnaxi.ws"; content:"|08|qbxfnaxi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131412; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qbyemqblya.biz"; content:"|0a|qbyemqblya|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131413; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qbzfigxm.org"; content:"|08|qbzfigxm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131414; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qcczqdwvbul.com"; content:"|0b|qcczqdwvbul|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131415; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qcimjafucd.biz"; content:"|0a|qcimjafucd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131416; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qcjfpwki.cn"; content:"|08|qcjfpwki|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131417; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qcjxiq.cc"; content:"|06|qcjxiq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131418; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qckagzlly.ws"; content:"|09|qckagzlly|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131419; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qcnpdp.net"; content:"|06|qcnpdp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131420; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qcqtkmm.org"; content:"|07|qcqtkmm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131421; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qcqzijihrbi.org"; content:"|0b|qcqzijihrbi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131422; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qcshh.ws"; content:"|05|qcshh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131423; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qcxrzjkibk.org"; content:"|0a|qcxrzjkibk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131424; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qcyacnx.cc"; content:"|07|qcyacnx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131425; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qdfyhwsj.info"; content:"|08|qdfyhwsj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131426; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qdlinqkj.cn"; content:"|08|qdlinqkj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131427; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qdofhtn.cn"; content:"|07|qdofhtn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131428; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qdolfvphqey.cc"; content:"|0b|qdolfvphqey|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131429; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qdoujdxfkv.info"; content:"|0a|qdoujdxfkv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131430; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qdqcj.info"; content:"|05|qdqcj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131431; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qdvjcy.ws"; content:"|06|qdvjcy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131432; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qdwod.biz"; content:"|05|qdwod|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131433; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qeahojvb.com"; content:"|08|qeahojvb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131434; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qedckhvug.info"; content:"|09|qedckhvug|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131435; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qefeblddml.cn"; content:"|0a|qefeblddml|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131436; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qejwksoprdq.cc"; content:"|0b|qejwksoprdq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131437; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qekdrpuk.info"; content:"|08|qekdrpuk|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131438; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qezcylybpes.net"; content:"|0b|qezcylybpes|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131439; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qfalhafl.biz"; content:"|08|qfalhafl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131440; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qfdzi.cn"; content:"|05|qfdzi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131441; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qffmlssift.ws"; content:"|0a|qffmlssift|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131442; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qfgid.cn"; content:"|05|qfgid|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131443; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qfifhgvzw.org"; content:"|09|qfifhgvzw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131444; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qfuvhuc.biz"; content:"|07|qfuvhuc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131445; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qfxahfnzrey.biz"; content:"|0b|qfxahfnzrey|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131446; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qfymhtdcilp.ws"; content:"|0b|qfymhtdcilp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131447; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qgayfsvv.cc"; content:"|08|qgayfsvv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131448; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qgdbibgvtvx.com"; content:"|0b|qgdbibgvtvx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131449; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qgdqzyylpz.cc"; content:"|0a|qgdqzyylpz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131450; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qghegpum.biz"; content:"|08|qghegpum|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131451; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qgifbgcehd.ws"; content:"|0a|qgifbgcehd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131452; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qgiqzqku.org"; content:"|08|qgiqzqku|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131453; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qgjoigz.cc"; content:"|07|qgjoigz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131454; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qgonj.org"; content:"|05|qgonj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131455; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qgpyxv.cc"; content:"|06|qgpyxv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131456; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qgqlegd.ws"; content:"|07|qgqlegd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131457; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qguxq.net"; content:"|05|qguxq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131458; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qgvdewfrugn.biz"; content:"|0b|qgvdewfrugn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131459; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qgzbblvj.cn"; content:"|08|qgzbblvj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131460; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qhadbvoewux.ws"; content:"|0b|qhadbvoewux|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131461; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qhcrcvaj.com"; content:"|08|qhcrcvaj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131462; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qhewh.biz"; content:"|05|qhewh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131463; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qhicobspqz.biz"; content:"|0a|qhicobspqz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131464; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qhjwjbl.cc"; content:"|07|qhjwjbl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131465; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qhoinnw.org"; content:"|07|qhoinnw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131466; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qhpolvizd.cc"; content:"|09|qhpolvizd|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131467; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qhrtqufcby.cc"; content:"|0a|qhrtqufcby|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131468; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qhttgwjumgy.info"; content:"|0b|qhttgwjumgy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131469; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qhuszdmw.ws"; content:"|08|qhuszdmw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131470; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qhuuaxmcmm.cn"; content:"|0a|qhuuaxmcmm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131471; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qiayjduc.biz"; content:"|08|qiayjduc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131472; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qibwdeut.org"; content:"|08|qibwdeut|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131473; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qiemhukm.info"; content:"|08|qiemhukm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131474; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qifpvwidp.info"; content:"|09|qifpvwidp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131475; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qimzdrke.ws"; content:"|08|qimzdrke|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131476; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qinenxowbfq.info"; content:"|0b|qinenxowbfq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131477; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qinuerjgx.cn"; content:"|09|qinuerjgx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131478; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qirgo.net"; content:"|05|qirgo|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131479; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qiulotxgo.cn"; content:"|09|qiulotxgo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131480; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qivtol.ws"; content:"|06|qivtol|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131481; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qjawq.cc"; content:"|05|qjawq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131482; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qjcxgnndotw.ws"; content:"|0b|qjcxgnndotw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131483; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qjfxbvm.biz"; content:"|07|qjfxbvm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131484; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qjhjdhlz.cn"; content:"|08|qjhjdhlz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131485; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qjhmxkxd.biz"; content:"|08|qjhmxkxd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131486; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qjjrkniy.cn"; content:"|08|qjjrkniy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131487; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qjkew.cc"; content:"|05|qjkew|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131488; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qjmokzhkje.cc"; content:"|0a|qjmokzhkje|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131489; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qjofdixzldq.com"; content:"|0b|qjofdixzldq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131490; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qjpearsx.info"; content:"|08|qjpearsx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131491; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qjpifsgyq.cc"; content:"|09|qjpifsgyq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131492; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qjsadoxp.net"; content:"|08|qjsadoxp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131493; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qjuymtkvuz.biz"; content:"|0a|qjuymtkvuz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131494; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qjzsjizrql.org"; content:"|0a|qjzsjizrql|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131495; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qkbhug.com"; content:"|06|qkbhug|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131496; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qkbkrejv.ws"; content:"|08|qkbkrejv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131497; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qkhqya.org"; content:"|06|qkhqya|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131498; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qkicwpssyqq.ws"; content:"|0b|qkicwpssyqq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131499; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qkkmvlbeju.ws"; content:"|0a|qkkmvlbeju|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131500; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qkmgw.info"; content:"|05|qkmgw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131501; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qksanemv.info"; content:"|08|qksanemv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131502; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qktevuzhocb.ws"; content:"|0b|qktevuzhocb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131503; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qkutpgy.cn"; content:"|07|qkutpgy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131504; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qkwkisxjrda.info"; content:"|0b|qkwkisxjrda|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131505; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qkwtuqsvosx.net"; content:"|0b|qkwtuqsvosx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131506; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qkzsjlke.cc"; content:"|08|qkzsjlke|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131507; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qlbipppa.cc"; content:"|08|qlbipppa|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131508; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qlczv.ws"; content:"|05|qlczv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131509; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qldhsago.ws"; content:"|08|qldhsago|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131510; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qldicmvkgjs.org"; content:"|0b|qldicmvkgjs|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131511; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qldphap.cc"; content:"|07|qldphap|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131512; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qlfdkrct.info"; content:"|08|qlfdkrct|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131513; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qllpfooy.info"; content:"|08|qllpfooy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131514; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qlnffol.cn"; content:"|07|qlnffol|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131515; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qlogqutck.biz"; content:"|09|qlogqutck|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131516; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qlpwryfw.cn"; content:"|08|qlpwryfw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131517; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qlrftmmkeb.ws"; content:"|0a|qlrftmmkeb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131518; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qlvxbtedi.net"; content:"|09|qlvxbtedi|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131519; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qmfadrq.cc"; content:"|07|qmfadrq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131520; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qmjajbhlz.cc"; content:"|09|qmjajbhlz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131521; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qmtpueij.cn"; content:"|08|qmtpueij|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131522; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qnacqa.cn"; content:"|06|qnacqa|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131523; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qnafc.cn"; content:"|05|qnafc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131524; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qnbtavef.ws"; content:"|08|qnbtavef|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131525; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qnepvnyi.com"; content:"|08|qnepvnyi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131526; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qnjhgeqo.org"; content:"|08|qnjhgeqo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131527; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qnrfhab.cn"; content:"|07|qnrfhab|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131528; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qnurw.info"; content:"|05|qnurw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131529; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qnywyohh.net"; content:"|08|qnywyohh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131530; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qoabx.info"; content:"|05|qoabx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131531; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qoannyakv.com"; content:"|09|qoannyakv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131532; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qoawwhift.ws"; content:"|09|qoawwhift|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131533; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qodltlxq.info"; content:"|08|qodltlxq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131534; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qofvmh.org"; content:"|06|qofvmh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131535; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qohzshqs.cn"; content:"|08|qohzshqs|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131536; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qoimnv.info"; content:"|06|qoimnv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131537; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qoiwnsds.net"; content:"|08|qoiwnsds|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131538; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qokjsrql.info"; content:"|08|qokjsrql|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131539; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qolzlkj.cc"; content:"|07|qolzlkj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131540; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qonsfxge.cc"; content:"|08|qonsfxge|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131541; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qooqx.cc"; content:"|05|qooqx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131542; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qopwuuexkz.cc"; content:"|0a|qopwuuexkz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131543; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qoreqq.ws"; content:"|06|qoreqq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131544; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qortwaop.net"; content:"|08|qortwaop|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131545; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qozxumsp.org"; content:"|08|qozxumsp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131546; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qpawss.org"; content:"|06|qpawss|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131547; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qpfltprtdi.ws"; content:"|0a|qpfltprtdi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131548; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qpfvfblzzpv.cn"; content:"|0b|qpfvfblzzpv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131549; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qpiyveyem.info"; content:"|09|qpiyveyem|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131550; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qplszkmhy.biz"; content:"|09|qplszkmhy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131551; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qpneqvcq.ws"; content:"|08|qpneqvcq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131552; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qpwxnkr.com"; content:"|07|qpwxnkr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131553; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qpxysphd.info"; content:"|08|qpxysphd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131554; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qpymjmhg.ws"; content:"|08|qpymjmhg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131555; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qqcszt.com"; content:"|06|qqcszt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131556; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qqimfkn.ws"; content:"|07|qqimfkn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131557; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qqnacg.cc"; content:"|06|qqnacg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131558; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qqpnaajt.cn"; content:"|08|qqpnaajt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131559; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qqulhbnqr.info"; content:"|09|qqulhbnqr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131560; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qqxpzy.biz"; content:"|06|qqxpzy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131561; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qqxxwmvc.net"; content:"|08|qqxxwmvc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131562; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qqzcj.biz"; content:"|05|qqzcj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131563; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qrbjxq.cc"; content:"|06|qrbjxq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131564; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qrdrrlxk.com"; content:"|08|qrdrrlxk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131565; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qrlnw.info"; content:"|05|qrlnw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131566; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qroqhapisu.org"; content:"|0a|qroqhapisu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131567; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qrplvbq.ws"; content:"|07|qrplvbq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131568; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qrtrfgr.com"; content:"|07|qrtrfgr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131569; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qrweyxte.cn"; content:"|08|qrweyxte|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131570; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qsdevuhx.cc"; content:"|08|qsdevuhx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131571; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qsehd.ws"; content:"|05|qsehd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131572; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qsfzy.cn"; content:"|05|qsfzy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131573; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qsjnu.biz"; content:"|05|qsjnu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131574; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qskpkic.ws"; content:"|07|qskpkic|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131575; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qsliadryqdl.biz"; content:"|0b|qsliadryqdl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131576; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qsphossoosm.info"; content:"|0b|qsphossoosm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131577; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qsqzphbn.biz"; content:"|08|qsqzphbn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131578; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qssxelpaj.biz"; content:"|09|qssxelpaj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131579; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qstvmix.cc"; content:"|07|qstvmix|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131580; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qswex.ws"; content:"|05|qswex|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131581; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qswtpkukowa.com"; content:"|0b|qswtpkukowa|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131582; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qsxcmwzhazv.info"; content:"|0b|qsxcmwzhazv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131583; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qsxeivsx.com"; content:"|08|qsxeivsx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131584; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qszdsach.net"; content:"|08|qszdsach|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131585; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qtaldgw.cc"; content:"|07|qtaldgw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131586; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qtasozeikv.cc"; content:"|0a|qtasozeikv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131587; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qtbmhtzr.com"; content:"|08|qtbmhtzr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131588; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qtdpwbqe.cn"; content:"|08|qtdpwbqe|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131589; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qtedmd.ws"; content:"|06|qtedmd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131590; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qtfiwzoynvt.biz"; content:"|0b|qtfiwzoynvt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131591; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qtgwrex.ws"; content:"|07|qtgwrex|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131592; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qtjeguoq.biz"; content:"|08|qtjeguoq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131593; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qtmmqlhn.cc"; content:"|08|qtmmqlhn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131594; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qtomwj.net"; content:"|06|qtomwj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131595; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qtqkzrdq.net"; content:"|08|qtqkzrdq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131596; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qtswkdyv.org"; content:"|08|qtswkdyv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131597; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qtuugidrs.org"; content:"|09|qtuugidrs|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131598; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qtwsu.cn"; content:"|05|qtwsu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131599; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qtznkfhtubt.net"; content:"|0b|qtznkfhtubt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131600; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qubvgudy.biz"; content:"|08|qubvgudy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131601; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qubyrikn.biz"; content:"|08|qubyrikn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131602; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain quegn.com"; content:"|05|quegn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131603; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qugqb.cc"; content:"|05|qugqb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131604; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain quhadtzhf.cn"; content:"|09|quhadtzhf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131605; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain quiarcmzv.net"; content:"|09|quiarcmzv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131606; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain quijpkm.net"; content:"|07|quijpkm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131607; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain quluaum.net"; content:"|07|quluaum|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131608; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qunxrz.ws"; content:"|06|qunxrz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131609; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain quqgdstsjng.org"; content:"|0b|quqgdstsjng|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131610; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain quqkos.cn"; content:"|06|quqkos|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131611; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain quszmfjxua.net"; content:"|0a|quszmfjxua|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131612; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qutyj.biz"; content:"|05|qutyj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131613; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain quwft.org"; content:"|05|quwft|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131614; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain quwhdjti.info"; content:"|08|quwhdjti|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131615; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain quzvccfmdv.info"; content:"|0a|quzvccfmdv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131616; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain quzwxckdf.com"; content:"|09|quzwxckdf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131617; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain quzzvbzxjr.com"; content:"|0a|quzzvbzxjr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131618; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qvdzfaho.cn"; content:"|08|qvdzfaho|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131619; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qvfgggsqtng.info"; content:"|0b|qvfgggsqtng|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131620; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qvhilplhfqq.ws"; content:"|0b|qvhilplhfqq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131621; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qvmzqye.cc"; content:"|07|qvmzqye|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131622; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qvnfaywhwhw.com"; content:"|0b|qvnfaywhwhw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131623; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qvnhbpk.org"; content:"|07|qvnhbpk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131624; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qvsmrqmdrm.com"; content:"|0a|qvsmrqmdrm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131625; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qvueu.info"; content:"|05|qvueu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131626; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qvwckjrf.net"; content:"|08|qvwckjrf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131627; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qvyvzewbqkq.ws"; content:"|0b|qvyvzewbqkq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131628; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qvzypxf.com"; content:"|07|qvzypxf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131629; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qwfcxgnc.info"; content:"|08|qwfcxgnc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131630; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qwinh.org"; content:"|05|qwinh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131631; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qwjuegxqh.net"; content:"|09|qwjuegxqh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131632; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qwpesyonrmi.org"; content:"|0b|qwpesyonrmi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131633; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qwqkvsda.org"; content:"|08|qwqkvsda|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131634; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qwrocvcxdj.com"; content:"|0a|qwrocvcxdj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131635; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qwusil.cn"; content:"|06|qwusil|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131636; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qwzicmkwz.org"; content:"|09|qwzicmkwz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131637; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qxcxpni.biz"; content:"|07|qxcxpni|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131638; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qxdkkpacly.com"; content:"|0a|qxdkkpacly|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131639; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qxenfobwl.info"; content:"|09|qxenfobwl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131640; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qxkvlqwi.info"; content:"|08|qxkvlqwi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131641; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qxmqdmbq.org"; content:"|08|qxmqdmbq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131642; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qxrnjpyctb.cn"; content:"|0a|qxrnjpyctb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131643; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qxstvnsd.net"; content:"|08|qxstvnsd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131644; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qxsxb.com"; content:"|05|qxsxb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131645; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qxtjbnjh.info"; content:"|08|qxtjbnjh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131646; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qxyzgnspv.com"; content:"|09|qxyzgnspv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131647; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qyampepf.org"; content:"|08|qyampepf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131648; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qybdhoaha.info"; content:"|09|qybdhoaha|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131649; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qybgneto.cc"; content:"|08|qybgneto|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131650; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qyebtoqbjfk.net"; content:"|0b|qyebtoqbjfk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131651; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qyjltabsst.info"; content:"|0a|qyjltabsst|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131652; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qykelyjzh.ws"; content:"|09|qykelyjzh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131653; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qylslhes.cn"; content:"|08|qylslhes|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131654; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qymfl.cc"; content:"|05|qymfl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131655; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qyohr.cc"; content:"|05|qyohr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131656; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qyrijhdd.biz"; content:"|08|qyrijhdd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131657; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qysvcgwah.ws"; content:"|09|qysvcgwah|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131658; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qytgc.cc"; content:"|05|qytgc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131659; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qyujxpk.cn"; content:"|07|qyujxpk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131660; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qyvsfov.com"; content:"|07|qyvsfov|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131661; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qzbvem.biz"; content:"|06|qzbvem|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131662; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qzgnxw.net"; content:"|06|qzgnxw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131663; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qzgyjhup.biz"; content:"|08|qzgyjhup|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131664; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qzivyjquml.net"; content:"|0a|qzivyjquml|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131665; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qzjyrml.com"; content:"|07|qzjyrml|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131666; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qzkaju.cc"; content:"|06|qzkaju|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131667; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qzleqgznf.info"; content:"|09|qzleqgznf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131668; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qzlfh.net"; content:"|05|qzlfh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131669; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qzooymslxej.com"; content:"|0b|qzooymslxej|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131670; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qzpbloczji.net"; content:"|0a|qzpbloczji|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131671; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qzpvisbi.net"; content:"|08|qzpvisbi|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131672; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qzrggnrqst.com"; content:"|0a|qzrggnrqst|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131673; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qztsgdxmpqu.biz"; content:"|0b|qztsgdxmpqu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131674; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qzxydhk.net"; content:"|07|qzxydhk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131675; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain qzyrvndwoc.cc"; content:"|0a|qzyrvndwoc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131676; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain raalbadv.biz"; content:"|08|raalbadv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131677; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain racjzx.org"; content:"|06|racjzx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131678; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain racsx.info"; content:"|05|racsx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131679; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rafkqbyd.com"; content:"|08|rafkqbyd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131680; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rakaxu.info"; content:"|06|rakaxu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131681; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ralhutpu.cn"; content:"|08|ralhutpu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131682; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ramgjeat.ws"; content:"|08|ramgjeat|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131683; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain raqmrl.cn"; content:"|06|raqmrl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131684; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rasheyojv.org"; content:"|09|rasheyojv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131685; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain raubskriq.org"; content:"|09|raubskriq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131686; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rbcjkg.org"; content:"|06|rbcjkg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131687; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rbekhsjm.info"; content:"|08|rbekhsjm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131688; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rbfan.org"; content:"|05|rbfan|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131689; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rbifty.biz"; content:"|06|rbifty|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131690; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rbjeqpnp.biz"; content:"|08|rbjeqpnp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131691; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rbpbj.com"; content:"|05|rbpbj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131692; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rbtecgfirq.info"; content:"|0a|rbtecgfirq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131693; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rbyrn.cn"; content:"|05|rbyrn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131694; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rbyzt.biz"; content:"|05|rbyzt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131695; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rbzcikvmd.biz"; content:"|09|rbzcikvmd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131696; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rbzidpwqe.net"; content:"|09|rbzidpwqe|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131697; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rbzjkswmaov.ws"; content:"|0b|rbzjkswmaov|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131698; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rbzylysnj.org"; content:"|09|rbzylysnj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131699; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rcavymltxt.biz"; content:"|0a|rcavymltxt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131700; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rcbyhvcrwa.cn"; content:"|0a|rcbyhvcrwa|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131701; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rcelnq.cc"; content:"|06|rcelnq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131702; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rchvvorw.ws"; content:"|08|rchvvorw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131703; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rchwwlcb.org"; content:"|08|rchwwlcb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131704; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rckibfug.ws"; content:"|08|rckibfug|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131705; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rclpcz.org"; content:"|06|rclpcz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131706; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rcyimutglo.com"; content:"|0a|rcyimutglo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131707; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rcziownth.com"; content:"|09|rcziownth|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131708; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rdbauksv.info"; content:"|08|rdbauksv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131709; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rdcszutu.com"; content:"|08|rdcszutu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131710; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rdexbtmbl.cn"; content:"|09|rdexbtmbl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131711; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rdfarfyewl.com"; content:"|0a|rdfarfyewl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131712; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rdfswbanm.org"; content:"|09|rdfswbanm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131713; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rdhclmucp.net"; content:"|09|rdhclmucp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131714; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rdjctqxy.cc"; content:"|08|rdjctqxy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131715; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rdjqownr.com"; content:"|08|rdjqownr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131716; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rdprelwvb.info"; content:"|09|rdprelwvb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131717; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rdvawqzqijj.info"; content:"|0b|rdvawqzqijj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131718; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rdwtyuufalt.com"; content:"|0b|rdwtyuufalt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131719; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rebfockcth.ws"; content:"|0a|rebfockcth|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131720; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rejze.cc"; content:"|05|rejze|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131721; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain relrzcn.info"; content:"|07|relrzcn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131722; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain renxmbz.net"; content:"|07|renxmbz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131723; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain reobqwkilit.cc"; content:"|0b|reobqwkilit|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131724; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain reouydwdm.biz"; content:"|09|reouydwdm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131725; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain reqyuj.org"; content:"|06|reqyuj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131726; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rewjywqqo.info"; content:"|09|rewjywqqo|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131727; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rfdeesry.com"; content:"|08|rfdeesry|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131728; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rfejugue.info"; content:"|08|rfejugue|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131729; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rflqrvdydx.com"; content:"|0a|rflqrvdydx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131730; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rflzjrum.cn"; content:"|08|rflzjrum|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131731; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rfqczmtl.com"; content:"|08|rfqczmtl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131732; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rfuwbtpao.biz"; content:"|09|rfuwbtpao|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131733; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rfwywk.cc"; content:"|06|rfwywk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131734; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rfyed.ws"; content:"|05|rfyed|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131735; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rgbzv.cn"; content:"|05|rgbzv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131736; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rgchrvllei.net"; content:"|0a|rgchrvllei|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131737; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rgdcynmhntg.info"; content:"|0b|rgdcynmhntg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131738; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rgebqfky.cc"; content:"|08|rgebqfky|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131739; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rgfypgjh.biz"; content:"|08|rgfypgjh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131740; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rgknkeug.cc"; content:"|08|rgknkeug|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131741; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rglmx.info"; content:"|05|rglmx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131742; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rgpss.org"; content:"|05|rgpss|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131743; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rgqrrwfeoa.cc"; content:"|0a|rgqrrwfeoa|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131744; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rgxcau.com"; content:"|06|rgxcau|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131745; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rhajsi.ws"; content:"|06|rhajsi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131746; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rhctgs.com"; content:"|06|rhctgs|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131747; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rhcypryu.cc"; content:"|08|rhcypryu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131748; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rhehnaj.net"; content:"|07|rhehnaj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131749; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rhfkejzf.cn"; content:"|08|rhfkejzf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131750; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rhgyydcyyo.cc"; content:"|0a|rhgyydcyyo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131751; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rhntrjxx.biz"; content:"|08|rhntrjxx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131752; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rhrahyqpsw.info"; content:"|0a|rhrahyqpsw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131753; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rhztuit.net"; content:"|07|rhztuit|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131754; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rhzxknos.biz"; content:"|08|rhzxknos|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131755; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ribnhdd.info"; content:"|07|ribnhdd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131756; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rifav.com"; content:"|05|rifav|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131757; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rihbrnoa.info"; content:"|08|rihbrnoa|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131758; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rijpyth.org"; content:"|07|rijpyth|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131759; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rikxptlxql.org"; content:"|0a|rikxptlxql|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131760; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rimtnxo.cn"; content:"|07|rimtnxo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131761; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rinisz.biz"; content:"|06|rinisz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131762; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain riqknkgj.info"; content:"|08|riqknkgj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131763; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain riqyxgvya.ws"; content:"|09|riqyxgvya|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131764; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rirlhb.ws"; content:"|06|rirlhb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131765; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rivvkrcowlr.cc"; content:"|0b|rivvkrcowlr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131766; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rivyunrkskh.com"; content:"|0b|rivyunrkskh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131767; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain riynlba.net"; content:"|07|riynlba|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131768; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rjavlutq.cn"; content:"|08|rjavlutq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131769; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rjazqxfxmsd.cc"; content:"|0b|rjazqxfxmsd|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131770; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rjbtl.com"; content:"|05|rjbtl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131771; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rjcbd.net"; content:"|05|rjcbd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131772; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rjdii.info"; content:"|05|rjdii|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131773; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rjjgyb.info"; content:"|06|rjjgyb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131774; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rjlptxlxq.org"; content:"|09|rjlptxlxq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131775; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rjqjm.cc"; content:"|05|rjqjm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131776; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rjsav.com"; content:"|05|rjsav|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131777; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rjsffr.ws"; content:"|06|rjsffr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131778; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rjvall.ws"; content:"|06|rjvall|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131779; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rjvlwhvr.biz"; content:"|08|rjvlwhvr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131780; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rjxwaaely.cn"; content:"|09|rjxwaaely|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131781; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rjzkeijkmnv.com"; content:"|0b|rjzkeijkmnv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131782; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rjzuxroyrbj.com"; content:"|0b|rjzuxroyrbj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131783; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rkbqytwqds.cc"; content:"|0a|rkbqytwqds|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131784; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rkfunmd.net"; content:"|07|rkfunmd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131785; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rkgygiuqa.net"; content:"|09|rkgygiuqa|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131786; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rktgbmry.net"; content:"|08|rktgbmry|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131787; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rlfwtkpfei.com"; content:"|0a|rlfwtkpfei|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131788; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rlgyzxg.biz"; content:"|07|rlgyzxg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131789; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rlhct.ws"; content:"|05|rlhct|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131790; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rljsboda.cc"; content:"|08|rljsboda|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131791; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rlpgxilhi.ws"; content:"|09|rlpgxilhi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131792; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rlslxdey.cn"; content:"|08|rlslxdey|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131793; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rltimrcp.org"; content:"|08|rltimrcp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131794; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rmampuk.cn"; content:"|07|rmampuk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131795; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rmbojgpsd.biz"; content:"|09|rmbojgpsd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131796; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rmglvergkca.ws"; content:"|0b|rmglvergkca|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131797; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rmhyh.net"; content:"|05|rmhyh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131798; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rmjdpkwptlz.net"; content:"|0b|rmjdpkwptlz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131799; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rmktfaklohq.biz"; content:"|0b|rmktfaklohq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131800; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rmpvverw.info"; content:"|08|rmpvverw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131801; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rmqfcajefq.ws"; content:"|0a|rmqfcajefq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131802; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rmrhxq.biz"; content:"|06|rmrhxq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131803; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rmzyhnwtmn.org"; content:"|0a|rmzyhnwtmn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131804; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rnaghjxv.biz"; content:"|08|rnaghjxv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131805; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rncmbpeafbp.info"; content:"|0b|rncmbpeafbp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131806; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rncreh.cn"; content:"|06|rncreh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131807; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rniew.cc"; content:"|05|rniew|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131808; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rniousog.info"; content:"|08|rniousog|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131809; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rnjeqxq.ws"; content:"|07|rnjeqxq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131810; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rnqzhbvt.org"; content:"|08|rnqzhbvt|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131811; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rnsbb.net"; content:"|05|rnsbb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131812; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rnyktvxtf.cc"; content:"|09|rnyktvxtf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131813; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rnymyg.com"; content:"|06|rnymyg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131814; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain roery.org"; content:"|05|roery|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131815; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain roftjc.info"; content:"|06|roftjc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131816; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain roigsnrtvds.biz"; content:"|0b|roigsnrtvds|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131817; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain romcfvnmryd.ws"; content:"|0b|romcfvnmryd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131818; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain romkeunpx.cn"; content:"|09|romkeunpx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131819; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain roqqvqrc.com"; content:"|08|roqqvqrc|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131820; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain roxvqz.ws"; content:"|06|roxvqz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131821; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain royvtamqn.net"; content:"|09|royvtamqn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131822; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rozkig.info"; content:"|06|rozkig|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131823; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rpeckjzfomf.cc"; content:"|0b|rpeckjzfomf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131824; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rpedvmagz.ws"; content:"|09|rpedvmagz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131825; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rpeychzz.info"; content:"|08|rpeychzz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131826; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rpkzbsley.org"; content:"|09|rpkzbsley|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131827; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rptnsiqmjko.biz"; content:"|0b|rptnsiqmjko|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131828; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rqaxubzq.info"; content:"|08|rqaxubzq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131829; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rqdftonkoo.ws"; content:"|0a|rqdftonkoo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131830; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rqldxpu.ws"; content:"|07|rqldxpu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131831; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rqneyond.ws"; content:"|08|rqneyond|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131832; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rqqku.info"; content:"|05|rqqku|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131833; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rqxbr.ws"; content:"|05|rqxbr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131834; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rqxfbvifxf.org"; content:"|0a|rqxfbvifxf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131835; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rrdxfjj.org"; content:"|07|rrdxfjj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131836; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rreveufl.biz"; content:"|08|rreveufl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131837; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rrewefjtj.net"; content:"|09|rrewefjtj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131838; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rrhovohs.info"; content:"|08|rrhovohs|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131839; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rrjmfzxb.net"; content:"|08|rrjmfzxb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131840; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rrpdakk.org"; content:"|07|rrpdakk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131841; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rrsdfiur.com"; content:"|08|rrsdfiur|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131842; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rrsdvsj.net"; content:"|07|rrsdvsj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131843; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rrtbh.ws"; content:"|05|rrtbh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131844; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rrtzzdnqq.net"; content:"|09|rrtzzdnqq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131845; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rrwjj.cn"; content:"|05|rrwjj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131846; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rrzspoaf.cn"; content:"|08|rrzspoaf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131847; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rsazathuel.cc"; content:"|0a|rsazathuel|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131848; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rsbor.ws"; content:"|05|rsbor|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131849; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rscstrg.net"; content:"|07|rscstrg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131850; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rscwmsyi.org"; content:"|08|rscwmsyi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131851; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rsfezsgy.biz"; content:"|08|rsfezsgy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131852; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rsjgf.ws"; content:"|05|rsjgf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131853; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rskthnv.com"; content:"|07|rskthnv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131854; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rsmzxv.ws"; content:"|06|rsmzxv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131855; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rsnxwtl.cn"; content:"|07|rsnxwtl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131856; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rsrkxnd.com"; content:"|07|rsrkxnd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131857; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rsuwwqeavwk.net"; content:"|0b|rsuwwqeavwk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131858; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rsxnpbosc.biz"; content:"|09|rsxnpbosc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131859; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rsyzyumhu.biz"; content:"|09|rsyzyumhu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131860; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rtcjo.com"; content:"|05|rtcjo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131861; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rtddftlxg.org"; content:"|09|rtddftlxg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131862; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rtdqveaty.cn"; content:"|09|rtdqveaty|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131863; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rthetwm.net"; content:"|07|rthetwm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131864; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rtjisxo.com"; content:"|07|rtjisxo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131865; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rtlgvsbu.com"; content:"|08|rtlgvsbu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131866; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rtodbdvcl.com"; content:"|09|rtodbdvcl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131867; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rtpzc.com"; content:"|05|rtpzc|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131868; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rtqgn.net"; content:"|05|rtqgn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131869; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rtrqsk.biz"; content:"|06|rtrqsk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131870; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rtwaityhogv.org"; content:"|0b|rtwaityhogv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131871; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ruafhrzv.info"; content:"|08|ruafhrzv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131872; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rucfs.cc"; content:"|05|rucfs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131873; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rudmrpsin.org"; content:"|09|rudmrpsin|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131874; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rugpnqj.info"; content:"|07|rugpnqj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131875; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rugpyolul.info"; content:"|09|rugpyolul|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131876; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ruiwqgem.cc"; content:"|08|ruiwqgem|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131877; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rukczmad.cn"; content:"|08|rukczmad|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131878; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rukfugqs.info"; content:"|08|rukfugqs|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131879; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ruldhmqxjcx.info"; content:"|0b|ruldhmqxjcx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131880; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ruqokftfajk.net"; content:"|0b|ruqokftfajk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131881; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ruskhlngd.com"; content:"|09|ruskhlngd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131882; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ruuhvtto.net"; content:"|08|ruuhvtto|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131883; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ruumtptj.info"; content:"|08|ruumtptj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131884; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ruzegzybxv.info"; content:"|0a|ruzegzybxv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131885; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rvavwk.info"; content:"|06|rvavwk|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131886; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rvbdrqudg.cc"; content:"|09|rvbdrqudg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131887; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rvbfbogka.info"; content:"|09|rvbfbogka|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131888; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rvbslbhdvrf.info"; content:"|0b|rvbslbhdvrf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131889; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rvfykydvwi.cn"; content:"|0a|rvfykydvwi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131890; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rvhcoa.org"; content:"|06|rvhcoa|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131891; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rvhvbi.cn"; content:"|06|rvhvbi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131892; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rvmiyrsaqg.com"; content:"|0a|rvmiyrsaqg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131893; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rvmol.org"; content:"|05|rvmol|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131894; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rvnvann.ws"; content:"|07|rvnvann|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131895; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rvqwxtih.ws"; content:"|08|rvqwxtih|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131896; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rvtamwuej.cn"; content:"|09|rvtamwuej|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131897; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rvtzck.cn"; content:"|06|rvtzck|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131898; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rvultcjbuo.cn"; content:"|0a|rvultcjbuo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131899; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rwasjcfsnz.ws"; content:"|0a|rwasjcfsnz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131900; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rweccbkpzr.net"; content:"|0a|rweccbkpzr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131901; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rwetoiko.com"; content:"|08|rwetoiko|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131902; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rwfgarryuy.info"; content:"|0a|rwfgarryuy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131903; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rwiyqzly.net"; content:"|08|rwiyqzly|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131904; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rwkqtoqf.biz"; content:"|08|rwkqtoqf|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131905; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rwmwqdsvqr.net"; content:"|0a|rwmwqdsvqr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131906; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rwpbyvqz.org"; content:"|08|rwpbyvqz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131907; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rwqxxbu.com"; content:"|07|rwqxxbu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131908; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rwvfb.cn"; content:"|05|rwvfb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131909; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rwxmjsptq.org"; content:"|09|rwxmjsptq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131910; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rxccxskrbga.cn"; content:"|0b|rxccxskrbga|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131911; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rxchcthe.cc"; content:"|08|rxchcthe|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131912; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rxczbmld.cn"; content:"|08|rxczbmld|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131913; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rxczeejwkou.com"; content:"|0b|rxczeejwkou|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131914; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rxixiiuue.info"; content:"|09|rxixiiuue|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131915; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rxorldpg.biz"; content:"|08|rxorldpg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131916; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rxpglvszy.net"; content:"|09|rxpglvszy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131917; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rxqlcdh.org"; content:"|07|rxqlcdh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131918; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rxudub.com"; content:"|06|rxudub|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131919; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rxvyilttrl.org"; content:"|0a|rxvyilttrl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131920; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rxynyceq.org"; content:"|08|rxynyceq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131921; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rybkid.info"; content:"|06|rybkid|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131922; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ryfzqwwqj.net"; content:"|09|ryfzqwwqj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131923; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rymsnlkiyx.org"; content:"|0a|rymsnlkiyx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131924; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rynvoara.info"; content:"|08|rynvoara|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131925; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ryqxzcty.com"; content:"|08|ryqxzcty|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131926; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rytpdfq.org"; content:"|07|rytpdfq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131927; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ryuho.org"; content:"|05|ryuho|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131928; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ryvdsgvff.org"; content:"|09|ryvdsgvff|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131929; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rzbytcy.biz"; content:"|07|rzbytcy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131930; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rzgffapkxq.com"; content:"|0a|rzgffapkxq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131931; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rzgmri.org"; content:"|06|rzgmri|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131932; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rzlam.ws"; content:"|05|rzlam|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131933; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rznslgg.biz"; content:"|07|rznslgg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131934; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rzqzjvsifdf.cc"; content:"|0b|rzqzjvsifdf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131935; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rzvvq.biz"; content:"|05|rzvvq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131936; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain rzxnhyltz.ws"; content:"|09|rzxnhyltz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131937; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain safwd.org"; content:"|05|safwd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131938; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sagng.ws"; content:"|05|sagng|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131939; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sagosv.cn"; content:"|06|sagosv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131940; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sahjbzm.cn"; content:"|07|sahjbzm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131941; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain samhhlsm.cc"; content:"|08|samhhlsm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131942; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sandi.org"; content:"|05|sandi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131943; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sangcegp.cc"; content:"|08|sangcegp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131944; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sapbya.org"; content:"|06|sapbya|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131945; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sapiqa.ws"; content:"|06|sapiqa|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131946; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain saqxofwayc.cn"; content:"|0a|saqxofwayc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131947; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain saxvxv.biz"; content:"|06|saxvxv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131948; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sbakzupwmng.info"; content:"|0b|sbakzupwmng|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131949; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sbbswcha.biz"; content:"|08|sbbswcha|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131950; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sbdjgg.com"; content:"|06|sbdjgg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131951; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sbilhpphnk.com"; content:"|0a|sbilhpphnk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131952; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sbmnoiof.cc"; content:"|08|sbmnoiof|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131953; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sbrdiglh.ws"; content:"|08|sbrdiglh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131954; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sbtjn.info"; content:"|05|sbtjn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131955; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sbvgg.info"; content:"|05|sbvgg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131956; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sbzyy.com"; content:"|05|sbzyy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131957; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain scahghjcie.cn"; content:"|0a|scahghjcie|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131958; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain scbspcf.com"; content:"|07|scbspcf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131959; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain scbzfnzjb.net"; content:"|09|scbzfnzjb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131960; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain scdfpwon.net"; content:"|08|scdfpwon|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131961; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain scfsyn.info"; content:"|06|scfsyn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131962; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain scipqzxrer.net"; content:"|0a|scipqzxrer|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131963; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain scjmdvgmrk.cc"; content:"|0a|scjmdvgmrk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131964; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sclmtmct.com"; content:"|08|sclmtmct|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131965; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sclqaespjj.net"; content:"|0a|sclqaespjj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131966; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain scmzswqu.biz"; content:"|08|scmzswqu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131967; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain scnjeg.info"; content:"|06|scnjeg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131968; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain scpakoggetx.cn"; content:"|0b|scpakoggetx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131969; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain scpintu.com"; content:"|07|scpintu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131970; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain scrfe.cc"; content:"|05|scrfe|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131971; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain scskkm.biz"; content:"|06|scskkm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131972; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain scszulix.cc"; content:"|08|scszulix|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131973; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sctecuktoz.org"; content:"|0a|sctecuktoz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131974; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sczwwxhl.info"; content:"|08|sczwwxhl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131975; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sdavlnnh.org"; content:"|08|sdavlnnh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131976; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sddqcvwejja.info"; content:"|0b|sddqcvwejja|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131977; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sdkagdc.ws"; content:"|07|sdkagdc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131978; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sduragfe.ws"; content:"|08|sduragfe|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131979; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sdxysffj.cn"; content:"|08|sdxysffj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131980; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sedkmzgp.com"; content:"|08|sedkmzgp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131981; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sefcfa.info"; content:"|06|sefcfa|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131982; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain selnrar.cc"; content:"|07|selnrar|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131983; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sexgtf.biz"; content:"|06|sexgtf|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131984; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sexleluipbl.net"; content:"|0b|sexleluipbl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131985; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain seydyurxviy.net"; content:"|0b|seydyurxviy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131986; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sezsag.com"; content:"|06|sezsag|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131987; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sfaue.com"; content:"|05|sfaue|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131988; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sfewlklal.cn"; content:"|09|sfewlklal|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131989; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sffyl.org"; content:"|05|sffyl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131990; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sfkstad.biz"; content:"|07|sfkstad|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131991; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sfrasqf.cc"; content:"|07|sfrasqf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131992; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sftywhme.ws"; content:"|08|sftywhme|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131993; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sfwdoh.net"; content:"|06|sfwdoh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131994; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sfzejfxgkd.org"; content:"|0a|sfzejfxgkd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131995; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sgacxqoybh.cn"; content:"|0a|sgacxqoybh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131996; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sgaepqrv.ws"; content:"|08|sgaepqrv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131997; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sgdddluw.ws"; content:"|08|sgdddluw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131998; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sgeaa.cc"; content:"|05|sgeaa|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1131999; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sgntwzrr.info"; content:"|08|sgntwzrr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132000; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sgpdthlld.ws"; content:"|09|sgpdthlld|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132001; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sgsehctxx.net"; content:"|09|sgsehctxx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132002; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sgxykke.cn"; content:"|07|sgxykke|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132003; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sgzfudoj.org"; content:"|08|sgzfudoj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132004; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain shavy.cn"; content:"|05|shavy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132005; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain shcgasmdx.info"; content:"|09|shcgasmdx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132006; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain shdsqjxrz.ws"; content:"|09|shdsqjxrz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132007; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sheibwdyuvp.biz"; content:"|0b|sheibwdyuvp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132008; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain shgejdfjwa.ws"; content:"|0a|shgejdfjwa|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132009; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain shiofev.cc"; content:"|07|shiofev|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132010; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain shmvimbc.biz"; content:"|08|shmvimbc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132011; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain shoiserbdcg.com"; content:"|0b|shoiserbdcg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132012; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain shppkis.ws"; content:"|07|shppkis|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132013; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain shsicq.net"; content:"|06|shsicq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132014; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain shtfsfbrm.org"; content:"|09|shtfsfbrm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132015; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain shwojlx.cc"; content:"|07|shwojlx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132016; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain shylqiuiq.cc"; content:"|09|shylqiuiq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132017; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain shyvo.net"; content:"|05|shyvo|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132018; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sigyyi.biz"; content:"|06|sigyyi|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132019; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain siifd.ws"; content:"|05|siifd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132020; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sijvoeskno.net"; content:"|0a|sijvoeskno|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132021; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sikjseldv.org"; content:"|09|sikjseldv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132022; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain silhfh.com"; content:"|06|silhfh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132023; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain siluo.cn"; content:"|05|siluo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132024; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sisokevdud.biz"; content:"|0a|sisokevdud|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132025; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain siswyys.info"; content:"|07|siswyys|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132026; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain siuadyqg.org"; content:"|08|siuadyqg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132027; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sixneijywxc.cc"; content:"|0b|sixneijywxc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132028; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sjaqg.cc"; content:"|05|sjaqg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132029; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sjavozdtlq.cn"; content:"|0a|sjavozdtlq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132030; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sjhjl.org"; content:"|05|sjhjl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132031; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sjhkdarvt.cc"; content:"|09|sjhkdarvt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132032; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sjixpmmmdc.com"; content:"|0a|sjixpmmmdc|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132033; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sjnfabzo.org"; content:"|08|sjnfabzo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132034; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sjupvoufz.net"; content:"|09|sjupvoufz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132035; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sjytbweiau.net"; content:"|0a|sjytbweiau|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132036; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain skcyikvd.info"; content:"|08|skcyikvd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132037; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain skcyjnhyepe.net"; content:"|0b|skcyjnhyepe|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132038; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain skemtel.info"; content:"|07|skemtel|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132039; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain skfbge.org"; content:"|06|skfbge|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132040; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain skgmqkpg.net"; content:"|08|skgmqkpg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132041; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain skgqvrxd.biz"; content:"|08|skgqvrxd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132042; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain skilxwvitvx.net"; content:"|0b|skilxwvitvx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132043; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain skkxnzr.org"; content:"|07|skkxnzr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132044; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain skkxqs.ws"; content:"|06|skkxqs|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132045; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain skndv.org"; content:"|05|skndv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132046; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sksrgbf.com"; content:"|07|sksrgbf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132047; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain slbtqhyncj.info"; content:"|0a|slbtqhyncj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132048; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sleksch.biz"; content:"|07|sleksch|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132049; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain slhvdudnf.cc"; content:"|09|slhvdudnf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132050; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain slrhg.net"; content:"|05|slrhg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132051; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain slsqaegkmfz.ws"; content:"|0b|slsqaegkmfz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132052; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain slssfkn.net"; content:"|07|slssfkn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132053; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain slszffr.cc"; content:"|07|slszffr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132054; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain slvahkhn.com"; content:"|08|slvahkhn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132055; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain slxpfijgkz.info"; content:"|0a|slxpfijgkz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132056; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain slytoyqoqc.ws"; content:"|0a|slytoyqoqc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132057; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain smfmltmoj.com"; content:"|09|smfmltmoj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132058; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain smfvxkm.org"; content:"|07|smfvxkm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132059; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain smgvmkdp.com"; content:"|08|smgvmkdp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132060; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain smkdzas.info"; content:"|07|smkdzas|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132061; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain smlkhu.cn"; content:"|06|smlkhu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132062; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain smnqjo.cn"; content:"|06|smnqjo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132063; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain smtkszdwg.org"; content:"|09|smtkszdwg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132064; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain smvrvxlltv.net"; content:"|0a|smvrvxlltv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132065; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain snaagvfdlpv.cc"; content:"|0b|snaagvfdlpv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132066; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sncktoorc.net"; content:"|09|sncktoorc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132067; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sndfqy.info"; content:"|06|sndfqy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132068; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain snkcfzxaheq.cn"; content:"|0b|snkcfzxaheq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132069; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain snpminjjim.com"; content:"|0a|snpminjjim|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132070; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain snrehamj.cn"; content:"|08|snrehamj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132071; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain snrsdiqlwn.com"; content:"|0a|snrsdiqlwn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132072; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain snrwfw.net"; content:"|06|snrwfw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132073; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sntxwdytxpx.com"; content:"|0b|sntxwdytxpx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132074; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain snumkrdchs.org"; content:"|0a|snumkrdchs|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132075; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain snuxeyjd.ws"; content:"|08|snuxeyjd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132076; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain snxhgzscf.com"; content:"|09|snxhgzscf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132077; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain snylypvt.com"; content:"|08|snylypvt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132078; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain soaflmpywku.com"; content:"|0b|soaflmpywku|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132079; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain soepchc.net"; content:"|07|soepchc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132080; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sofguqubt.info"; content:"|09|sofguqubt|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132081; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sohqme.ws"; content:"|06|sohqme|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132082; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain solmaxpr.com"; content:"|08|solmaxpr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132083; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain somhljq.info"; content:"|07|somhljq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132084; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sotwuj.biz"; content:"|06|sotwuj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132085; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain soybeq.ws"; content:"|06|soybeq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132086; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain spdnlov.info"; content:"|07|spdnlov|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132087; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain spgjeejxb.com"; content:"|09|spgjeejxb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132088; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain spgznazzmz.ws"; content:"|0a|spgznazzmz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132089; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain spjask.info"; content:"|06|spjask|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132090; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain spjcshgyf.cc"; content:"|09|spjcshgyf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132091; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain spnayasxg.org"; content:"|09|spnayasxg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132092; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sppxdumavx.info"; content:"|0a|sppxdumavx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132093; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sprqpgmxgxu.biz"; content:"|0b|sprqpgmxgxu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132094; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sptaheyzvf.com"; content:"|0a|sptaheyzvf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132095; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sptrhoxqkt.com"; content:"|0a|sptrhoxqkt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132096; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain spxkyjpsp.cn"; content:"|09|spxkyjpsp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132097; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain spxyhruw.ws"; content:"|08|spxyhruw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132098; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain spzufxgx.com"; content:"|08|spzufxgx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132099; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sqalakc.info"; content:"|07|sqalakc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132100; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sqans.biz"; content:"|05|sqans|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132101; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sqcfrsro.ws"; content:"|08|sqcfrsro|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132102; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sqfhtowtw.cn"; content:"|09|sqfhtowtw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132103; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sqhos.net"; content:"|05|sqhos|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132104; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sqjwhcl.cn"; content:"|07|sqjwhcl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132105; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sqnumlqlo.biz"; content:"|09|sqnumlqlo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132106; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sqpftcg.cn"; content:"|07|sqpftcg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132107; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sqshug.cn"; content:"|06|sqshug|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132108; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sqzsuya.cn"; content:"|07|sqzsuya|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132109; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain srajq.ws"; content:"|05|srajq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132110; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain srbzb.cn"; content:"|05|srbzb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132111; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain srhecfvsr.cn"; content:"|09|srhecfvsr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132112; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sribppeju.ws"; content:"|09|sribppeju|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132113; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain srjwfhbfo.com"; content:"|09|srjwfhbfo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132114; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain srmbfkjcmn.com"; content:"|0a|srmbfkjcmn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132115; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain srmxxnfw.cc"; content:"|08|srmxxnfw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132116; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sroaftqrym.ws"; content:"|0a|sroaftqrym|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132117; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain srojy.com"; content:"|05|srojy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132118; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sromdqapm.org"; content:"|09|sromdqapm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132119; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sronnqvge.biz"; content:"|09|sronnqvge|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132120; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain srsiugzezhh.net"; content:"|0b|srsiugzezhh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132121; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain srtsegh.biz"; content:"|07|srtsegh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132122; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain srtxytfi.cc"; content:"|08|srtxytfi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132123; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain srtysfesysj.cn"; content:"|0b|srtysfesysj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132124; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain srvfpsfy.biz"; content:"|08|srvfpsfy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132125; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain srwepeuiqvj.net"; content:"|0b|srwepeuiqvj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132126; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain srxjzio.net"; content:"|07|srxjzio|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132127; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ssetffuvs.info"; content:"|09|ssetffuvs|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132128; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ssflk.com"; content:"|05|ssflk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132129; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ssgdi.cn"; content:"|05|ssgdi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132130; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sshnzek.cn"; content:"|07|sshnzek|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132131; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sshvtflrc.ws"; content:"|09|sshvtflrc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132132; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ssjqbgpfj.cn"; content:"|09|ssjqbgpfj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132133; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sslhlmqz.org"; content:"|08|sslhlmqz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132134; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ssltognlcg.ws"; content:"|0a|ssltognlcg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132135; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ssmfcaqxjux.info"; content:"|0b|ssmfcaqxjux|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132136; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ssnhicgcgh.cc"; content:"|0a|ssnhicgcgh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132137; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ssomoo.com"; content:"|06|ssomoo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132138; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sstpu.net"; content:"|05|sstpu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132139; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ssufijjwb.info"; content:"|09|ssufijjwb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132140; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ssujv.ws"; content:"|05|ssujv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132141; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ssvxr.org"; content:"|05|ssvxr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132142; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ssyysilqyia.info"; content:"|0b|ssyysilqyia|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132143; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain stgerfil.cc"; content:"|08|stgerfil|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132144; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain stiueoc.biz"; content:"|07|stiueoc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132145; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain stmxnlyn.info"; content:"|08|stmxnlyn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132146; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain stnqmjyz.com"; content:"|08|stnqmjyz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132147; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain stoyqvmgnn.net"; content:"|0a|stoyqvmgnn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132148; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain stpee.ws"; content:"|05|stpee|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132149; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain stvlyz.info"; content:"|06|stvlyz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132150; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain styov.org"; content:"|05|styov|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132151; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain suaxalyvgsq.org"; content:"|0b|suaxalyvgsq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132152; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain suesywytrkn.net"; content:"|0b|suesywytrkn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132153; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sufkibs.biz"; content:"|07|sufkibs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132154; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sujofaaews.cc"; content:"|0a|sujofaaews|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132155; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain suoporuovok.biz"; content:"|0b|suoporuovok|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132156; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain suqiseu.biz"; content:"|07|suqiseu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132157; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain surldonyx.cn"; content:"|09|surldonyx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132158; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain susaodlavq.cc"; content:"|0a|susaodlavq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132159; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain suytoaiowz.org"; content:"|0a|suytoaiowz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132160; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain suznbpapa.cc"; content:"|09|suznbpapa|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132161; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain svgohz.net"; content:"|06|svgohz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132162; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain svlfxvm.info"; content:"|07|svlfxvm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132163; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain svtcljcb.cc"; content:"|08|svtcljcb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132164; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain svvefxal.info"; content:"|08|svvefxal|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132165; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain svvibknhg.info"; content:"|09|svvibknhg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132166; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain svvmatkit.com"; content:"|09|svvmatkit|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132167; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain svwhhuya.org"; content:"|08|svwhhuya|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132168; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain swbemops.info"; content:"|08|swbemops|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132169; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain swbshwcwn.biz"; content:"|09|swbshwcwn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132170; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain swdfxny.biz"; content:"|07|swdfxny|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132171; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain swdyhkqbohy.info"; content:"|0b|swdyhkqbohy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132172; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain swfcssglq.info"; content:"|09|swfcssglq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132173; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain swmmvd.info"; content:"|06|swmmvd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132174; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain swpor.info"; content:"|05|swpor|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132175; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain swunekex.cc"; content:"|08|swunekex|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132176; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain swveigmu.cc"; content:"|08|swveigmu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132177; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sxgmnprmz.com"; content:"|09|sxgmnprmz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132178; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sxiyjena.ws"; content:"|08|sxiyjena|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132179; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sxsmcgr.org"; content:"|07|sxsmcgr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132180; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sxtpninvky.cc"; content:"|0a|sxtpninvky|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132181; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sxvqdldn.cc"; content:"|08|sxvqdldn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132182; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sxyoll.info"; content:"|06|sxyoll|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132183; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sxzlrx.ws"; content:"|06|sxzlrx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132184; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain syiishkm.ws"; content:"|08|syiishkm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132185; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain syijgk.ws"; content:"|06|syijgk|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132186; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain syiqhl.net"; content:"|06|syiqhl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132187; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sykqsbjrva.org"; content:"|0a|sykqsbjrva|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132188; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sykvfydjzhw.org"; content:"|0b|sykvfydjzhw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132189; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sylwsr.com"; content:"|06|sylwsr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132190; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain symgojsh.net"; content:"|08|symgojsh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132191; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain synbzqr.info"; content:"|07|synbzqr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132192; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain syncmgv.cc"; content:"|07|syncmgv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132193; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain syunjiyy.info"; content:"|08|syunjiyy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132194; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sywenkkgnlo.ws"; content:"|0b|sywenkkgnlo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132195; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain syzjnqadt.cn"; content:"|09|syzjnqadt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132196; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain szbptthxxz.net"; content:"|0a|szbptthxxz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132197; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain szbxskmfy.org"; content:"|09|szbxskmfy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132198; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain szckwxv.org"; content:"|07|szckwxv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132199; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain szdhzuiy.cc"; content:"|08|szdhzuiy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132200; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain szhuhils.ws"; content:"|08|szhuhils|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132201; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain sziwsac.com"; content:"|07|sziwsac|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132202; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain szkaboqsz.cc"; content:"|09|szkaboqsz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132203; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain szkxcfuo.net"; content:"|08|szkxcfuo|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132204; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain szlcbxnb.ws"; content:"|08|szlcbxnb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132205; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain szlubrt.com"; content:"|07|szlubrt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132206; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain szpeb.net"; content:"|05|szpeb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132207; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain szrkexnx.info"; content:"|08|szrkexnx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132208; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain szsbgama.cn"; content:"|08|szsbgama|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132209; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain taaeo.biz"; content:"|05|taaeo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132210; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tagcoi.cc"; content:"|06|tagcoi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132211; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tagxdwy.com"; content:"|07|tagxdwy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132212; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain talnbhlp.com"; content:"|08|talnbhlp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132213; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tarfewesi.ws"; content:"|09|tarfewesi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132214; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tataqltca.ws"; content:"|09|tataqltca|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132215; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tavac.com"; content:"|05|tavac|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132216; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tawnzjz.com"; content:"|07|tawnzjz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132217; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tazrfn.biz"; content:"|06|tazrfn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132218; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tbgcgpm.biz"; content:"|07|tbgcgpm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132219; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tbpttujamcz.cc"; content:"|0b|tbpttujamcz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132220; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tbuoif.ws"; content:"|06|tbuoif|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132221; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tbvovmyd.cc"; content:"|08|tbvovmyd|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132222; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tcarx.cc"; content:"|05|tcarx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132223; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tcbtnaebej.ws"; content:"|0a|tcbtnaebej|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132224; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tcegtg.cc"; content:"|06|tcegtg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132225; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tcevzrnoct.com"; content:"|0a|tcevzrnoct|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132226; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tcgarwt.cc"; content:"|07|tcgarwt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132227; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tcgkchw.net"; content:"|07|tcgkchw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132228; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tcjxugz.biz"; content:"|07|tcjxugz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132229; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tclfvhw.cn"; content:"|07|tclfvhw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132230; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tcmtxyktjzn.net"; content:"|0b|tcmtxyktjzn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132231; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tcngaetsid.biz"; content:"|0a|tcngaetsid|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132232; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tcnhupykd.com"; content:"|09|tcnhupykd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132233; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tdbhddt.cc"; content:"|07|tdbhddt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132234; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tdbthwxq.cc"; content:"|08|tdbthwxq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132235; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tdbtypmn.cc"; content:"|08|tdbtypmn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132236; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tdgsgjwvt.org"; content:"|09|tdgsgjwvt|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132237; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tdkxbpmfi.net"; content:"|09|tdkxbpmfi|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132238; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tduiv.org"; content:"|05|tduiv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132239; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tdvgojfy.cn"; content:"|08|tdvgojfy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132240; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tdxdunvz.net"; content:"|08|tdxdunvz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132241; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tdymddlff.info"; content:"|09|tdymddlff|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132242; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tdzdgj.cc"; content:"|06|tdzdgj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132243; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tdzodwfldqh.net"; content:"|0b|tdzodwfldqh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132244; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tebvspufw.info"; content:"|09|tebvspufw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132245; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tedjpv.ws"; content:"|06|tedjpv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132246; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tedmy.info"; content:"|05|tedmy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132247; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tefyuyjz.info"; content:"|08|tefyuyjz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132248; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tepnrnkun.com"; content:"|09|tepnrnkun|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132249; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain terelimq.org"; content:"|08|terelimq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132250; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ternejxaejt.info"; content:"|0b|ternejxaejt|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132251; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tetbkm.net"; content:"|06|tetbkm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132252; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tetdazdemi.net"; content:"|0a|tetdazdemi|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132253; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tewipgyjp.info"; content:"|09|tewipgyjp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132254; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tfcvbmab.info"; content:"|08|tfcvbmab|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132255; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tfeyn.com"; content:"|05|tfeyn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132256; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tfhzlr.net"; content:"|06|tfhzlr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132257; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tfifi.net"; content:"|05|tfifi|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132258; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tfixdiwu.info"; content:"|08|tfixdiwu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132259; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tfnfxwe.com"; content:"|07|tfnfxwe|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132260; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tftuqinyyrc.ws"; content:"|0b|tftuqinyyrc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132261; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tfyobg.biz"; content:"|06|tfyobg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132262; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tfzpfwcmldg.biz"; content:"|0b|tfzpfwcmldg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132263; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tfzulmlx.net"; content:"|08|tfzulmlx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132264; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tgboedaobyl.net"; content:"|0b|tgboedaobyl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132265; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tgcgikjn.net"; content:"|08|tgcgikjn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132266; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tgdzedjwvjj.org"; content:"|0b|tgdzedjwvjj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132267; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tgebxytw.biz"; content:"|08|tgebxytw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132268; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tggfaxy.biz"; content:"|07|tggfaxy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132269; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tgjioxdbiav.org"; content:"|0b|tgjioxdbiav|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132270; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tgqkxnuw.biz"; content:"|08|tgqkxnuw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132271; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tguhxgmcs.net"; content:"|09|tguhxgmcs|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132272; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tgvbjlcfej.com"; content:"|0a|tgvbjlcfej|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132273; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tgzhmsde.cc"; content:"|08|tgzhmsde|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132274; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain thcuopn.cc"; content:"|07|thcuopn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132275; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain thdcwdksjm.cn"; content:"|0a|thdcwdksjm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132276; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain thdeppe.org"; content:"|07|thdeppe|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132277; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain thesgcu.com"; content:"|07|thesgcu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132278; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain thmlxku.com"; content:"|07|thmlxku|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132279; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain thnry.info"; content:"|05|thnry|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132280; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain thslqpqy.info"; content:"|08|thslqpqy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132281; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain thtad.net"; content:"|05|thtad|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132282; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain thxdquzq.cn"; content:"|08|thxdquzq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132283; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain thyqwwprmtt.ws"; content:"|0b|thyqwwprmtt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132284; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain thyxxmsk.biz"; content:"|08|thyxxmsk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132285; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tiernyo.com"; content:"|07|tiernyo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132286; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tifqdfwxmfv.ws"; content:"|0b|tifqdfwxmfv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132287; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tigysjnq.cc"; content:"|08|tigysjnq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132288; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tihdxuyc.info"; content:"|08|tihdxuyc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132289; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tiluusvmqjj.org"; content:"|0b|tiluusvmqjj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132290; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain timmmhkx.biz"; content:"|08|timmmhkx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132291; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tinyi.info"; content:"|05|tinyi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132292; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tipfu.info"; content:"|05|tipfu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132293; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tisqmlsg.cc"; content:"|08|tisqmlsg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132294; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tivftzsxby.cc"; content:"|0a|tivftzsxby|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132295; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tivjpcirp.com"; content:"|09|tivjpcirp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132296; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tiztqf.com"; content:"|06|tiztqf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132297; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tjaat.cc"; content:"|05|tjaat|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132298; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tjdgdlqf.biz"; content:"|08|tjdgdlqf|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132299; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tjdyvinkh.org"; content:"|09|tjdyvinkh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132300; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tjjcikcy.cc"; content:"|08|tjjcikcy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132301; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tjjiztwcou.cn"; content:"|0a|tjjiztwcou|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132302; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tjsopgmeek.ws"; content:"|0a|tjsopgmeek|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132303; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tjspg.cc"; content:"|05|tjspg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132304; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tjtsxja.biz"; content:"|07|tjtsxja|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132305; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tjvefqxqlr.info"; content:"|0a|tjvefqxqlr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132306; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tjwdqoeamkf.cc"; content:"|0b|tjwdqoeamkf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132307; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tjwzznowwui.info"; content:"|0b|tjwzznowwui|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132308; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tkafooxvch.cn"; content:"|0a|tkafooxvch|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132309; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tkbtykjz.org"; content:"|08|tkbtykjz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132310; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tkeyobhshvu.biz"; content:"|0b|tkeyobhshvu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132311; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tkhdrx.cn"; content:"|06|tkhdrx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132312; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tkingcups.cc"; content:"|09|tkingcups|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132313; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tklekgu.cn"; content:"|07|tklekgu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132314; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tkphdaca.cc"; content:"|08|tkphdaca|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132315; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tkubynh.cc"; content:"|07|tkubynh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132316; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tkxkhyv.cc"; content:"|07|tkxkhyv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132317; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tlaxvwr.cc"; content:"|07|tlaxvwr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132318; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tlbbalyz.net"; content:"|08|tlbbalyz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132319; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tlgors.biz"; content:"|06|tlgors|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132320; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tlndeejpds.net"; content:"|0a|tlndeejpds|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132321; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tlpigmj.biz"; content:"|07|tlpigmj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132322; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tltdo.org"; content:"|05|tltdo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132323; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tlwosy.info"; content:"|06|tlwosy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132324; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tmdoki.cc"; content:"|06|tmdoki|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132325; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tmhgtv.com"; content:"|06|tmhgtv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132326; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tmhnlhbrzh.ws"; content:"|0a|tmhnlhbrzh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132327; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tmkexwuqjf.info"; content:"|0a|tmkexwuqjf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132328; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tmscfuqp.ws"; content:"|08|tmscfuqp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132329; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tmtrpg.cn"; content:"|06|tmtrpg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132330; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tmvnj.cc"; content:"|05|tmvnj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132331; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tmwcxpmcfz.org"; content:"|0a|tmwcxpmcfz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132332; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tnaaqjqu.cc"; content:"|08|tnaaqjqu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132333; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tnagofimk.cn"; content:"|09|tnagofimk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132334; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tnhqtzyqtp.com"; content:"|0a|tnhqtzyqtp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132335; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tnkjprzx.com"; content:"|08|tnkjprzx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132336; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tnkxqqtb.org"; content:"|08|tnkxqqtb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132337; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tnlmtx.net"; content:"|06|tnlmtx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132338; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tnptkkdfxh.com"; content:"|0a|tnptkkdfxh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132339; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tnrujiwcv.cn"; content:"|09|tnrujiwcv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132340; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tnuxckwi.info"; content:"|08|tnuxckwi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132341; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tnyoe.biz"; content:"|05|tnyoe|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132342; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tnzfyibhbtw.cc"; content:"|0b|tnzfyibhbtw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132343; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tnzkz.org"; content:"|05|tnzkz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132344; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain toelhed.com"; content:"|07|toelhed|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132345; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain togmnpwjhle.cn"; content:"|0b|togmnpwjhle|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132346; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tommhm.info"; content:"|06|tommhm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132347; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tonfoqsz.ws"; content:"|08|tonfoqsz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132348; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tonpusaf.net"; content:"|08|tonpusaf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132349; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain toqkacan.biz"; content:"|08|toqkacan|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132350; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tpgdkpjv.com"; content:"|08|tpgdkpjv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132351; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tphvx.cc"; content:"|05|tphvx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132352; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tpkbumd.cn"; content:"|07|tpkbumd|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132353; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tpksdgdw.info"; content:"|08|tpksdgdw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132354; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tpotbxzpo.info"; content:"|09|tpotbxzpo|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132355; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tprcc.com"; content:"|05|tprcc|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132356; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tptllc.biz"; content:"|06|tptllc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132357; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tqierhr.biz"; content:"|07|tqierhr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132358; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tqjhjpk.net"; content:"|07|tqjhjpk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132359; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tqnaeermt.info"; content:"|09|tqnaeermt|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132360; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tqpmv.cn"; content:"|05|tqpmv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132361; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tqrbgf.net"; content:"|06|tqrbgf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132362; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tqrvcxo.net"; content:"|07|tqrvcxo|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132363; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tqtnrxkweyx.info"; content:"|0b|tqtnrxkweyx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132364; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tqvwpiwc.biz"; content:"|08|tqvwpiwc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132365; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tqxzpdw.cn"; content:"|07|tqxzpdw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132366; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tqzjmvlyeeb.cc"; content:"|0b|tqzjmvlyeeb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132367; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tradgt.com"; content:"|06|tradgt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132368; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tramqz.cn"; content:"|06|tramqz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132369; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tremlxfrl.org"; content:"|09|tremlxfrl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132370; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain trkctkzzbyn.org"; content:"|0b|trkctkzzbyn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132371; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain trlexdgc.ws"; content:"|08|trlexdgc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132372; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain trmewcvoq.org"; content:"|09|trmewcvoq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132373; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain troiiabfc.cc"; content:"|09|troiiabfc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132374; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain trootsvamx.cn"; content:"|0a|trootsvamx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132375; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain trwvnulzy.info"; content:"|09|trwvnulzy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132376; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tryfhkfn.info"; content:"|08|tryfhkfn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132377; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tsdxhq.biz"; content:"|06|tsdxhq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132378; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tsgtbvs.ws"; content:"|07|tsgtbvs|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132379; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tshds.cc"; content:"|05|tshds|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132380; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tsjzgxuzez.org"; content:"|0a|tsjzgxuzez|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132381; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tslzsbjfqy.biz"; content:"|0a|tslzsbjfqy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132382; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tsqpmkeeck.cc"; content:"|0a|tsqpmkeeck|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132383; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tsycqmvg.info"; content:"|08|tsycqmvg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132384; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ttayfnqfm.cn"; content:"|09|ttayfnqfm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132385; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ttjii.cn"; content:"|05|ttjii|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132386; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ttkaq.org"; content:"|05|ttkaq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132387; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ttthajxow.org"; content:"|09|ttthajxow|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132388; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ttzdmasoznn.cc"; content:"|0b|ttzdmasoznn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132389; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ttzzvrfo.cc"; content:"|08|ttzzvrfo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132390; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tudeabpw.ws"; content:"|08|tudeabpw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132391; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tudeimpru.cc"; content:"|09|tudeimpru|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132392; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tuffguigcu.org"; content:"|0a|tuffguigcu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132393; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tuhtxdoajob.info"; content:"|0b|tuhtxdoajob|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132394; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tuhysx.ws"; content:"|06|tuhysx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132395; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tumewmzmu.com"; content:"|09|tumewmzmu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132396; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tunpxrzrdyc.net"; content:"|0b|tunpxrzrdyc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132397; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tuqmkyjjtr.biz"; content:"|0a|tuqmkyjjtr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132398; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tuwgbh.cc"; content:"|06|tuwgbh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132399; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tuwyjn.org"; content:"|06|tuwyjn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132400; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tvdla.ws"; content:"|05|tvdla|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132401; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tvilqlxvso.org"; content:"|0a|tvilqlxvso|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132402; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tvlkfranbj.info"; content:"|0a|tvlkfranbj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132403; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tvmfjtdpaqd.cn"; content:"|0b|tvmfjtdpaqd|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132404; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tvqan.com"; content:"|05|tvqan|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132405; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tvrdaqhl.biz"; content:"|08|tvrdaqhl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132406; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tvtsv.ws"; content:"|05|tvtsv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132407; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tvvheukpa.cn"; content:"|09|tvvheukpa|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132408; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tvwnxuykkhf.com"; content:"|0b|tvwnxuykkhf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132409; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tvxwoajfwad.info"; content:"|0b|tvxwoajfwad|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132410; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tvysbw.cc"; content:"|06|tvysbw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132411; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tvzbrtjyzuz.cn"; content:"|0b|tvzbrtjyzuz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132412; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain twdpjzbj.info"; content:"|08|twdpjzbj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132413; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain twezyyjnxf.cc"; content:"|0a|twezyyjnxf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132414; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain twgwehjx.info"; content:"|08|twgwehjx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132415; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain twiyhxlv.com"; content:"|08|twiyhxlv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132416; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain twkmzh.com"; content:"|06|twkmzh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132417; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain twmabfjya.info"; content:"|09|twmabfjya|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132418; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain twqmhi.org"; content:"|06|twqmhi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132419; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain twqwuzz.com"; content:"|07|twqwuzz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132420; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain twruappdufi.org"; content:"|0b|twruappdufi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132421; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain twtvwecs.biz"; content:"|08|twtvwecs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132422; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain txbhanwri.info"; content:"|09|txbhanwri|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132423; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain txdqaaltce.biz"; content:"|0a|txdqaaltce|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132424; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain txfbo.org"; content:"|05|txfbo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132425; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain txjgvcfekb.info"; content:"|0a|txjgvcfekb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132426; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain txkffqzb.cc"; content:"|08|txkffqzb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132427; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain txkzcsjfd.net"; content:"|09|txkzcsjfd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132428; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain txnolh.net"; content:"|06|txnolh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132429; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain txpkkokog.info"; content:"|09|txpkkokog|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132430; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain txqynk.org"; content:"|06|txqynk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132431; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain txvjauhdpi.com"; content:"|0a|txvjauhdpi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132432; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain txylpyufnwf.biz"; content:"|0b|txylpyufnwf|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132433; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain txzzhw.cc"; content:"|06|txzzhw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132434; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tyaeyf.net"; content:"|06|tyaeyf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132435; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tydokfamq.info"; content:"|09|tydokfamq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132436; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tyhmkzncif.biz"; content:"|0a|tyhmkzncif|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132437; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tyhxxp.org"; content:"|06|tyhxxp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132438; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tylkrbxwkfs.ws"; content:"|0b|tylkrbxwkfs|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132439; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tymmlhtxv.org"; content:"|09|tymmlhtxv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132440; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tynydhcexa.net"; content:"|0a|tynydhcexa|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132441; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tyoitrfd.cc"; content:"|08|tyoitrfd|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132442; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain typtgoruqt.net"; content:"|0a|typtgoruqt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132443; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tyujkges.biz"; content:"|08|tyujkges|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132444; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tywsqrku.ws"; content:"|08|tywsqrku|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132445; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tyxbe.org"; content:"|05|tyxbe|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132446; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tyzatriduf.cn"; content:"|0a|tyzatriduf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132447; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tyzxflu.com"; content:"|07|tyzxflu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132448; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tzooed.ws"; content:"|06|tzooed|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132449; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tzpkgjpxuoi.cn"; content:"|0b|tzpkgjpxuoi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132450; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tzprbjc.net"; content:"|07|tzprbjc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132451; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tzqfiz.cn"; content:"|06|tzqfiz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132452; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tzrfrg.org"; content:"|06|tzrfrg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132453; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tzwarqjb.net"; content:"|08|tzwarqjb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132454; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain tzypvofmcb.org"; content:"|0a|tzypvofmcb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132455; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uabunivo.cn"; content:"|08|uabunivo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132456; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uafls.org"; content:"|05|uafls|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132457; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uafqnxnne.biz"; content:"|09|uafqnxnne|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132458; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uajnpswdqt.info"; content:"|0a|uajnpswdqt|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132459; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uamvk.ws"; content:"|05|uamvk|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132460; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uaneenztbom.info"; content:"|0b|uaneenztbom|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132461; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uaqvzuts.org"; content:"|08|uaqvzuts|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132462; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uavdrxponer.net"; content:"|0b|uavdrxponer|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132463; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uavwqqpcg.ws"; content:"|09|uavwqqpcg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132464; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uawcbjxis.cc"; content:"|09|uawcbjxis|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132465; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ubeeiukdvt.info"; content:"|0a|ubeeiukdvt|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132466; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ubgmrw.info"; content:"|06|ubgmrw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132467; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ubgqhviieje.cc"; content:"|0b|ubgqhviieje|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132468; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ubhgfypid.cn"; content:"|09|ubhgfypid|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132469; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ubiywmgsgr.biz"; content:"|0a|ubiywmgsgr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132470; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ubjodoye.cn"; content:"|08|ubjodoye|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132471; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ubknrmhsoi.ws"; content:"|0a|ubknrmhsoi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132472; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ubsovnqdv.biz"; content:"|09|ubsovnqdv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132473; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ubtelxgq.ws"; content:"|08|ubtelxgq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132474; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ubvlpfg.com"; content:"|07|ubvlpfg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132475; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ubzlifughs.cn"; content:"|0a|ubzlifughs|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132476; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uckilshenha.biz"; content:"|0b|uckilshenha|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132477; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ucmuaxul.biz"; content:"|08|ucmuaxul|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132478; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ucnnloin.cn"; content:"|08|ucnnloin|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132479; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ucqrsken.net"; content:"|08|ucqrsken|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132480; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uctrusufjz.net"; content:"|0a|uctrusufjz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132481; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uctsowwgmi.biz"; content:"|0a|uctsowwgmi|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132482; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uczjckcyrkw.cc"; content:"|0b|uczjckcyrkw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132483; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain udborfgbg.cn"; content:"|09|udborfgbg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132484; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain udbvqhv.cc"; content:"|07|udbvqhv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132485; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uddcubbkqum.ws"; content:"|0b|uddcubbkqum|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132486; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uddgabutnpi.cc"; content:"|0b|uddgabutnpi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132487; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain udhptrbaazm.cn"; content:"|0b|udhptrbaazm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132488; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain udjxu.net"; content:"|05|udjxu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132489; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain udokf.info"; content:"|05|udokf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132490; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain udqdymazjoa.org"; content:"|0b|udqdymazjoa|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132491; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain udrgx.biz"; content:"|05|udrgx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132492; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain udvddawlm.biz"; content:"|09|udvddawlm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132493; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain udxiloqop.ws"; content:"|09|udxiloqop|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132494; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain udyhlg.org"; content:"|06|udyhlg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132495; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain udzuo.ws"; content:"|05|udzuo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132496; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ueelnmvdnk.cn"; content:"|0a|ueelnmvdnk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132497; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ueggzco.org"; content:"|07|ueggzco|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132498; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uegouowokq.biz"; content:"|0a|uegouowokq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132499; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ueltnbl.ws"; content:"|07|ueltnbl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132500; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ueohrxmapc.org"; content:"|0a|ueohrxmapc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132501; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uetplwwcdmy.net"; content:"|0b|uetplwwcdmy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132502; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uetromhtnxk.cc"; content:"|0b|uetromhtnxk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132503; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uevprsie.cc"; content:"|08|uevprsie|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132504; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uexeygfy.biz"; content:"|08|uexeygfy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132505; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ueynorg.org"; content:"|07|ueynorg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132506; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ufazrsmrmc.biz"; content:"|0a|ufazrsmrmc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132507; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ufboli.biz"; content:"|06|ufboli|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132508; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uffput.info"; content:"|06|uffput|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132509; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ufgnahag.com"; content:"|08|ufgnahag|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132510; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ufhmuk.com"; content:"|06|ufhmuk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132511; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ufhraloau.cc"; content:"|09|ufhraloau|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132512; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ufktrvyfq.ws"; content:"|09|ufktrvyfq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132513; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ufnmpxs.com"; content:"|07|ufnmpxs|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132514; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ufpxknzxnb.net"; content:"|0a|ufpxknzxnb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132515; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ugaazvewq.com"; content:"|09|ugaazvewq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132516; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ugeflvltyv.cc"; content:"|0a|ugeflvltyv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132517; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ugeqpaiap.ws"; content:"|09|ugeqpaiap|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132518; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ughzu.org"; content:"|05|ughzu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132519; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ugjnzl.cc"; content:"|06|ugjnzl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132520; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ugjqk.cc"; content:"|05|ugjqk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132521; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ugkoregg.cn"; content:"|08|ugkoregg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132522; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uglsg.com"; content:"|05|uglsg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132523; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ugnkuzoqgki.biz"; content:"|0b|ugnkuzoqgki|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132524; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ugtahatfgsa.org"; content:"|0b|ugtahatfgsa|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132525; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ugtwzfwpxva.com"; content:"|0b|ugtwzfwpxva|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132526; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ugyhpbprwr.cn"; content:"|0a|ugyhpbprwr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132527; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uhepry.net"; content:"|06|uhepry|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132528; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uhfeiwpsct.ws"; content:"|0a|uhfeiwpsct|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132529; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uhpbnqlc.cn"; content:"|08|uhpbnqlc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132530; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uhrsndwe.ws"; content:"|08|uhrsndwe|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132531; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uhveylzx.biz"; content:"|08|uhveylzx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132532; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uhysixxy.biz"; content:"|08|uhysixxy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132533; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uhzgcgkujvs.com"; content:"|0b|uhzgcgkujvs|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132534; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uibdqsw.ws"; content:"|07|uibdqsw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132535; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uiilro.org"; content:"|06|uiilro|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132536; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uijgu.biz"; content:"|05|uijgu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132537; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uilzic.ws"; content:"|06|uilzic|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132538; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uipbktpoky.com"; content:"|0a|uipbktpoky|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132539; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uiswfyjxcc.info"; content:"|0a|uiswfyjxcc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132540; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uitecyjld.cn"; content:"|09|uitecyjld|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132541; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uitrihnoh.cn"; content:"|09|uitrihnoh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132542; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uivjqfnulmh.cc"; content:"|0b|uivjqfnulmh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132543; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ujbrkhpx.cc"; content:"|08|ujbrkhpx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132544; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ujdomf.cn"; content:"|06|ujdomf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132545; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ujgrynec.biz"; content:"|08|ujgrynec|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132546; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ujnftbydr.ws"; content:"|09|ujnftbydr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132547; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ujpthkga.info"; content:"|08|ujpthkga|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132548; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ujrnewgru.cn"; content:"|09|ujrnewgru|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132549; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ujzpza.com"; content:"|06|ujzpza|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132550; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ukfuduz.ws"; content:"|07|ukfuduz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132551; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ukmpxytz.info"; content:"|08|ukmpxytz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132552; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ukqiawhtqd.biz"; content:"|0a|ukqiawhtqd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132553; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ukqwemk.info"; content:"|07|ukqwemk|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132554; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ukuqsmn.biz"; content:"|07|ukuqsmn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132555; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ukwvwfaiu.info"; content:"|09|ukwvwfaiu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132556; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ukxgal.com"; content:"|06|ukxgal|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132557; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ukxmvi.ws"; content:"|06|ukxmvi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132558; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uldhoic.cn"; content:"|07|uldhoic|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132559; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uldkodnkep.biz"; content:"|0a|uldkodnkep|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132560; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uldnbkdkumm.biz"; content:"|0b|uldnbkdkumm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132561; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uleytss.cc"; content:"|07|uleytss|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132562; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ulffjtkvrji.biz"; content:"|0b|ulffjtkvrji|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132563; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ulfnee.ws"; content:"|06|ulfnee|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132564; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ulgfprulq.biz"; content:"|09|ulgfprulq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132565; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uliaq.org"; content:"|05|uliaq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132566; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uligasxj.info"; content:"|08|uligasxj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132567; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uliwlzca.biz"; content:"|08|uliwlzca|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132568; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ulktqmy.biz"; content:"|07|ulktqmy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132569; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ulmejlhz.biz"; content:"|08|ulmejlhz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132570; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ulqlqwzgn.ws"; content:"|09|ulqlqwzgn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132571; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ululjjjs.cn"; content:"|08|ululjjjs|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132572; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ulvlpxdw.net"; content:"|08|ulvlpxdw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132573; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ulvpjjkvcu.cn"; content:"|0a|ulvpjjkvcu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132574; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ulyfi.info"; content:"|05|ulyfi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132575; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain umdnoct.net"; content:"|07|umdnoct|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132576; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain umgrzaybbf.ws"; content:"|0a|umgrzaybbf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132577; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain umjdpnpbbhh.ws"; content:"|0b|umjdpnpbbhh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132578; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain umjrct.net"; content:"|06|umjrct|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132579; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain umkiozwh.cc"; content:"|08|umkiozwh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132580; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain umluy.net"; content:"|05|umluy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132581; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain umngw.com"; content:"|05|umngw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132582; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain umqfuqwmktu.cc"; content:"|0b|umqfuqwmktu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132583; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain umqtarbxcmw.cn"; content:"|0b|umqtarbxcmw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132584; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain umvcnk.biz"; content:"|06|umvcnk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132585; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain umvvkf.cc"; content:"|06|umvvkf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132586; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain unbhkg.net"; content:"|06|unbhkg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132587; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uncibjec.biz"; content:"|08|uncibjec|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132588; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain unfvvsov.biz"; content:"|08|unfvvsov|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132589; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain unjjlzgun.org"; content:"|09|unjjlzgun|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132590; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain unqho.com"; content:"|05|unqho|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132591; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain unrnhkoxq.ws"; content:"|09|unrnhkoxq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132592; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain unvndijxzq.biz"; content:"|0a|unvndijxzq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132593; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uobezqzg.info"; content:"|08|uobezqzg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132594; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uogbe.ws"; content:"|05|uogbe|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132595; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uogmr.net"; content:"|05|uogmr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132596; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uojjvetarlp.biz"; content:"|0b|uojjvetarlp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132597; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uokxbwcbrmf.com"; content:"|0b|uokxbwcbrmf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132598; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uonhoi.com"; content:"|06|uonhoi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132599; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uoqbvls.com"; content:"|07|uoqbvls|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132600; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uoqvv.ws"; content:"|05|uoqvv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132601; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uorfhkepws.info"; content:"|0a|uorfhkepws|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132602; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uorujqm.ws"; content:"|07|uorujqm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132603; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uotzjjnk.net"; content:"|08|uotzjjnk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132604; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uovfy.com"; content:"|05|uovfy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132605; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uovpetznu.biz"; content:"|09|uovpetznu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132606; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uovwjgizn.com"; content:"|09|uovwjgizn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132607; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uowottva.com"; content:"|08|uowottva|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132608; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain upcmlutiiq.com"; content:"|0a|upcmlutiiq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132609; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain upcthasiy.info"; content:"|09|upcthasiy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132610; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain upghkiye.info"; content:"|08|upghkiye|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132611; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain upjcspkige.com"; content:"|0a|upjcspkige|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132612; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uplniy.biz"; content:"|06|uplniy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132613; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain upmulhd.net"; content:"|07|upmulhd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132614; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uppnhowvl.com"; content:"|09|uppnhowvl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132615; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain upqeljp.ws"; content:"|07|upqeljp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132616; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain upsjmozhl.cn"; content:"|09|upsjmozhl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132617; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain upupibjpwqv.biz"; content:"|0b|upupibjpwqv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132618; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain upwiyquy.info"; content:"|08|upwiyquy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132619; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain upzsy.net"; content:"|05|upzsy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132620; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uqafvtq.cc"; content:"|07|uqafvtq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132621; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uqcazwzegzn.biz"; content:"|0b|uqcazwzegzn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132622; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uqfgkxdvw.ws"; content:"|09|uqfgkxdvw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132623; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uqfzolyp.cn"; content:"|08|uqfzolyp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132624; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uqgpswra.cc"; content:"|08|uqgpswra|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132625; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uqhvz.org"; content:"|05|uqhvz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132626; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uqihcac.ws"; content:"|07|uqihcac|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132627; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uqmsduvtgww.biz"; content:"|0b|uqmsduvtgww|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132628; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uqnlhr.ws"; content:"|06|uqnlhr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132629; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uqpocmyi.com"; content:"|08|uqpocmyi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132630; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uqrlsyms.ws"; content:"|08|uqrlsyms|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132631; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uquzon.cc"; content:"|06|uquzon|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132632; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uqxdowupi.net"; content:"|09|uqxdowupi|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132633; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uqxvxaj.ws"; content:"|07|uqxvxaj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132634; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain urcve.net"; content:"|05|urcve|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132635; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain urdxcorsqk.cn"; content:"|0a|urdxcorsqk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132636; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain urfztv.cc"; content:"|06|urfztv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132637; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain urhqbtajdht.org"; content:"|0b|urhqbtajdht|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132638; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain urhyk.cc"; content:"|05|urhyk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132639; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain urixfusg.ws"; content:"|08|urixfusg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132640; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain urksolrnpen.info"; content:"|0b|urksolrnpen|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132641; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain urlwsnisgv.com"; content:"|0a|urlwsnisgv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132642; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uroanhravmx.ws"; content:"|0b|uroanhravmx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132643; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain urogwzkqroi.org"; content:"|0b|urogwzkqroi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132644; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain urrglga.cn"; content:"|07|urrglga|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132645; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain urtdwcew.com"; content:"|08|urtdwcew|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132646; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain urtme.cc"; content:"|05|urtme|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132647; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain urzrnxavs.net"; content:"|09|urzrnxavs|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132648; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain usczgt.cn"; content:"|06|usczgt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132649; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain usdjf.ws"; content:"|05|usdjf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132650; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain usgfgyrh.biz"; content:"|08|usgfgyrh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132651; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain usghnwl.org"; content:"|07|usghnwl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132652; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain usmkwbv.org"; content:"|07|usmkwbv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132653; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain usoqghuemmw.cn"; content:"|0b|usoqghuemmw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132654; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain usrqx.cn"; content:"|05|usrqx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132655; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain usszqbnqg.biz"; content:"|09|usszqbnqg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132656; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain usxadarmv.com"; content:"|09|usxadarmv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132657; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain utahikra.com"; content:"|08|utahikra|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132658; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain utalpx.ws"; content:"|06|utalpx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132659; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain utbimmusuxn.cn"; content:"|0b|utbimmusuxn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132660; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain utbiotqvxno.ws"; content:"|0b|utbiotqvxno|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132661; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain utdfk.cn"; content:"|05|utdfk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132662; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain utdqhiex.info"; content:"|08|utdqhiex|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132663; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain utlannep.net"; content:"|08|utlannep|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132664; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain utlojstinfb.info"; content:"|0b|utlojstinfb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132665; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain utmmrnd.com"; content:"|07|utmmrnd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132666; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain utpqpy.org"; content:"|06|utpqpy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132667; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uttlowt.biz"; content:"|07|uttlowt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132668; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uuazku.net"; content:"|06|uuazku|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132669; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uubjjpmxz.info"; content:"|09|uubjjpmxz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132670; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uuglkv.org"; content:"|06|uuglkv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132671; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uugnbcdx.com"; content:"|08|uugnbcdx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132672; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uuourp.com"; content:"|06|uuourp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132673; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uuowweqohk.cn"; content:"|0a|uuowweqohk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132674; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uurcnwltksv.info"; content:"|0b|uurcnwltksv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132675; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uusemlujqw.ws"; content:"|0a|uusemlujqw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132676; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uutymelew.ws"; content:"|09|uutymelew|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132677; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uvayt.com"; content:"|05|uvayt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132678; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uvcyogmb.cc"; content:"|08|uvcyogmb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132679; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uvgrnfxxy.ws"; content:"|09|uvgrnfxxy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132680; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uvkwq.info"; content:"|05|uvkwq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132681; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uvlspttu.biz"; content:"|08|uvlspttu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132682; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uvmfy.net"; content:"|05|uvmfy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132683; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uvrlzdip.cc"; content:"|08|uvrlzdip|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132684; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uvrxxqewe.cn"; content:"|09|uvrxxqewe|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132685; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uvslvfs.net"; content:"|07|uvslvfs|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132686; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uvtstx.cc"; content:"|06|uvtstx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132687; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uvvaipuj.info"; content:"|08|uvvaipuj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132688; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uweacujeuoi.biz"; content:"|0b|uweacujeuoi|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132689; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uwfszkzrcxt.com"; content:"|0b|uwfszkzrcxt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132690; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uwgdzbx.info"; content:"|07|uwgdzbx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132691; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uwgey.cn"; content:"|05|uwgey|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132692; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uwlvejqqts.ws"; content:"|0a|uwlvejqqts|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132693; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uwprrfybx.ws"; content:"|09|uwprrfybx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132694; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uwqigcjz.com"; content:"|08|uwqigcjz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132695; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uwtayowm.org"; content:"|08|uwtayowm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132696; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uwuounkr.net"; content:"|08|uwuounkr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132697; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uwwglriisw.biz"; content:"|0a|uwwglriisw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132698; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uwygkzj.org"; content:"|07|uwygkzj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132699; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uxanqeotk.cc"; content:"|09|uxanqeotk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132700; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uxdbwifkpgm.ws"; content:"|0b|uxdbwifkpgm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132701; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uxieimjfdma.com"; content:"|0b|uxieimjfdma|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132702; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uxlvkpqt.ws"; content:"|08|uxlvkpqt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132703; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uxlzgnr.net"; content:"|07|uxlzgnr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132704; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uxousgjz.org"; content:"|08|uxousgjz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132705; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uxpaksbu.cc"; content:"|08|uxpaksbu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132706; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uxpqlqs.biz"; content:"|07|uxpqlqs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132707; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uxrmhfgorzv.info"; content:"|0b|uxrmhfgorzv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132708; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uxspcbmj.info"; content:"|08|uxspcbmj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132709; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uxtjksje.info"; content:"|08|uxtjksje|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132710; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uxtrsv.ws"; content:"|06|uxtrsv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132711; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uxulkhuv.info"; content:"|08|uxulkhuv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132712; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uxyrhnsy.org"; content:"|08|uxyrhnsy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132713; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uxzjhuowp.biz"; content:"|09|uxzjhuowp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132714; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uxzohv.net"; content:"|06|uxzohv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132715; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uyeyaru.net"; content:"|07|uyeyaru|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132716; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uygmqsa.cn"; content:"|07|uygmqsa|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132717; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uyiah.cn"; content:"|05|uyiah|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132718; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uyirxqr.info"; content:"|07|uyirxqr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132719; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uyjdlpiunh.com"; content:"|0a|uyjdlpiunh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132720; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uylik.cc"; content:"|05|uylik|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132721; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uynbrymwazc.cc"; content:"|0b|uynbrymwazc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132722; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uynobabzpaf.ws"; content:"|0b|uynobabzpaf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132723; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uypnsgg.cn"; content:"|07|uypnsgg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132724; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uypye.net"; content:"|05|uypye|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132725; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uysqj.cn"; content:"|05|uysqj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132726; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uyuhhzmn.ws"; content:"|08|uyuhhzmn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132727; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uyxmoxyj.net"; content:"|08|uyxmoxyj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132728; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uyyghgb.net"; content:"|07|uyyghgb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132729; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uyzhcxigfuy.cn"; content:"|0b|uyzhcxigfuy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132730; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uyzlvwfb.info"; content:"|08|uyzlvwfb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132731; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uzfwob.info"; content:"|06|uzfwob|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132732; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uziii.cc"; content:"|05|uziii|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132733; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uzniito.org"; content:"|07|uzniito|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132734; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uznqdyrfxig.info"; content:"|0b|uznqdyrfxig|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132735; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uzslyemkgp.org"; content:"|0a|uzslyemkgp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132736; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uzsxgxyhbz.info"; content:"|0a|uzsxgxyhbz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132737; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uztphoq.biz"; content:"|07|uztphoq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132738; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uzugx.com"; content:"|05|uzugx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132739; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uzuosebt.net"; content:"|08|uzuosebt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132740; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uzvlv.net"; content:"|05|uzvlv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132741; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uzvnheey.cn"; content:"|08|uzvnheey|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132742; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uzyklfedapm.org"; content:"|0b|uzyklfedapm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132743; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain uzyyqpoips.cn"; content:"|0a|uzyyqpoips|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132744; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vaaswk.biz"; content:"|06|vaaswk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132745; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vaexmpw.info"; content:"|07|vaexmpw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132746; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vafgbrzo.biz"; content:"|08|vafgbrzo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132747; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain valqeokzwat.ws"; content:"|0b|valqeokzwat|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132748; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain valzdgbsf.com"; content:"|09|valzdgbsf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132749; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vantmmsh.biz"; content:"|08|vantmmsh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132750; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vaogjyxq.net"; content:"|08|vaogjyxq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132751; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vasfb.info"; content:"|05|vasfb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132752; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vasygtcuz.org"; content:"|09|vasygtcuz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132753; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vazhiuxkv.cn"; content:"|09|vazhiuxkv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132754; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vazhyu.com"; content:"|06|vazhyu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132755; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vbbhdrbbfwt.biz"; content:"|0b|vbbhdrbbfwt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132756; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vbbjv.com"; content:"|05|vbbjv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132757; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vbeovpdn.biz"; content:"|08|vbeovpdn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132758; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vbjstafi.biz"; content:"|08|vbjstafi|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132759; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vbpeqzpt.net"; content:"|08|vbpeqzpt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132760; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vbssgsgybj.net"; content:"|0a|vbssgsgybj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132761; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vbwhhlfafi.com"; content:"|0a|vbwhhlfafi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132762; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vcgsjfkeuhy.biz"; content:"|0b|vcgsjfkeuhy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132763; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vchmbilga.net"; content:"|09|vchmbilga|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132764; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vcjpll.cn"; content:"|06|vcjpll|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132765; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vckczwjmw.net"; content:"|09|vckczwjmw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132766; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vclci.cn"; content:"|05|vclci|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132767; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vclswjqb.com"; content:"|08|vclswjqb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132768; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vcmau.cn"; content:"|05|vcmau|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132769; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vcnuzztt.cc"; content:"|08|vcnuzztt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132770; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vcolhdduik.cn"; content:"|0a|vcolhdduik|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132771; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vcpazlzrx.ws"; content:"|09|vcpazlzrx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132772; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vcpszndgka.info"; content:"|0a|vcpszndgka|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132773; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vcqztqbj.info"; content:"|08|vcqztqbj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132774; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vctfuwpev.info"; content:"|09|vctfuwpev|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132775; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vdahomfvfe.cc"; content:"|0a|vdahomfvfe|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132776; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vddiqr.net"; content:"|06|vddiqr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132777; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vdewaxvqc.org"; content:"|09|vdewaxvqc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132778; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vdikzl.cn"; content:"|06|vdikzl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132779; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vdkxnnbwfm.cn"; content:"|0a|vdkxnnbwfm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132780; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vdmykunuce.net"; content:"|0a|vdmykunuce|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132781; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vdsde.cn"; content:"|05|vdsde|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132782; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vdsrhqmzq.ws"; content:"|09|vdsrhqmzq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132783; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vdtmjhqy.info"; content:"|08|vdtmjhqy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132784; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vdxssrdc.info"; content:"|08|vdxssrdc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132785; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vdygyoqe.net"; content:"|08|vdygyoqe|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132786; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain veabkr.cn"; content:"|06|veabkr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132787; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain veaddsyy.org"; content:"|08|veaddsyy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132788; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain veddlqjch.org"; content:"|09|veddlqjch|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132789; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vehlidlesti.cn"; content:"|0b|vehlidlesti|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132790; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain velbll.net"; content:"|06|velbll|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132791; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain velrwcm.cc"; content:"|07|velrwcm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132792; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain veoqv.org"; content:"|05|veoqv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132793; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain veudsqsw.biz"; content:"|08|veudsqsw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132794; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vevngpv.net"; content:"|07|vevngpv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132795; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vexdtva.cn"; content:"|07|vexdtva|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132796; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vezihx.net"; content:"|06|vezihx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132797; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vfdnzeurq.cc"; content:"|09|vfdnzeurq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132798; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vfguvpbt.biz"; content:"|08|vfguvpbt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132799; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vfjhftwm.net"; content:"|08|vfjhftwm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132800; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vfmpw.cn"; content:"|05|vfmpw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132801; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vfscb.info"; content:"|05|vfscb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132802; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vfwrb.cc"; content:"|05|vfwrb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132803; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vgbogeog.ws"; content:"|08|vgbogeog|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132804; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vgcyhzoh.cn"; content:"|08|vgcyhzoh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132805; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vggcvrzqf.info"; content:"|09|vggcvrzqf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132806; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vgggxseofs.cc"; content:"|0a|vgggxseofs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132807; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vggkljj.org"; content:"|07|vggkljj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132808; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vggnylv.info"; content:"|07|vggnylv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132809; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vgkejpqr.cn"; content:"|08|vgkejpqr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132810; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vglwbgkd.info"; content:"|08|vglwbgkd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132811; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vgotiw.ws"; content:"|06|vgotiw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132812; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vgryosc.ws"; content:"|07|vgryosc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132813; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vgryyypd.org"; content:"|08|vgryyypd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132814; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vgwcjqka.org"; content:"|08|vgwcjqka|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132815; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vgwyv.com"; content:"|05|vgwyv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132816; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vgyoqgax.ws"; content:"|08|vgyoqgax|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132817; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vhasqxmxj.biz"; content:"|09|vhasqxmxj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132818; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vhbmwpzur.net"; content:"|09|vhbmwpzur|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132819; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vheid.com"; content:"|05|vheid|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132820; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vheuyj.cn"; content:"|06|vheuyj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132821; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vhfai.info"; content:"|05|vhfai|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132822; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vhhfwy.cn"; content:"|06|vhhfwy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132823; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vhjqxvsh.biz"; content:"|08|vhjqxvsh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132824; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vhmurg.org"; content:"|06|vhmurg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132825; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vhpupovxy.cc"; content:"|09|vhpupovxy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132826; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vhska.org"; content:"|05|vhska|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132827; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vhvxfpo.cc"; content:"|07|vhvxfpo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132828; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vibyewhrkna.net"; content:"|0b|vibyewhrkna|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132829; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain viecrkik.com"; content:"|08|viecrkik|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132830; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vifqhgub.cc"; content:"|08|vifqhgub|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132831; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vigaiqjg.biz"; content:"|08|vigaiqjg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132832; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vigqlmbhmy.cc"; content:"|0a|vigqlmbhmy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132833; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vihxht.info"; content:"|06|vihxht|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132834; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vijyqu.org"; content:"|06|vijyqu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132835; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vikesnbz.org"; content:"|08|vikesnbz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132836; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vimaaccjr.org"; content:"|09|vimaaccjr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132837; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vineonu.com"; content:"|07|vineonu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132838; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain viojld.ws"; content:"|06|viojld|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132839; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vipynuzcwv.cc"; content:"|0a|vipynuzcwv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132840; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vixsdo.cc"; content:"|06|vixsdo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132841; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain viyjls.cc"; content:"|06|viyjls|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132842; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vizrmmimz.cn"; content:"|09|vizrmmimz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132843; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vjjbbfae.org"; content:"|08|vjjbbfae|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132844; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vjkhxcm.net"; content:"|07|vjkhxcm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132845; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vjlgzxjsqmy.info"; content:"|0b|vjlgzxjsqmy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132846; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vjpbsaooi.ws"; content:"|09|vjpbsaooi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132847; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vjpejpftzlf.net"; content:"|0b|vjpejpftzlf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132848; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vjserartvqy.cn"; content:"|0b|vjserartvqy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132849; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vjsmabscj.cc"; content:"|09|vjsmabscj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132850; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vjtapco.info"; content:"|07|vjtapco|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132851; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vjwyu.cn"; content:"|05|vjwyu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132852; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vjxkpzjy.ws"; content:"|08|vjxkpzjy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132853; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vjxondoml.com"; content:"|09|vjxondoml|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132854; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vjyqkabkmo.org"; content:"|0a|vjyqkabkmo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132855; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vkbtrsp.org"; content:"|07|vkbtrsp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132856; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vkhzj.ws"; content:"|05|vkhzj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132857; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vkiekjsibs.biz"; content:"|0a|vkiekjsibs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132858; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vkklzvdp.org"; content:"|08|vkklzvdp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132859; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vklqfsex.net"; content:"|08|vklqfsex|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132860; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vkmjhrjguxd.cc"; content:"|0b|vkmjhrjguxd|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132861; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vkqieqptln.com"; content:"|0a|vkqieqptln|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132862; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vkszqxrh.cn"; content:"|08|vkszqxrh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132863; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vkvluvl.cn"; content:"|07|vkvluvl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132864; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vkwhdn.cn"; content:"|06|vkwhdn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132865; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vkwmjysckw.com"; content:"|0a|vkwmjysckw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132866; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vkxamvsj.ws"; content:"|08|vkxamvsj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132867; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vlaxurwstxe.cc"; content:"|0b|vlaxurwstxe|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132868; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vlbmfokvnne.cn"; content:"|0b|vlbmfokvnne|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132869; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vleymecsnw.net"; content:"|0a|vleymecsnw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132870; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vlirftbioot.org"; content:"|0b|vlirftbioot|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132871; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vlitjm.com"; content:"|06|vlitjm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132872; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vljtjpucxi.biz"; content:"|0a|vljtjpucxi|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132873; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vlkhsahn.cn"; content:"|08|vlkhsahn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132874; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vlnozhk.ws"; content:"|07|vlnozhk|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132875; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vlpqeenasaf.com"; content:"|0b|vlpqeenasaf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132876; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vlsenoqzo.cc"; content:"|09|vlsenoqzo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132877; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vlypmcfvyoj.info"; content:"|0b|vlypmcfvyoj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132878; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vlzhbjngjm.net"; content:"|0a|vlzhbjngjm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132879; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vlzlu.biz"; content:"|05|vlzlu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132880; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vmawtnjld.com"; content:"|09|vmawtnjld|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132881; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vmbmamagdrf.ws"; content:"|0b|vmbmamagdrf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132882; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vmgdd.biz"; content:"|05|vmgdd|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132883; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vmhsmqsi.org"; content:"|08|vmhsmqsi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132884; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vmihyrme.ws"; content:"|08|vmihyrme|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132885; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vmlqnkzzrj.org"; content:"|0a|vmlqnkzzrj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132886; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vmszfpaum.ws"; content:"|09|vmszfpaum|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132887; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vmtryplu.ws"; content:"|08|vmtryplu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132888; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vmvkzoh.com"; content:"|07|vmvkzoh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132889; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vmxbpigde.biz"; content:"|09|vmxbpigde|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132890; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vnbdzcqj.org"; content:"|08|vnbdzcqj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132891; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vnccge.net"; content:"|06|vnccge|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132892; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vnfelxpqv.net"; content:"|09|vnfelxpqv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132893; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vnfofosikdn.info"; content:"|0b|vnfofosikdn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132894; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vnftvuwsc.cc"; content:"|09|vnftvuwsc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132895; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vnggfk.cc"; content:"|06|vnggfk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132896; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vngpufi.ws"; content:"|07|vngpufi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132897; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vnnvv.ws"; content:"|05|vnnvv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132898; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vnovsiyi.info"; content:"|08|vnovsiyi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132899; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vnpywuesuuo.org"; content:"|0b|vnpywuesuuo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132900; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vnqgih.net"; content:"|06|vnqgih|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132901; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vnuqq.net"; content:"|05|vnuqq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132902; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vnvwemcjnme.info"; content:"|0b|vnvwemcjnme|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132903; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vnwkfwgz.cc"; content:"|08|vnwkfwgz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132904; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain voabb.net"; content:"|05|voabb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132905; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain voagmvir.org"; content:"|08|voagmvir|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132906; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vomzyf.net"; content:"|06|vomzyf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132907; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vosefdv.org"; content:"|07|vosefdv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132908; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vovtrjccrsl.net"; content:"|0b|vovtrjccrsl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132909; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vpazff.ws"; content:"|06|vpazff|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132910; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vpczdekreiw.cn"; content:"|0b|vpczdekreiw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132911; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vphgegmhae.biz"; content:"|0a|vphgegmhae|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132912; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vphrfbewywp.ws"; content:"|0b|vphrfbewywp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132913; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vpldhuci.net"; content:"|08|vpldhuci|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132914; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vppxyts.info"; content:"|07|vppxyts|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132915; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vprizkn.cc"; content:"|07|vprizkn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132916; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vpstnlx.info"; content:"|07|vpstnlx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132917; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vpxzacqm.cn"; content:"|08|vpxzacqm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132918; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vqbdbdpqbq.info"; content:"|0a|vqbdbdpqbq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132919; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vqcgq.org"; content:"|05|vqcgq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132920; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vqczjx.ws"; content:"|06|vqczjx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132921; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vqhjzyqmx.biz"; content:"|09|vqhjzyqmx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132922; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vqiuygpe.com"; content:"|08|vqiuygpe|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132923; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vqjxnfzgwpf.info"; content:"|0b|vqjxnfzgwpf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132924; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vqotwoktgfz.net"; content:"|0b|vqotwoktgfz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132925; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vqouxuylewm.com"; content:"|0b|vqouxuylewm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132926; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vqwnnus.cn"; content:"|07|vqwnnus|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132927; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vqxhbptch.org"; content:"|09|vqxhbptch|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132928; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vqxwpjbon.cc"; content:"|09|vqxwpjbon|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132929; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vqzhnzta.net"; content:"|08|vqzhnzta|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132930; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vrbmviovc.ws"; content:"|09|vrbmviovc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132931; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vrdnipky.biz"; content:"|08|vrdnipky|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132932; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vrfxnw.biz"; content:"|06|vrfxnw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132933; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vrgoqyot.com"; content:"|08|vrgoqyot|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132934; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vrhgjrm.info"; content:"|07|vrhgjrm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132935; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vrhuj.biz"; content:"|05|vrhuj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132936; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vrlrqeh.net"; content:"|07|vrlrqeh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132937; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vrnxwzaq.cn"; content:"|08|vrnxwzaq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132938; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vrpacjf.biz"; content:"|07|vrpacjf|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132939; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vrrwkskscbo.info"; content:"|0b|vrrwkskscbo|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132940; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vrtdipjb.cn"; content:"|08|vrtdipjb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132941; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vrtqvqrumu.ws"; content:"|0a|vrtqvqrumu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132942; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vrtzt.com"; content:"|05|vrtzt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132943; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vruapxob.ws"; content:"|08|vruapxob|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132944; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vrubpihsie.info"; content:"|0a|vrubpihsie|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132945; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vrxen.com"; content:"|05|vrxen|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132946; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vsacmlzsp.info"; content:"|09|vsacmlzsp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132947; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vsdybsmkb.net"; content:"|09|vsdybsmkb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132948; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vsfmbniupz.info"; content:"|0a|vsfmbniupz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132949; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vsgtxoi.ws"; content:"|07|vsgtxoi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132950; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vsmidbelr.biz"; content:"|09|vsmidbelr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132951; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vsnxgaelfa.info"; content:"|0a|vsnxgaelfa|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132952; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vssnitrn.com"; content:"|08|vssnitrn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132953; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vsuydde.com"; content:"|07|vsuydde|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132954; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vszdkanx.net"; content:"|08|vszdkanx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132955; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vteqnx.cn"; content:"|06|vteqnx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132956; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vtuaadhk.net"; content:"|08|vtuaadhk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132957; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vtvznrman.org"; content:"|09|vtvznrman|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132958; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vtwarykv.com"; content:"|08|vtwarykv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132959; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vtyneumdae.net"; content:"|0a|vtyneumdae|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132960; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vubptn.cc"; content:"|06|vubptn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132961; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vuildthqw.info"; content:"|09|vuildthqw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132962; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vujyjleli.info"; content:"|09|vujyjleli|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132963; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vunmterotnw.net"; content:"|0b|vunmterotnw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132964; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vunoxb.cn"; content:"|06|vunoxb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132965; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vuogfm.org"; content:"|06|vuogfm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132966; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vuphfe.info"; content:"|06|vuphfe|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132967; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vuraosyhqnk.info"; content:"|0b|vuraosyhqnk|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132968; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vveyjzawmv.com"; content:"|0a|vveyjzawmv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132969; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vvhpv.net"; content:"|05|vvhpv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132970; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vvogepcx.org"; content:"|08|vvogepcx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132971; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vvqsg.biz"; content:"|05|vvqsg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132972; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vvuudmwr.com"; content:"|08|vvuudmwr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132973; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vvweyjaovcl.org"; content:"|0b|vvweyjaovcl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132974; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vvwqqbvotv.cn"; content:"|0a|vvwqqbvotv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132975; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vvwvy.cc"; content:"|05|vvwvy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132976; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vvxht.ws"; content:"|05|vvxht|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132977; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vwbvabm.info"; content:"|07|vwbvabm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132978; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vwcfpqfrp.cn"; content:"|09|vwcfpqfrp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132979; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vwcylhjx.cn"; content:"|08|vwcylhjx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132980; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vwfaonhvn.cc"; content:"|09|vwfaonhvn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132981; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vwgdbmr.cc"; content:"|07|vwgdbmr|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132982; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vwlfawc.info"; content:"|07|vwlfawc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132983; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vwrooxouznd.info"; content:"|0b|vwrooxouznd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132984; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vwwqlgpnyna.info"; content:"|0b|vwwqlgpnyna|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132985; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vxamxl.ws"; content:"|06|vxamxl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132986; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vxerdo.net"; content:"|06|vxerdo|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132987; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vxfquswvuig.cn"; content:"|0b|vxfquswvuig|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132988; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vxopad.cn"; content:"|06|vxopad|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132989; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vxvesdz.biz"; content:"|07|vxvesdz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132990; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vxvonuud.cc"; content:"|08|vxvonuud|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132991; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vxvtklfi.cn"; content:"|08|vxvtklfi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132992; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vxxuh.com"; content:"|05|vxxuh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132993; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vxysg.org"; content:"|05|vxysg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132994; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vygrbrlxv.com"; content:"|09|vygrbrlxv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132995; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vymavkyhw.info"; content:"|09|vymavkyhw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132996; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vynvj.org"; content:"|05|vynvj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132997; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vyplikblxxc.info"; content:"|0b|vyplikblxxc|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132998; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vyzvxu.net"; content:"|06|vyzvxu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1132999; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vzbgh.cc"; content:"|05|vzbgh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133000; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vzeokljpnr.com"; content:"|0a|vzeokljpnr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133001; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vzhbblmarub.biz"; content:"|0b|vzhbblmarub|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133002; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vzhxgk.cc"; content:"|06|vzhxgk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133003; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vzjlek.cc"; content:"|06|vzjlek|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133004; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vzlfvfvezh.info"; content:"|0a|vzlfvfvezh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133005; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vzljnwli.com"; content:"|08|vzljnwli|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133006; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vzovitytmwe.org"; content:"|0b|vzovitytmwe|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133007; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vzpyqbo.cc"; content:"|07|vzpyqbo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133008; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vzslzjbk.cc"; content:"|08|vzslzjbk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133009; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vztfd.com"; content:"|05|vztfd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133010; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vzuqako.cn"; content:"|07|vzuqako|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133011; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vzvazdci.ws"; content:"|08|vzvazdci|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133012; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vzyzblan.info"; content:"|08|vzyzblan|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133013; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vzzewdf.com"; content:"|07|vzzewdf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133014; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vzzhznw.biz"; content:"|07|vzzhznw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133015; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain vzzuvgpkx.cc"; content:"|09|vzzuvgpkx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133016; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wabvqn.ws"; content:"|06|wabvqn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133017; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wahyqjim.biz"; content:"|08|wahyqjim|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133018; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wakhxbdmtf.info"; content:"|0a|wakhxbdmtf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133019; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain walwzm.net"; content:"|06|walwzm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133020; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wanvm.org"; content:"|05|wanvm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133021; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wapbyseplma.cn"; content:"|0b|wapbyseplma|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133022; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wapowlqx.com"; content:"|08|wapowlqx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133023; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wazviaf.com"; content:"|07|wazviaf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133024; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wbacuwr.com"; content:"|07|wbacuwr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133025; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wbajb.net"; content:"|05|wbajb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133026; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wbdekpojmj.ws"; content:"|0a|wbdekpojmj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133027; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wbdhui.com"; content:"|06|wbdhui|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133028; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wbjlu.biz"; content:"|05|wbjlu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133029; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wbkwcfjq.org"; content:"|08|wbkwcfjq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133030; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wbmhbsj.cc"; content:"|07|wbmhbsj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133031; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wbobojduz.org"; content:"|09|wbobojduz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133032; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wborsoqvqc.org"; content:"|0a|wborsoqvqc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133033; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wbqmay.cc"; content:"|06|wbqmay|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133034; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wbqzfcuyro.info"; content:"|0a|wbqzfcuyro|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133035; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wbrkx.biz"; content:"|05|wbrkx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133036; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wbtxb.org"; content:"|05|wbtxb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133037; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wbvwzllblbx.cn"; content:"|0b|wbvwzllblbx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133038; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wbwvhyp.cc"; content:"|07|wbwvhyp|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133039; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wbwxwj.cn"; content:"|06|wbwxwj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133040; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wcahkwnptg.info"; content:"|0a|wcahkwnptg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133041; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wcduvz.info"; content:"|06|wcduvz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133042; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wclcusdc.cn"; content:"|08|wclcusdc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133043; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wcnwtqgrwsi.cc"; content:"|0b|wcnwtqgrwsi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133044; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wcqvpjl.cc"; content:"|07|wcqvpjl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133045; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wcruf.org"; content:"|05|wcruf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133046; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wcvefnxyed.net"; content:"|0a|wcvefnxyed|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133047; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wcwcea.net"; content:"|06|wcwcea|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133048; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wcwidsgf.net"; content:"|08|wcwidsgf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133049; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wcxel.com"; content:"|05|wcxel|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133050; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wdbdysh.ws"; content:"|07|wdbdysh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133051; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wdbgtuwp.net"; content:"|08|wdbgtuwp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133052; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wdcegogbqvj.cn"; content:"|0b|wdcegogbqvj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133053; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wdfzz.com"; content:"|05|wdfzz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133054; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wdgabi.org"; content:"|06|wdgabi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133055; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wdjdmg.ws"; content:"|06|wdjdmg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133056; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wdlsie.info"; content:"|06|wdlsie|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133057; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wdplwc.biz"; content:"|06|wdplwc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133058; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wdpucqvx.org"; content:"|08|wdpucqvx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133059; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wdqfchpyit.cn"; content:"|0a|wdqfchpyit|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133060; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wdrmldpi.cc"; content:"|08|wdrmldpi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133061; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wdupy.com"; content:"|05|wdupy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133062; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wdvgdthzylc.biz"; content:"|0b|wdvgdthzylc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133063; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain weazmg.ws"; content:"|06|weazmg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133064; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wekgfuxf.com"; content:"|08|wekgfuxf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133065; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain weonzjsfkp.info"; content:"|0a|weonzjsfkp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133066; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain weprtcnohd.info"; content:"|0a|weprtcnohd|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133067; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wepsyxzntrb.com"; content:"|0b|wepsyxzntrb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133068; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wepvixvkqg.cn"; content:"|0a|wepvixvkqg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133069; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wesgfnul.info"; content:"|08|wesgfnul|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133070; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain weusmtyrqtu.net"; content:"|0b|weusmtyrqtu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133071; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wevlmmten.cc"; content:"|09|wevlmmten|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133072; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wevtrx.org"; content:"|06|wevtrx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133073; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wexznxcezl.biz"; content:"|0a|wexznxcezl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133074; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wfchtofigh.org"; content:"|0a|wfchtofigh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133075; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wffdwuanc.biz"; content:"|09|wffdwuanc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133076; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wffkjjhb.biz"; content:"|08|wffkjjhb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133077; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wfghs.cn"; content:"|05|wfghs|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133078; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wfjsbzzw.info"; content:"|08|wfjsbzzw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133079; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wfkvsxro.net"; content:"|08|wfkvsxro|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133080; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wfluedra.net"; content:"|08|wfluedra|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133081; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wfodxabpmbs.ws"; content:"|0b|wfodxabpmbs|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133082; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wfoejvts.org"; content:"|08|wfoejvts|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133083; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wforeqsb.cc"; content:"|08|wforeqsb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133084; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wfqox.biz"; content:"|05|wfqox|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133085; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wfqzygvi.biz"; content:"|08|wfqzygvi|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133086; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wfsldzh.com"; content:"|07|wfsldzh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133087; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wfubxhuk.biz"; content:"|08|wfubxhuk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133088; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wfupyx.org"; content:"|06|wfupyx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133089; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wfvybafvpdt.org"; content:"|0b|wfvybafvpdt|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133090; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wgcdvtvl.org"; content:"|08|wgcdvtvl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133091; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wgcqzae.cn"; content:"|07|wgcqzae|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133092; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wgdjcvlvf.com"; content:"|09|wgdjcvlvf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133093; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wggil.ws"; content:"|05|wggil|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133094; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wgikdfuxvk.info"; content:"|0a|wgikdfuxvk|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133095; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wgrrrr.biz"; content:"|06|wgrrrr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133096; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wgswqfz.biz"; content:"|07|wgswqfz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133097; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wgtesvq.cn"; content:"|07|wgtesvq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133098; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wgtylzoqwk.biz"; content:"|0a|wgtylzoqwk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133099; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wgvfkydxg.biz"; content:"|09|wgvfkydxg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133100; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wgythzbq.cn"; content:"|08|wgythzbq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133101; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain whbzalb.net"; content:"|07|whbzalb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133102; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain whigezriq.info"; content:"|09|whigezriq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133103; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain whkwdbtil.biz"; content:"|09|whkwdbtil|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133104; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain whmzd.org"; content:"|05|whmzd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133105; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain whozgfgo.info"; content:"|08|whozgfgo|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133106; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain whpknp.info"; content:"|06|whpknp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133107; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain whtoggsn.cn"; content:"|08|whtoggsn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133108; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain whwjvoiu.ws"; content:"|08|whwjvoiu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133109; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain whxjnuzkrrj.org"; content:"|0b|whxjnuzkrrj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133110; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wibsai.net"; content:"|06|wibsai|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133111; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wibsuoiv.com"; content:"|08|wibsuoiv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133112; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wibxhuusz.org"; content:"|09|wibxhuusz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133113; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wiclhowq.com"; content:"|08|wiclhowq|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133114; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wicuel.org"; content:"|06|wicuel|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133115; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain widmxfbwldl.ws"; content:"|0b|widmxfbwldl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133116; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wiexvexd.com"; content:"|08|wiexvexd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133117; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wifxeanv.org"; content:"|08|wifxeanv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133118; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wiiqojrh.com"; content:"|08|wiiqojrh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133119; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wimmugmq.biz"; content:"|08|wimmugmq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133120; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain winzhhi.cn"; content:"|07|winzhhi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133121; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wivgwlsw.biz"; content:"|08|wivgwlsw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133122; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wiwjpxuh.cc"; content:"|08|wiwjpxuh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133123; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wjckgem.org"; content:"|07|wjckgem|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133124; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wjejuk.cn"; content:"|06|wjejuk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133125; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wjmtwr.cn"; content:"|06|wjmtwr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133126; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wjpfsmacv.org"; content:"|09|wjpfsmacv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133127; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wjqbogswat.cc"; content:"|0a|wjqbogswat|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133128; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wjscodzhqdk.ws"; content:"|0b|wjscodzhqdk|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133129; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wjtqbfkn.biz"; content:"|08|wjtqbfkn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133130; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wjujqikaeln.net"; content:"|0b|wjujqikaeln|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133131; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wjzvlpbb.info"; content:"|08|wjzvlpbb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133132; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wkbtsutp.net"; content:"|08|wkbtsutp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133133; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wkbvdauis.info"; content:"|09|wkbvdauis|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133134; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wkcdfa.cc"; content:"|06|wkcdfa|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133135; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wkdcxbete.com"; content:"|09|wkdcxbete|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133136; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wkeezcsvft.net"; content:"|0a|wkeezcsvft|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133137; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wkgxweno.cc"; content:"|08|wkgxweno|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133138; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wkhpstck.org"; content:"|08|wkhpstck|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133139; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wkionoga.ws"; content:"|08|wkionoga|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133140; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wknpnwvgl.info"; content:"|09|wknpnwvgl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133141; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wkqcihwx.ws"; content:"|08|wkqcihwx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133142; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wktsmmjr.com"; content:"|08|wktsmmjr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133143; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wkvbczdzsj.cc"; content:"|0a|wkvbczdzsj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133144; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wkvkdjlr.com"; content:"|08|wkvkdjlr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133145; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wkzwqadhnt.org"; content:"|0a|wkzwqadhnt|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133146; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wldrwyjcl.cc"; content:"|09|wldrwyjcl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133147; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wliljo.com"; content:"|06|wliljo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133148; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wliwjdtky.cc"; content:"|09|wliwjdtky|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133149; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wlkxnlrq.cn"; content:"|08|wlkxnlrq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133150; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wlmza.info"; content:"|05|wlmza|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133151; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wlninxzpry.net"; content:"|0a|wlninxzpry|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133152; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wlnszbqd.com"; content:"|08|wlnszbqd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133153; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wlpgvwvnu.cn"; content:"|09|wlpgvwvnu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133154; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wlpqoktb.biz"; content:"|08|wlpqoktb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133155; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wlrcobl.biz"; content:"|07|wlrcobl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133156; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wltcukzp.org"; content:"|08|wltcukzp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133157; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wluffxa.com"; content:"|07|wluffxa|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133158; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wlxjtkxrbyk.cn"; content:"|0b|wlxjtkxrbyk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133159; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wlybsg.biz"; content:"|06|wlybsg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133160; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wlzslrk.cn"; content:"|07|wlzslrk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133161; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wmcdgj.net"; content:"|06|wmcdgj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133162; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wmfhmgelw.ws"; content:"|09|wmfhmgelw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133163; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wmfhqozqhq.ws"; content:"|0a|wmfhqozqhq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133164; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wmfkzwuiol.cc"; content:"|0a|wmfkzwuiol|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133165; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wmidqpt.cn"; content:"|07|wmidqpt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133166; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wmkcopyel.cn"; content:"|09|wmkcopyel|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133167; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wmoyqa.info"; content:"|06|wmoyqa|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133168; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wmpjwl.cc"; content:"|06|wmpjwl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133169; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wmrgfsvntrt.net"; content:"|0b|wmrgfsvntrt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133170; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wmsftfdn.org"; content:"|08|wmsftfdn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133171; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wnblaillueg.com"; content:"|0b|wnblaillueg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133172; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wnjfjuouots.cn"; content:"|0b|wnjfjuouots|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133173; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wnlhztbubp.biz"; content:"|0a|wnlhztbubp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133174; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wnmyshy.org"; content:"|07|wnmyshy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133175; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wnorqcsdsi.info"; content:"|0a|wnorqcsdsi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133176; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wnowb.ws"; content:"|05|wnowb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133177; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wnreurumhj.cc"; content:"|0a|wnreurumhj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133178; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wnsxv.biz"; content:"|05|wnsxv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133179; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wnvilf.cc"; content:"|06|wnvilf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133180; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain woacrktk.biz"; content:"|08|woacrktk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133181; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain woauil.ws"; content:"|06|woauil|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133182; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wodewbue.ws"; content:"|08|wodewbue|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133183; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wogimu.org"; content:"|06|wogimu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133184; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wolhe.cn"; content:"|05|wolhe|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133185; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wonkbberwbl.biz"; content:"|0b|wonkbberwbl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133186; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wooqbpfdlj.ws"; content:"|0a|wooqbpfdlj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133187; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wosnxmoz.cc"; content:"|08|wosnxmoz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133188; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wosrockrpzj.net"; content:"|0b|wosrockrpzj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133189; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain woteqrbxnh.ws"; content:"|0a|woteqrbxnh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133190; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wouzxeg.cc"; content:"|07|wouzxeg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133191; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain woydjyl.com"; content:"|07|woydjyl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133192; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain woynkuri.info"; content:"|08|woynkuri|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133193; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wpdbrkjfz.net"; content:"|09|wpdbrkjfz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133194; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wpfugtqb.biz"; content:"|08|wpfugtqb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133195; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wprbrimehm.net"; content:"|0a|wprbrimehm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133196; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wpyllvth.cn"; content:"|08|wpyllvth|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133197; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wqbjvpohm.net"; content:"|09|wqbjvpohm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133198; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wqcbuw.biz"; content:"|06|wqcbuw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133199; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wqfelrxhr.ws"; content:"|09|wqfelrxhr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133200; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wqhhhjbi.org"; content:"|08|wqhhhjbi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133201; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wqkbfpdckvi.cc"; content:"|0b|wqkbfpdckvi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133202; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wqkgkbdtn.ws"; content:"|09|wqkgkbdtn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133203; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wqmxcrfkx.info"; content:"|09|wqmxcrfkx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133204; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wqpcgig.ws"; content:"|07|wqpcgig|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133205; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wqvmvfoxadp.biz"; content:"|0b|wqvmvfoxadp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133206; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wrcknvxkwf.net"; content:"|0a|wrcknvxkwf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133207; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wrdbxtbc.cn"; content:"|08|wrdbxtbc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133208; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wrecujjv.cn"; content:"|08|wrecujjv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133209; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wrldwb.cc"; content:"|06|wrldwb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133210; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wrllp.net"; content:"|05|wrllp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133211; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wrmrvrxfow.cc"; content:"|0a|wrmrvrxfow|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133212; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wrnmevfu.com"; content:"|08|wrnmevfu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133213; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wrxks.info"; content:"|05|wrxks|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133214; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wsbbwkdhm.cc"; content:"|09|wsbbwkdhm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133215; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wscnhuf.net"; content:"|07|wscnhuf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133216; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wsgysloe.ws"; content:"|08|wsgysloe|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133217; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wshwtnllsr.info"; content:"|0a|wshwtnllsr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133218; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wsiyqwajpj.net"; content:"|0a|wsiyqwajpj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133219; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wsjiyynagm.info"; content:"|0a|wsjiyynagm|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133220; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wsmxdailo.cc"; content:"|09|wsmxdailo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133221; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wstwawu.ws"; content:"|07|wstwawu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133222; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wsuket.net"; content:"|06|wsuket|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133223; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wsuturjmqyi.org"; content:"|0b|wsuturjmqyi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133224; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wswnahsk.cc"; content:"|08|wswnahsk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133225; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wtaofs.cc"; content:"|06|wtaofs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133226; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wtcafowy.ws"; content:"|08|wtcafowy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133227; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wtddrnfw.ws"; content:"|08|wtddrnfw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133228; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wtdgzrjm.ws"; content:"|08|wtdgzrjm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133229; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wtjobooih.cn"; content:"|09|wtjobooih|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133230; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wtkbtzzcqu.cn"; content:"|0a|wtkbtzzcqu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133231; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wtkgtnjqlwj.cn"; content:"|0b|wtkgtnjqlwj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133232; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wtxrphhwb.biz"; content:"|09|wtxrphhwb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133233; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wucup.org"; content:"|05|wucup|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133234; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wuiatp.cn"; content:"|06|wuiatp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133235; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wukubviu.ws"; content:"|08|wukubviu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133236; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wulhfvenqbh.ws"; content:"|0b|wulhfvenqbh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133237; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wuwssqh.org"; content:"|07|wuwssqh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133238; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wvaniodf.info"; content:"|08|wvaniodf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133239; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wvchktbkwl.org"; content:"|0a|wvchktbkwl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133240; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wvfobdwhveb.net"; content:"|0b|wvfobdwhveb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133241; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wvfuetusyx.com"; content:"|0a|wvfuetusyx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133242; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wvnfwxpnbz.org"; content:"|0a|wvnfwxpnbz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133243; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wvpuoywimo.biz"; content:"|0a|wvpuoywimo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133244; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wvqxqsyymq.net"; content:"|0a|wvqxqsyymq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133245; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wvsqjknnv.com"; content:"|09|wvsqjknnv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133246; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wvwcyhi.net"; content:"|07|wvwcyhi|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133247; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wvwoiq.info"; content:"|06|wvwoiq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133248; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wwfelzbr.cn"; content:"|08|wwfelzbr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133249; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wwhcbcni.com"; content:"|08|wwhcbcni|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133250; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wwlcowdrm.biz"; content:"|09|wwlcowdrm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133251; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wwlfqnytkk.com"; content:"|0a|wwlfqnytkk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133252; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wwosffqdrms.cc"; content:"|0b|wwosffqdrms|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133253; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wwouhqhnjva.net"; content:"|0b|wwouhqhnjva|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133254; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wwqggh.info"; content:"|06|wwqggh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133255; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wwsxlytbv.biz"; content:"|09|wwsxlytbv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133256; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wwymamntdua.org"; content:"|0b|wwymamntdua|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133257; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wxcdra.cn"; content:"|06|wxcdra|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133258; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wxgnq.cn"; content:"|05|wxgnq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133259; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wxiqylrilq.net"; content:"|0a|wxiqylrilq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133260; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wxkpxxz.net"; content:"|07|wxkpxxz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133261; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wxkxwajermu.net"; content:"|0b|wxkxwajermu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133262; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wxlfit.cn"; content:"|06|wxlfit|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133263; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wxnollmx.info"; content:"|08|wxnollmx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133264; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wxopucfwtv.biz"; content:"|0a|wxopucfwtv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133265; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wxwemyyxdk.com"; content:"|0a|wxwemyyxdk|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133266; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wxzbnun.cn"; content:"|07|wxzbnun|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133267; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wyaxnexy.com"; content:"|08|wyaxnexy|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133268; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wyhjqt.com"; content:"|06|wyhjqt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133269; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wyotcipxz.org"; content:"|09|wyotcipxz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133270; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wywqsiczcj.com"; content:"|0a|wywqsiczcj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133271; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wzbxihb.org"; content:"|07|wzbxihb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133272; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wzdmkmilbab.cn"; content:"|0b|wzdmkmilbab|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133273; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wzefdogdhap.ws"; content:"|0b|wzefdogdhap|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133274; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wzgldft.cc"; content:"|07|wzgldft|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133275; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wzhthzr.org"; content:"|07|wzhthzr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133276; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wzmdclkw.cc"; content:"|08|wzmdclkw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133277; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wznxl.ws"; content:"|05|wznxl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133278; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wzufbp.org"; content:"|06|wzufbp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133279; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain wzzslteh.net"; content:"|08|wzzslteh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133280; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xabjxjlmzl.biz"; content:"|0a|xabjxjlmzl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133281; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xabntimrwb.com"; content:"|0a|xabntimrwb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133282; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xacazmx.ws"; content:"|07|xacazmx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133283; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xakik.org"; content:"|05|xakik|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133284; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xanlblmx.org"; content:"|08|xanlblmx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133285; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xavltz.biz"; content:"|06|xavltz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133286; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xavpwmhbudw.cn"; content:"|0b|xavpwmhbudw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133287; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xbdjhvt.biz"; content:"|07|xbdjhvt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133288; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xbkrklrg.biz"; content:"|08|xbkrklrg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133289; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xbrvxo.cc"; content:"|06|xbrvxo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133290; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xbtym.ws"; content:"|05|xbtym|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133291; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xbunpivzp.net"; content:"|09|xbunpivzp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133292; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xbxyocsckcf.cc"; content:"|0b|xbxyocsckcf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133293; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xcamfhy.net"; content:"|07|xcamfhy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133294; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xcawtpe.cn"; content:"|07|xcawtpe|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133295; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xcidgt.net"; content:"|06|xcidgt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133296; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xcjgshv.biz"; content:"|07|xcjgshv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133297; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xckrqm.ws"; content:"|06|xckrqm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133298; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xclzr.com"; content:"|05|xclzr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133299; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xcnoe.ws"; content:"|05|xcnoe|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133300; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xcpmja.biz"; content:"|06|xcpmja|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133301; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xcrhxwrvo.com"; content:"|09|xcrhxwrvo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133302; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xdcxwqcz.net"; content:"|08|xdcxwqcz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133303; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xdhnjwwxv.net"; content:"|09|xdhnjwwxv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133304; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xdihjups.cn"; content:"|08|xdihjups|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133305; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xdjngyq.cn"; content:"|07|xdjngyq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133306; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xdjpcxs.com"; content:"|07|xdjpcxs|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133307; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xdndrkjz.cc"; content:"|08|xdndrkjz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133308; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xdqufheh.info"; content:"|08|xdqufheh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133309; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xdqzyayi.info"; content:"|08|xdqzyayi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133310; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xdrubtomb.ws"; content:"|09|xdrubtomb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133311; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xdteidyiw.com"; content:"|09|xdteidyiw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133312; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xdufwxjn.org"; content:"|08|xdufwxjn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133313; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xdwgebaauin.cn"; content:"|0b|xdwgebaauin|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133314; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xdxeqtz.cn"; content:"|07|xdxeqtz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133315; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xdyneoeeu.ws"; content:"|09|xdyneoeeu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133316; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xeamunuu.cn"; content:"|08|xeamunuu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133317; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xedue.ws"; content:"|05|xedue|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133318; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xeeeute.cn"; content:"|07|xeeeute|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133319; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xeembzial.cn"; content:"|09|xeembzial|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133320; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xeiger.org"; content:"|06|xeiger|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133321; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xeishhte.biz"; content:"|08|xeishhte|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133322; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xelnyn.org"; content:"|06|xelnyn|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133323; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xepfjzwc.cn"; content:"|08|xepfjzwc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133324; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xesbtreo.cc"; content:"|08|xesbtreo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133325; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xetmditkqyc.biz"; content:"|0b|xetmditkqyc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133326; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xevxvx.biz"; content:"|06|xevxvx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133327; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xewglfxe.biz"; content:"|08|xewglfxe|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133328; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xewiwl.org"; content:"|06|xewiwl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133329; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xewlbghlpx.ws"; content:"|0a|xewlbghlpx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133330; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xezevhf.ws"; content:"|07|xezevhf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133331; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xfcycbggaw.cn"; content:"|0a|xfcycbggaw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133332; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xfelbel.com"; content:"|07|xfelbel|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133333; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xffieknyr.biz"; content:"|09|xffieknyr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133334; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xfghwqbgob.cc"; content:"|0a|xfghwqbgob|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133335; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xfgjrzyrvuc.net"; content:"|0b|xfgjrzyrvuc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133336; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xfnaalb.cn"; content:"|07|xfnaalb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133337; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xfnqftkujj.ws"; content:"|0a|xfnqftkujj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133338; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xfsfipdnphq.biz"; content:"|0b|xfsfipdnphq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133339; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xftpwood.org"; content:"|08|xftpwood|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133340; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xfuzwxumlfl.cn"; content:"|0b|xfuzwxumlfl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133341; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xfvjjlg.info"; content:"|07|xfvjjlg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133342; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xfwczdx.cc"; content:"|07|xfwczdx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133343; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xfyenknrbpg.biz"; content:"|0b|xfyenknrbpg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133344; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xgffbh.com"; content:"|06|xgffbh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133345; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xgfrdqez.net"; content:"|08|xgfrdqez|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133346; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xggorldk.cn"; content:"|08|xggorldk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133347; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xgiwdsgcpyl.info"; content:"|0b|xgiwdsgcpyl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133348; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xgkjhfess.org"; content:"|09|xgkjhfess|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133349; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xgmoj.ws"; content:"|05|xgmoj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133350; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xgoqk.biz"; content:"|05|xgoqk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133351; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xgvtzwl.ws"; content:"|07|xgvtzwl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133352; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xgwbws.net"; content:"|06|xgwbws|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133353; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xhduumfkgaw.com"; content:"|0b|xhduumfkgaw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133354; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xhhgkpikdre.net"; content:"|0b|xhhgkpikdre|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133355; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xhiocj.org"; content:"|06|xhiocj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133356; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xhmfmm.net"; content:"|06|xhmfmm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133357; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xhqza.info"; content:"|05|xhqza|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133358; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xhyhms.ws"; content:"|06|xhyhms|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133359; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xhzjonpceuz.ws"; content:"|0b|xhzjonpceuz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133360; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xiagdyqddky.org"; content:"|0b|xiagdyqddky|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133361; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xijacexv.cc"; content:"|08|xijacexv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133362; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ximulgkfecb.org"; content:"|0b|ximulgkfecb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133363; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xinnv.cn"; content:"|05|xinnv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133364; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xiparekzsg.info"; content:"|0a|xiparekzsg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133365; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xiriatxsu.net"; content:"|09|xiriatxsu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133366; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xirmhgmy.ws"; content:"|08|xirmhgmy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133367; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xisoeccem.net"; content:"|09|xisoeccem|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133368; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xiusku.org"; content:"|06|xiusku|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133369; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xivjndcvujg.ws"; content:"|0b|xivjndcvujg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133370; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xixgahsme.org"; content:"|09|xixgahsme|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133371; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xizpgl.cn"; content:"|06|xizpgl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133372; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xjbbh.biz"; content:"|05|xjbbh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133373; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xjepksyzmr.biz"; content:"|0a|xjepksyzmr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133374; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xjienyyvu.cn"; content:"|09|xjienyyvu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133375; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xjlvdsol.cc"; content:"|08|xjlvdsol|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133376; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xjnpta.info"; content:"|06|xjnpta|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133377; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xjqzsrigh.cc"; content:"|09|xjqzsrigh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133378; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xjrdzxmpvt.info"; content:"|0a|xjrdzxmpvt|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133379; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xjuxf.ws"; content:"|05|xjuxf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133380; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xjwkfgeo.cc"; content:"|08|xjwkfgeo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133381; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xjwvins.ws"; content:"|07|xjwvins|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133382; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xkhdy.info"; content:"|05|xkhdy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133383; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xkidsxiec.org"; content:"|09|xkidsxiec|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133384; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xkmatawaeyd.ws"; content:"|0b|xkmatawaeyd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133385; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xkqrmv.ws"; content:"|06|xkqrmv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133386; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xldrytzgs.cc"; content:"|09|xldrytzgs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133387; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xlfjsnkjpsl.net"; content:"|0b|xlfjsnkjpsl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133388; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xlhtaly.ws"; content:"|07|xlhtaly|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133389; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xlkuacxbcvv.ws"; content:"|0b|xlkuacxbcvv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133390; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xlnouzabw.biz"; content:"|09|xlnouzabw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133391; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xlnpg.cc"; content:"|05|xlnpg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133392; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xlnrxj.cc"; content:"|06|xlnrxj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133393; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xloopavgv.com"; content:"|09|xloopavgv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133394; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xlosfht.cc"; content:"|07|xlosfht|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133395; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xlyks.org"; content:"|05|xlyks|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133396; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xlykv.info"; content:"|05|xlykv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133397; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xlzbhthtxo.biz"; content:"|0a|xlzbhthtxo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133398; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xlzpvixoiz.net"; content:"|0a|xlzpvixoiz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133399; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xmaeirgs.ws"; content:"|08|xmaeirgs|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133400; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xmctgjpflf.com"; content:"|0a|xmctgjpflf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133401; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xmgstrtk.net"; content:"|08|xmgstrtk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133402; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xmguae.info"; content:"|06|xmguae|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133403; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xmgxtj.com"; content:"|06|xmgxtj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133404; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xmjnaifd.net"; content:"|08|xmjnaifd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133405; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xmlpihy.net"; content:"|07|xmlpihy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133406; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xmlvdnv.org"; content:"|07|xmlvdnv|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133407; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xmokrbue.org"; content:"|08|xmokrbue|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133408; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xmphimfexan.net"; content:"|0b|xmphimfexan|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133409; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xmqvvfhk.cn"; content:"|08|xmqvvfhk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133410; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xmsbzwrkin.net"; content:"|0a|xmsbzwrkin|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133411; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xmsmie.org"; content:"|06|xmsmie|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133412; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xmvgwbvwlo.cn"; content:"|0a|xmvgwbvwlo|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133413; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xmvowigylg.cn"; content:"|0a|xmvowigylg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133414; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xmxavpz.info"; content:"|07|xmxavpz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133415; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xmyifuhae.cc"; content:"|09|xmyifuhae|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133416; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xmzssuqhrt.com"; content:"|0a|xmzssuqhrt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133417; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xneyfpbm.net"; content:"|08|xneyfpbm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133418; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xnnwtwmqzy.cc"; content:"|0a|xnnwtwmqzy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133419; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xnpjdw.org"; content:"|06|xnpjdw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133420; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xnscyafnmmg.org"; content:"|0b|xnscyafnmmg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133421; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xnvfivzg.org"; content:"|08|xnvfivzg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133422; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xnwfg.cc"; content:"|05|xnwfg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133423; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xnxyjdysq.org"; content:"|09|xnxyjdysq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133424; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xnzuqhiov.cn"; content:"|09|xnzuqhiov|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133425; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xoaofixy.cc"; content:"|08|xoaofixy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133426; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xoecpucb.cn"; content:"|08|xoecpucb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133427; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xokdyfov.cn"; content:"|08|xokdyfov|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133428; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xonjjbnm.com"; content:"|08|xonjjbnm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133429; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xonyr.biz"; content:"|05|xonyr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133430; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xotgndzx.ws"; content:"|08|xotgndzx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133431; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xoxrmb.info"; content:"|06|xoxrmb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133432; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xoyyoyga.net"; content:"|08|xoyyoyga|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133433; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xpbbuplwr.com"; content:"|09|xpbbuplwr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133434; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xpgvysyxnj.cn"; content:"|0a|xpgvysyxnj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133435; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xpstks.ws"; content:"|06|xpstks|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133436; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xpuxbfskdml.net"; content:"|0b|xpuxbfskdml|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133437; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xpvxrtc.net"; content:"|07|xpvxrtc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133438; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xpwme.cn"; content:"|05|xpwme|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133439; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xqdmhmahmpq.cn"; content:"|0b|xqdmhmahmpq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133440; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xqdvmavs.cn"; content:"|08|xqdvmavs|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133441; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xqfdelcoqf.biz"; content:"|0a|xqfdelcoqf|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133442; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xqhprnzly.net"; content:"|09|xqhprnzly|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133443; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xqjjsl.cc"; content:"|06|xqjjsl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133444; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xqllsdhf.cc"; content:"|08|xqllsdhf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133445; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xqnpfcbbug.org"; content:"|0a|xqnpfcbbug|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133446; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xqozuwlzxu.ws"; content:"|0a|xqozuwlzxu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133447; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xqrivxkwont.info"; content:"|0b|xqrivxkwont|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133448; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xqscazit.net"; content:"|08|xqscazit|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133449; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xqyppogvu.net"; content:"|09|xqyppogvu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133450; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xqyzrta.biz"; content:"|07|xqyzrta|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133451; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xrcle.biz"; content:"|05|xrcle|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133452; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xrclthrjydr.com"; content:"|0b|xrclthrjydr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133453; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xrczhfv.ws"; content:"|07|xrczhfv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133454; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xrgcklnazu.biz"; content:"|0a|xrgcklnazu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133455; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xrgifthjcst.ws"; content:"|0b|xrgifthjcst|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133456; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xrgxmv.net"; content:"|06|xrgxmv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133457; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xrmujflezfj.ws"; content:"|0b|xrmujflezfj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133458; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xrqddhe.cc"; content:"|07|xrqddhe|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133459; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xrrccq.biz"; content:"|06|xrrccq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133460; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xrtxdmzw.ws"; content:"|08|xrtxdmzw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133461; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xrvmv.ws"; content:"|05|xrvmv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133462; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xrvvhixdfy.info"; content:"|0a|xrvvhixdfy|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133463; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xryywddo.com"; content:"|08|xryywddo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133464; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xryzbbnvct.cc"; content:"|0a|xryzbbnvct|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133465; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xrzrafikkg.cc"; content:"|0a|xrzrafikkg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133466; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xsayxr.net"; content:"|06|xsayxr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133467; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xsdprttq.cn"; content:"|08|xsdprttq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133468; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xshnizorkrh.cc"; content:"|0b|xshnizorkrh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133469; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xshoij.cn"; content:"|06|xshoij|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133470; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xshvtqskhlr.cn"; content:"|0b|xshvtqskhlr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133471; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xshzw.biz"; content:"|05|xshzw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133472; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xsjcsl.cn"; content:"|06|xsjcsl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133473; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xspcwvxa.cn"; content:"|08|xspcwvxa|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133474; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xspjsd.net"; content:"|06|xspjsd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133475; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xsprp.ws"; content:"|05|xsprp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133476; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xsvmvno.biz"; content:"|07|xsvmvno|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133477; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xswqjgwi.cn"; content:"|08|xswqjgwi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133478; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xszgmcabwi.ws"; content:"|0a|xszgmcabwi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133479; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xtbnbovhe.info"; content:"|09|xtbnbovhe|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133480; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xtbtqpli.org"; content:"|08|xtbtqpli|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133481; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xtljqkbw.net"; content:"|08|xtljqkbw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133482; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xtrfnjzzu.cc"; content:"|09|xtrfnjzzu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133483; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xtswjzf.cc"; content:"|07|xtswjzf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133484; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xtvdqw.cc"; content:"|06|xtvdqw|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133485; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xtvjheujt.org"; content:"|09|xtvjheujt|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133486; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xtwnkmbhs.info"; content:"|09|xtwnkmbhs|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133487; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xuaqxyger.cn"; content:"|09|xuaqxyger|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133488; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xubuzbxib.cn"; content:"|09|xubuzbxib|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133489; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xueudqloc.com"; content:"|09|xueudqloc|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133490; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xuhagghw.net"; content:"|08|xuhagghw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133491; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xukspudjb.net"; content:"|09|xukspudjb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133492; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xulixeux.ws"; content:"|08|xulixeux|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133493; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xupjnovhom.net"; content:"|0a|xupjnovhom|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133494; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xupqqpocybv.cc"; content:"|0b|xupqqpocybv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133495; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xuptopvu.cc"; content:"|08|xuptopvu|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133496; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xusqayr.cn"; content:"|07|xusqayr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133497; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xuudqhtfai.biz"; content:"|0a|xuudqhtfai|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133498; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xuxldhu.info"; content:"|07|xuxldhu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133499; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xvasux.net"; content:"|06|xvasux|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133500; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xvcqjmuf.net"; content:"|08|xvcqjmuf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133501; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xveewl.biz"; content:"|06|xveewl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133502; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xvfjmuc.cc"; content:"|07|xvfjmuc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133503; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xvlgoazi.biz"; content:"|08|xvlgoazi|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133504; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xvlhjdwgx.org"; content:"|09|xvlhjdwgx|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133505; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xvpqmsha.net"; content:"|08|xvpqmsha|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133506; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xvwla.net"; content:"|05|xvwla|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133507; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xwaauvkh.ws"; content:"|08|xwaauvkh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133508; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xweric.biz"; content:"|06|xweric|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133509; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xwfxr.ws"; content:"|05|xwfxr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133510; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xwhusrhizah.cn"; content:"|0b|xwhusrhizah|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133511; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xwjzhtjp.info"; content:"|08|xwjzhtjp|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133512; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xwlhjfvcut.biz"; content:"|0a|xwlhjfvcut|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133513; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xwmrl.biz"; content:"|05|xwmrl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133514; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xwsifg.biz"; content:"|06|xwsifg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133515; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xwtfxz.biz"; content:"|06|xwtfxz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133516; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xwvaial.net"; content:"|07|xwvaial|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133517; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xwvlbnrcpl.cc"; content:"|0a|xwvlbnrcpl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133518; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xwwcvhbv.cc"; content:"|08|xwwcvhbv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133519; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xwzjwdr.biz"; content:"|07|xwzjwdr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133520; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xxemzqzs.biz"; content:"|08|xxemzqzs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133521; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xxgurupno.net"; content:"|09|xxgurupno|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133522; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xxhddhr.info"; content:"|07|xxhddhr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133523; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xxhykrdy.cc"; content:"|08|xxhykrdy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133524; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xxjvxbcauub.biz"; content:"|0b|xxjvxbcauub|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133525; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xxljbrfxfgp.org"; content:"|0b|xxljbrfxfgp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133526; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xxpwmptr.org"; content:"|08|xxpwmptr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133527; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xxtsnhgtofx.com"; content:"|0b|xxtsnhgtofx|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133528; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xxttkwnl.ws"; content:"|08|xxttkwnl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133529; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xxxseref.org"; content:"|08|xxxseref|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133530; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xyfdb.cc"; content:"|05|xyfdb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133531; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xyfdhrfe.biz"; content:"|08|xyfdhrfe|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133532; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xyhcfvo.ws"; content:"|07|xyhcfvo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133533; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xyrnkypzje.org"; content:"|0a|xyrnkypzje|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133534; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xywsouuhr.net"; content:"|09|xywsouuhr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133535; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xyxbqh.cn"; content:"|06|xyxbqh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133536; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xzclkbzu.ws"; content:"|08|xzclkbzu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133537; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xzctegku.info"; content:"|08|xzctegku|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133538; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xzdcxhtc.net"; content:"|08|xzdcxhtc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133539; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xzjblauhljg.org"; content:"|0b|xzjblauhljg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133540; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xzlyjft.cc"; content:"|07|xzlyjft|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133541; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xzogtx.ws"; content:"|06|xzogtx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133542; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xzpcpocu.cn"; content:"|08|xzpcpocu|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133543; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xzqpj.cn"; content:"|05|xzqpj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133544; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xztpl.ws"; content:"|05|xztpl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133545; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xztuvntk.biz"; content:"|08|xztuvntk|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133546; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xzyijkpxgw.com"; content:"|0a|xzyijkpxgw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133547; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain xzzhfghienu.org"; content:"|0b|xzzhfghienu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133548; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yaclq.ws"; content:"|05|yaclq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133549; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yacomltkt.ws"; content:"|09|yacomltkt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133550; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yadzo.biz"; content:"|05|yadzo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133551; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yaedwfuvk.cn"; content:"|09|yaedwfuvk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133552; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yaidi.cc"; content:"|05|yaidi|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133553; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yajhavxl.cc"; content:"|08|yajhavxl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133554; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yajre.cc"; content:"|05|yajre|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133555; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yamkrmwsi.info"; content:"|09|yamkrmwsi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133556; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yanint.cn"; content:"|06|yanint|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133557; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yawby.biz"; content:"|05|yawby|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133558; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yaxhrsph.biz"; content:"|08|yaxhrsph|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133559; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yayuk.cc"; content:"|05|yayuk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133560; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yazntcwbxd.org"; content:"|0a|yazntcwbxd|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133561; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ybaoouf.cn"; content:"|07|ybaoouf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133562; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ybbrbg.com"; content:"|06|ybbrbg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133563; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ybidhb.info"; content:"|06|ybidhb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133564; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ybihllfqqik.com"; content:"|0b|ybihllfqqik|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133565; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ybjtdvji.net"; content:"|08|ybjtdvji|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133566; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ybpsbdzf.net"; content:"|08|ybpsbdzf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133567; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ybwirzc.biz"; content:"|07|ybwirzc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133568; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ybyjaovs.cc"; content:"|08|ybyjaovs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133569; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ybzrkprrl.com"; content:"|09|ybzrkprrl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133570; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ycdfursl.cc"; content:"|08|ycdfursl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133571; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ycevyefwa.biz"; content:"|09|ycevyefwa|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133572; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ycgezydw.biz"; content:"|08|ycgezydw|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133573; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ychbj.org"; content:"|05|ychbj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133574; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yckvdgrt.cc"; content:"|08|yckvdgrt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133575; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yckvo.info"; content:"|05|yckvo|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133576; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ycoosytm.cc"; content:"|08|ycoosytm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133577; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ycpzzw.com"; content:"|06|ycpzzw|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133578; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ycsmybgme.cc"; content:"|09|ycsmybgme|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133579; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ycwgwdvanuo.org"; content:"|0b|ycwgwdvanuo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133580; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ydecrmbuh.com"; content:"|09|ydecrmbuh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133581; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ydglzvb.com"; content:"|07|ydglzvb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133582; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ydgppkrxyr.net"; content:"|0a|ydgppkrxyr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133583; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ydknbsnwfr.cn"; content:"|0a|ydknbsnwfr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133584; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ydpzqus.com"; content:"|07|ydpzqus|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133585; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ydtcsvbu.com"; content:"|08|ydtcsvbu|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133586; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ydwcfs.net"; content:"|06|ydwcfs|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133587; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yebmykujlp.com"; content:"|0a|yebmykujlp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133588; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yedahlup.cn"; content:"|08|yedahlup|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133589; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yedecppeapc.biz"; content:"|0b|yedecppeapc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133590; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yeevkmesyeq.net"; content:"|0b|yeevkmesyeq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133591; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yeftond.ws"; content:"|07|yeftond|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133592; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yemvtcg.com"; content:"|07|yemvtcg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133593; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yenrkesj.cn"; content:"|08|yenrkesj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133594; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yfdourt.net"; content:"|07|yfdourt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133595; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yfebqhvj.ws"; content:"|08|yfebqhvj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133596; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yfgqozvpbwn.info"; content:"|0b|yfgqozvpbwn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133597; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yfjqp.net"; content:"|05|yfjqp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133598; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yflisitb.ws"; content:"|08|yflisitb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133599; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yfmylwuxeey.org"; content:"|0b|yfmylwuxeey|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133600; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yfnzrfkcxl.ws"; content:"|0a|yfnzrfkcxl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133601; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yfyegobg.biz"; content:"|08|yfyegobg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133602; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yfzklaex.info"; content:"|08|yfzklaex|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133603; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ygdukwm.com"; content:"|07|ygdukwm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133604; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ygirany.info"; content:"|07|ygirany|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133605; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ygmmvz.info"; content:"|06|ygmmvz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133606; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ygtgjsswc.org"; content:"|09|ygtgjsswc|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133607; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ygtvvefc.biz"; content:"|08|ygtvvefc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133608; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ygvkfwxfdl.com"; content:"|0a|ygvkfwxfdl|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133609; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ygysdugrzm.cc"; content:"|0a|ygysdugrzm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133610; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yhbysxjcdee.cc"; content:"|0b|yhbysxjcdee|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133611; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yhdcptopaf.info"; content:"|0a|yhdcptopaf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133612; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yhlgrmmkwc.cn"; content:"|0a|yhlgrmmkwc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133613; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yhodektvq.ws"; content:"|09|yhodektvq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133614; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yhrneiztdj.biz"; content:"|0a|yhrneiztdj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133615; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yieeig.org"; content:"|06|yieeig|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133616; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yiggf.cc"; content:"|05|yiggf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133617; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yihkzyyp.ws"; content:"|08|yihkzyyp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133618; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yijgzwfi.ws"; content:"|08|yijgzwfi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133619; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yijxxuz.biz"; content:"|07|yijxxuz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133620; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yikvwlpmdp.org"; content:"|0a|yikvwlpmdp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133621; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yilxgkzkgkq.net"; content:"|0b|yilxgkzkgkq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133622; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yimstmwg.cc"; content:"|08|yimstmwg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133623; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yindfyhpmbl.cc"; content:"|0b|yindfyhpmbl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133624; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yiovbk.net"; content:"|06|yiovbk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133625; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yipkvjmvri.com"; content:"|0a|yipkvjmvri|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133626; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yiqpp.cn"; content:"|05|yiqpp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133627; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yiqwstlwgv.cn"; content:"|0a|yiqwstlwgv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133628; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yiwvj.com"; content:"|05|yiwvj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133629; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yixphqc.cc"; content:"|07|yixphqc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133630; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yizcfmds.biz"; content:"|08|yizcfmds|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133631; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yjabarftt.cc"; content:"|09|yjabarftt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133632; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yjanhgty.org"; content:"|08|yjanhgty|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133633; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yjbqbnto.net"; content:"|08|yjbqbnto|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133634; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yjclmiyt.info"; content:"|08|yjclmiyt|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133635; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yjhnmyvd.com"; content:"|08|yjhnmyvd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133636; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yjknkl.cc"; content:"|06|yjknkl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133637; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yjlzdprmirt.cn"; content:"|0b|yjlzdprmirt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133638; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yjvnxwo.ws"; content:"|07|yjvnxwo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133639; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yjwgaoxpix.com"; content:"|0a|yjwgaoxpix|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133640; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yjyqctsg.info"; content:"|08|yjyqctsg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133641; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yjyzjdds.cc"; content:"|08|yjyzjdds|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133642; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ykhjvlxjuo.ws"; content:"|0a|ykhjvlxjuo|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133643; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ykhmfg.info"; content:"|06|ykhmfg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133644; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yknief.org"; content:"|06|yknief|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133645; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ykqsauqrfg.org"; content:"|0a|ykqsauqrfg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133646; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yktttj.net"; content:"|06|yktttj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133647; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ykvojyql.cc"; content:"|08|ykvojyql|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133648; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ylbytp.net"; content:"|06|ylbytp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133649; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ylchagzsl.net"; content:"|09|ylchagzsl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133650; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ylgdbucx.biz"; content:"|08|ylgdbucx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133651; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ylhuoa.org"; content:"|06|ylhuoa|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133652; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ylmveg.org"; content:"|06|ylmveg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133653; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yltuoxqxauo.org"; content:"|0b|yltuoxqxauo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133654; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ylyfvifl.ws"; content:"|08|ylyfvifl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133655; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ylyhrkjcvtt.info"; content:"|0b|ylyhrkjcvtt|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133656; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ylzaxpb.cc"; content:"|07|ylzaxpb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133657; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ymenitgfvl.org"; content:"|0a|ymenitgfvl|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133658; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ymhrxbrc.biz"; content:"|08|ymhrxbrc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133659; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ymkbmxhzbix.biz"; content:"|0b|ymkbmxhzbix|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133660; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ymldvrgx.ws"; content:"|08|ymldvrgx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133661; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ymlwifld.info"; content:"|08|ymlwifld|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133662; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ymtvjedm.net"; content:"|08|ymtvjedm|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133663; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ymucxcpjxea.com"; content:"|0b|ymucxcpjxea|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133664; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ymurba.biz"; content:"|06|ymurba|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133665; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ymwekewuo.biz"; content:"|09|ymwekewuo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133666; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ynbrcsthxfo.com"; content:"|0b|ynbrcsthxfo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133667; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ynczkf.org"; content:"|06|ynczkf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133668; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ynfgzwzb.biz"; content:"|08|ynfgzwzb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133669; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ynglotot.cc"; content:"|08|ynglotot|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133670; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ynmeiwz.biz"; content:"|07|ynmeiwz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133671; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ynplrvfkz.ws"; content:"|09|ynplrvfkz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133672; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ynqfpmquu.net"; content:"|09|ynqfpmquu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133673; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ynuobsj.org"; content:"|07|ynuobsj|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133674; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ynyewrpa.net"; content:"|08|ynyewrpa|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133675; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yoarqr.net"; content:"|06|yoarqr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133676; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yoegvilh.cc"; content:"|08|yoegvilh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133677; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yoguwx.cn"; content:"|06|yoguwx|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133678; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yohgqkpom.com"; content:"|09|yohgqkpom|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133679; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yoorxztrf.org"; content:"|09|yoorxztrf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133680; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain youpirm.cn"; content:"|07|youpirm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133681; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yoviqamreg.biz"; content:"|0a|yoviqamreg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133682; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yowejpctrmk.cn"; content:"|0b|yowejpctrmk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133683; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yoxbvfu.net"; content:"|07|yoxbvfu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133684; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yoygepkfm.biz"; content:"|09|yoygepkfm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133685; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yozysvf.com"; content:"|07|yozysvf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133686; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ypesg.info"; content:"|05|ypesg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133687; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ypfkpseno.info"; content:"|09|ypfkpseno|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133688; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ypgdkj.cn"; content:"|06|ypgdkj|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133689; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ypjfrw.net"; content:"|06|ypjfrw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133690; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ypmap.ws"; content:"|05|ypmap|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133691; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ypnttkrum.info"; content:"|09|ypnttkrum|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133692; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ypopvfrkjzt.com"; content:"|0b|ypopvfrkjzt|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133693; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yppihhwj.ws"; content:"|08|yppihhwj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133694; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yppvwckd.com"; content:"|08|yppvwckd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133695; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ypqhgbcgn.cn"; content:"|09|ypqhgbcgn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133696; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ypwdmaae.net"; content:"|08|ypwdmaae|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133697; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ypwpggu.info"; content:"|07|ypwpggu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133698; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ypytwkvkim.com"; content:"|0a|ypytwkvkim|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133699; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yqccbtgjnb.net"; content:"|0a|yqccbtgjnb|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133700; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yqcxxjbpay.info"; content:"|0a|yqcxxjbpay|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133701; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yqdzzlbq.biz"; content:"|08|yqdzzlbq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133702; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yqeouk.net"; content:"|06|yqeouk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133703; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yqfajzju.biz"; content:"|08|yqfajzju|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133704; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yqkakhmh.info"; content:"|08|yqkakhmh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133705; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yqtbedbhz.org"; content:"|09|yqtbedbhz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133706; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yqwtk.cc"; content:"|05|yqwtk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133707; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yqybykkajfh.com"; content:"|0b|yqybykkajfh|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133708; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yqyexlgpz.cn"; content:"|09|yqyexlgpz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133709; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yrbfi.com"; content:"|05|yrbfi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133710; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yrbnhkdlxzt.ws"; content:"|0b|yrbnhkdlxzt|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133711; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yrdcwi.ws"; content:"|06|yrdcwi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133712; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yrewowur.cc"; content:"|08|yrewowur|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133713; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yrgcmu.net"; content:"|06|yrgcmu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133714; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yrinxisdg.info"; content:"|09|yrinxisdg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133715; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yrpgqoqu.info"; content:"|08|yrpgqoqu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133716; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yrrutgq.org"; content:"|07|yrrutgq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133717; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yrthnvyrmdt.net"; content:"|0b|yrthnvyrmdt|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133718; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yrvdzk.cn"; content:"|06|yrvdzk|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133719; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yrvuhpuc.ws"; content:"|08|yrvuhpuc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133720; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yrwckmdl.net"; content:"|08|yrwckmdl|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133721; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yrzpmc.net"; content:"|06|yrzpmc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133722; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ysakp.com"; content:"|05|ysakp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133723; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ysbavwcm.biz"; content:"|08|ysbavwcm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133724; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yscuxpho.com"; content:"|08|yscuxpho|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133725; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ysebebh.ws"; content:"|07|ysebebh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133726; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yseyfv.net"; content:"|06|yseyfv|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133727; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ysfuiqst.info"; content:"|08|ysfuiqst|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133728; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yshaza.cc"; content:"|06|yshaza|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133729; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ysidbmhi.org"; content:"|08|ysidbmhi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133730; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yslqppecdy.biz"; content:"|0a|yslqppecdy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133731; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ysnmfhhcf.ws"; content:"|09|ysnmfhhcf|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133732; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yspvsbznejc.cc"; content:"|0b|yspvsbznejc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133733; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ysqlxmr.info"; content:"|07|ysqlxmr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133734; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ysuxhh.org"; content:"|06|ysuxhh|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133735; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ysyaeqbjzg.biz"; content:"|0a|ysyaeqbjzg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133736; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ytbmxzkdgk.org"; content:"|0a|ytbmxzkdgk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133737; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ytcagtse.cn"; content:"|08|ytcagtse|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133738; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ytddxgfjb.cc"; content:"|09|ytddxgfjb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133739; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ytdvsfuib.org"; content:"|09|ytdvsfuib|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133740; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ytfzqilyi.biz"; content:"|09|ytfzqilyi|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133741; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ytjlen.cc"; content:"|06|ytjlen|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133742; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ytqvefzgxa.ws"; content:"|0a|ytqvefzgxa|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133743; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yuahomj.com"; content:"|07|yuahomj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133744; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yufqprkpnsf.info"; content:"|0b|yufqprkpnsf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133745; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yuirssu.biz"; content:"|07|yuirssu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133746; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yujnjqjse.info"; content:"|09|yujnjqjse|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133747; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yumhjdufns.info"; content:"|0a|yumhjdufns|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133748; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yunanzx.cc"; content:"|07|yunanzx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133749; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yurewvc.cn"; content:"|07|yurewvc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133750; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yusgncpgt.cn"; content:"|09|yusgncpgt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133751; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yutmabqjlu.org"; content:"|0a|yutmabqjlu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133752; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yvadbxck.com"; content:"|08|yvadbxck|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133753; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yvlkxvd.cc"; content:"|07|yvlkxvd|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133754; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yvrmznz.ws"; content:"|07|yvrmznz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133755; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yvwag.ws"; content:"|05|yvwag|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133756; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yvxzn.info"; content:"|05|yvxzn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133757; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yvytooia.ws"; content:"|08|yvytooia|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133758; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yvyyovfzglu.biz"; content:"|0b|yvyyovfzglu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133759; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ywaeiheb.biz"; content:"|08|ywaeiheb|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133760; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ywckrimplau.cn"; content:"|0b|ywckrimplau|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133761; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ywdfbq.org"; content:"|06|ywdfbq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133762; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ywdrwurh.cn"; content:"|08|ywdrwurh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133763; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ywilexikc.com"; content:"|09|ywilexikc|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133764; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ywnhkpcpgee.cc"; content:"|0b|ywnhkpcpgee|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133765; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ywzlkcp.net"; content:"|07|ywzlkcp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133766; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yxaauxux.ws"; content:"|08|yxaauxux|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133767; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yxbrec.net"; content:"|06|yxbrec|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133768; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yxicsi.com"; content:"|06|yxicsi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133769; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yxksjp.ws"; content:"|06|yxksjp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133770; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yxmqplyne.info"; content:"|09|yxmqplyne|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133771; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yxpetpqwrmi.ws"; content:"|0b|yxpetpqwrmi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133772; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yxsepqiarq.cn"; content:"|0a|yxsepqiarq|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133773; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yxtiia.net"; content:"|06|yxtiia|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133774; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yxtjcrd.com"; content:"|07|yxtjcrd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133775; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yxuyut.com"; content:"|06|yxuyut|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133776; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yxvpevtjyld.ws"; content:"|0b|yxvpevtjyld|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133777; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yxwnwn.cn"; content:"|06|yxwnwn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133778; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yxxvynxrrc.net"; content:"|0a|yxxvynxrrc|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133779; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yxzklmdk.net"; content:"|08|yxzklmdk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133780; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yyajfcpyg.cn"; content:"|09|yyajfcpyg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133781; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yyaydupm.ws"; content:"|08|yyaydupm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133782; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yycmccfi.com"; content:"|08|yycmccfi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133783; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yycmfdoctbo.net"; content:"|0b|yycmfdoctbo|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133784; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yydso.cn"; content:"|05|yydso|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133785; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yyiglvvpw.org"; content:"|09|yyiglvvpw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133786; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yyivf.net"; content:"|05|yyivf|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133787; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yyjbeywcfn.cc"; content:"|0a|yyjbeywcfn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133788; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yyjpjnaeph.biz"; content:"|0a|yyjpjnaeph|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133789; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yylgyq.org"; content:"|06|yylgyq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133790; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yylsjrg.cn"; content:"|07|yylsjrg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133791; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yymte.cc"; content:"|05|yymte|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133792; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yyoviysa.com"; content:"|08|yyoviysa|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133793; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yywxvwexbr.cn"; content:"|0a|yywxvwexbr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133794; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yyyqaqlm.org"; content:"|08|yyyqaqlm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133795; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yzdatvla.com"; content:"|08|yzdatvla|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133796; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yzekqdhy.cn"; content:"|08|yzekqdhy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133797; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yzinlwjnk.cc"; content:"|09|yzinlwjnk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133798; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yzjdtpnm.ws"; content:"|08|yzjdtpnm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133799; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yzjohginc.cc"; content:"|09|yzjohginc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133800; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yzlbxeaza.ws"; content:"|09|yzlbxeaza|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133801; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yzleypgz.cn"; content:"|08|yzleypgz|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133802; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yznngzisqty.ws"; content:"|0b|yznngzisqty|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133803; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yzohm.org"; content:"|05|yzohm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133804; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yzojm.biz"; content:"|05|yzojm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133805; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yzrifnmukv.info"; content:"|0a|yzrifnmukv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133806; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yzudycfi.info"; content:"|08|yzudycfi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133807; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yzwehez.cc"; content:"|07|yzwehez|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133808; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yzweshaj.cc"; content:"|08|yzweshaj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133809; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yzxlo.biz"; content:"|05|yzxlo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133810; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yzywkn.biz"; content:"|06|yzywkn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133811; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yzzerluzfm.ws"; content:"|0a|yzzerluzfm|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133812; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain yzzgmzrklh.cc"; content:"|0a|yzzgmzrklh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133813; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zacmgz.ws"; content:"|06|zacmgz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133814; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zacmrunkdgy.org"; content:"|0b|zacmrunkdgy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133815; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zahqcgizo.biz"; content:"|09|zahqcgizo|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133816; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zaoycymp.biz"; content:"|08|zaoycymp|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133817; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zaplicub.net"; content:"|08|zaplicub|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133818; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zarozmg.cn"; content:"|07|zarozmg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133819; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zasquv.info"; content:"|06|zasquv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133820; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zatvtwot.net"; content:"|08|zatvtwot|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133821; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zavmb.ws"; content:"|05|zavmb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133822; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zbdbeaaq.ws"; content:"|08|zbdbeaaq|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133823; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zbdsyvs.org"; content:"|07|zbdsyvs|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133824; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zbevmvzw.org"; content:"|08|zbevmvzw|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133825; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zbgnrk.info"; content:"|06|zbgnrk|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133826; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zbiajjb.cn"; content:"|07|zbiajjb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133827; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zbiewrmmzep.ws"; content:"|0b|zbiewrmmzep|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133828; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zblmqh.cc"; content:"|06|zblmqh|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133829; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zbmxatm.com"; content:"|07|zbmxatm|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133830; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zboppntrtwt.cc"; content:"|0b|zboppntrtwt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133831; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zbour.biz"; content:"|05|zbour|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133832; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zboycplmkhc.cc"; content:"|0b|zboycplmkhc|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133833; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zbslidcvit.ws"; content:"|0a|zbslidcvit|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133834; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zbugoulmg.info"; content:"|09|zbugoulmg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133835; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zcarilbcqr.org"; content:"|0a|zcarilbcqr|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133836; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zcavyqnqpl.ws"; content:"|0a|zcavyqnqpl|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133837; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zcbsjuzm.cn"; content:"|08|zcbsjuzm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133838; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zcechlasbx.net"; content:"|0a|zcechlasbx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133839; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zcefs.org"; content:"|05|zcefs|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133840; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zcfvtlsjvr.ws"; content:"|0a|zcfvtlsjvr|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133841; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zciyretl.cn"; content:"|08|zciyretl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133842; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zckdb.cc"; content:"|05|zckdb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133843; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zclryxi.info"; content:"|07|zclryxi|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133844; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zctibhw.info"; content:"|07|zctibhw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133845; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zcutlqarzlc.biz"; content:"|0b|zcutlqarzlc|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133846; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zcyucto.org"; content:"|07|zcyucto|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133847; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zczeirxt.cn"; content:"|08|zczeirxt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133848; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zdazqvhocb.cc"; content:"|0a|zdazqvhocb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133849; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zddomeoygh.net"; content:"|0a|zddomeoygh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133850; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zdhbshwfrqz.net"; content:"|0b|zdhbshwfrqz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133851; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zdksja.info"; content:"|06|zdksja|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133852; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zdmbenveex.cn"; content:"|0a|zdmbenveex|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133853; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zdnqmsqfs.org"; content:"|09|zdnqmsqfs|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133854; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zdstty.cc"; content:"|06|zdstty|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133855; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zdzkzq.cc"; content:"|06|zdzkzq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133856; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zebpn.biz"; content:"|05|zebpn|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133857; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zebyj.cc"; content:"|05|zebyj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133858; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zefigoxg.net"; content:"|08|zefigoxg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133859; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zegjit.biz"; content:"|06|zegjit|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133860; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zeherorl.biz"; content:"|08|zeherorl|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133861; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zeljmeno.cc"; content:"|08|zeljmeno|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133862; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zeltfcskzj.com"; content:"|0a|zeltfcskzj|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133863; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zeotq.net"; content:"|05|zeotq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133864; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zetuoy.biz"; content:"|06|zetuoy|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133865; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zfavkfjx.ws"; content:"|08|zfavkfjx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133866; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zfgpodz.cc"; content:"|07|zfgpodz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133867; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zfhvmnb.ws"; content:"|07|zfhvmnb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133868; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zfjvhdlj.cc"; content:"|08|zfjvhdlj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133869; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zfkioxrnhy.cn"; content:"|0a|zfkioxrnhy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133870; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zfkoysimxg.org"; content:"|0a|zfkoysimxg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133871; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zfmocyjbic.ws"; content:"|0a|zfmocyjbic|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133872; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zfmpafgwj.cc"; content:"|09|zfmpafgwj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133873; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zftdulye.cc"; content:"|08|zftdulye|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133874; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zfyfunk.org"; content:"|07|zfyfunk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133875; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zfyihnrwg.biz"; content:"|09|zfyihnrwg|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133876; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zgazgcb.cc"; content:"|07|zgazgcb|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133877; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zgcmjtro.org"; content:"|08|zgcmjtro|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133878; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zggdwl.info"; content:"|06|zggdwl|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133879; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zgggppln.info"; content:"|08|zgggppln|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133880; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zggltknyouj.info"; content:"|0b|zggltknyouj|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133881; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zgiqtq.org"; content:"|06|zgiqtq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133882; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zgmaqgdwqqv.com"; content:"|0b|zgmaqgdwqqv|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133883; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zgooyq.org"; content:"|06|zgooyq|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133884; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zgqekvtm.cn"; content:"|08|zgqekvtm|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133885; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zgqutsstjmq.biz"; content:"|0b|zgqutsstjmq|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133886; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zgrgiwg.org"; content:"|07|zgrgiwg|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133887; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zgroktdeu.biz"; content:"|09|zgroktdeu|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133888; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zgtysu.org"; content:"|06|zgtysu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133889; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zgymxn.cn"; content:"|06|zgymxn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133890; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zhajnucx.biz"; content:"|08|zhajnucx|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133891; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zharbzer.cn"; content:"|08|zharbzer|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133892; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zhcqdyn.com"; content:"|07|zhcqdyn|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133893; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zhexbhrlzvj.cc"; content:"|0b|zhexbhrlzvj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133894; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zhjiigeghhh.ws"; content:"|0b|zhjiigeghhh|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133895; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zhjyjoofqlq.info"; content:"|0b|zhjyjoofqlq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133896; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zhorlp.net"; content:"|06|zhorlp|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133897; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zhtasm.org"; content:"|06|zhtasm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133898; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zhwchtai.org"; content:"|08|zhwchtai|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133899; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zhyzvapzcjp.ws"; content:"|0b|zhyzvapzcjp|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133900; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zhzewpi.org"; content:"|07|zhzewpi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133901; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zhzgijco.com"; content:"|08|zhzgijco|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133902; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zicumelxge.net"; content:"|0a|zicumelxge|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133903; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zimdpyj.biz"; content:"|07|zimdpyj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133904; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zinypi.com"; content:"|06|zinypi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133905; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ziqnyn.net"; content:"|06|ziqnyn|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133906; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zirhbkaz.biz"; content:"|08|zirhbkaz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133907; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zirzrofbz.net"; content:"|09|zirzrofbz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133908; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ziwhnrnrov.biz"; content:"|0a|ziwhnrnrov|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133909; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zjchlyi.org"; content:"|07|zjchlyi|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133910; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zjiviv.cc"; content:"|06|zjiviv|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133911; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zjjxdtnujmh.info"; content:"|0b|zjjxdtnujmh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133912; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zjnccjub.org"; content:"|08|zjnccjub|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133913; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zjuhmu.ws"; content:"|06|zjuhmu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133914; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zjwwq.net"; content:"|05|zjwwq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133915; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zjxpwpgxkfq.info"; content:"|0b|zjxpwpgxkfq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133916; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zkgcfaueaeh.cn"; content:"|0b|zkgcfaueaeh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133917; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zkgqzaj.ws"; content:"|07|zkgqzaj|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133918; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zkuvdy.org"; content:"|06|zkuvdy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133919; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zkwkzokp.com"; content:"|08|zkwkzokp|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133920; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zkzoxh.cn"; content:"|06|zkzoxh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133921; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zlamablafs.com"; content:"|0a|zlamablafs|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133922; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zlbbdijtaw.net"; content:"|0a|zlbbdijtaw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133923; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zldvitucgr.net"; content:"|0a|zldvitucgr|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133924; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zlgawvn.ws"; content:"|07|zlgawvn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133925; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zliqzcgfs.cc"; content:"|09|zliqzcgfs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133926; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zllecr.biz"; content:"|06|zllecr|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133927; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zlpfgipqu.org"; content:"|09|zlpfgipqu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133928; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zlplfbredw.cn"; content:"|0a|zlplfbredw|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133929; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zlppnkvr.info"; content:"|08|zlppnkvr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133930; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zlqmzbokhz.biz"; content:"|0a|zlqmzbokhz|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133931; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zlxdfhppqfa.cn"; content:"|0b|zlxdfhppqfa|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133932; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zlyjz.ws"; content:"|05|zlyjz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133933; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zmfyxvjqk.cc"; content:"|09|zmfyxvjqk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133934; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zmgysq.net"; content:"|06|zmgysq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133935; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zmnhqjcb.ws"; content:"|08|zmnhqjcb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133936; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zmqsofn.info"; content:"|07|zmqsofn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133937; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zmrhggnywy.net"; content:"|0a|zmrhggnywy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133938; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zmruw.ws"; content:"|05|zmruw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133939; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zmshkisthaw.ws"; content:"|0b|zmshkisthaw|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133940; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zmuqkyeiz.ws"; content:"|09|zmuqkyeiz|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133941; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain znibgzjx.info"; content:"|08|znibgzjx|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133942; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain znikwuy.net"; content:"|07|znikwuy|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133943; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain znirdem.cn"; content:"|07|znirdem|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133944; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain znjziqkc.cn"; content:"|08|znjziqkc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133945; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain znkbbrhlf.cc"; content:"|09|znkbbrhlf|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133946; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain znmbbkqb.cn"; content:"|08|znmbbkqb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133947; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain znoqzcykmgb.com"; content:"|0b|znoqzcykmgb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133948; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain znptaqencjo.cc"; content:"|0b|znptaqencjo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133949; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain znswtrgjvmd.ws"; content:"|0b|znswtrgjvmd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133950; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zntip.cn"; content:"|05|zntip|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133951; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain znuogf.info"; content:"|06|znuogf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133952; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain znveqe.cc"; content:"|06|znveqe|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133953; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain znxmxzanms.biz"; content:"|0a|znxmxzanms|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133954; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain znyzflhjde.biz"; content:"|0a|znyzflhjde|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133955; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain znzfmv.info"; content:"|06|znzfmv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133956; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zocgpgbixi.net"; content:"|0a|zocgpgbixi|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133957; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zodrx.cc"; content:"|05|zodrx|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133958; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zofophmu.ws"; content:"|08|zofophmu|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133959; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zoirzz.info"; content:"|06|zoirzz|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133960; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zojeum.org"; content:"|06|zojeum|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133961; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zokdnf.org"; content:"|06|zokdnf|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133962; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zomtxafd.com"; content:"|08|zomtxafd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133963; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zonvom.org"; content:"|06|zonvom|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133964; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zopdwi.ws"; content:"|06|zopdwi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133965; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zoptbj.cc"; content:"|06|zoptbj|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133966; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zoqlwoqdg.info"; content:"|09|zoqlwoqdg|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133967; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zozytj.biz"; content:"|06|zozytj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133968; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zpgyjthkw.info"; content:"|09|zpgyjthkw|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133969; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zpkltchysba.info"; content:"|0b|zpkltchysba|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133970; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zplvwmajnuq.info"; content:"|0b|zplvwmajnuq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133971; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zpqcdldqarz.net"; content:"|0b|zpqcdldqarz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133972; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zpryh.info"; content:"|05|zpryh|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133973; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zptgambnz.com"; content:"|09|zptgambnz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133974; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zpvedw.net"; content:"|06|zpvedw|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133975; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zpyrfuwg.net"; content:"|08|zpyrfuwg|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133976; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zqawkfefpqo.org"; content:"|0b|zqawkfefpqo|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133977; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zqcvteljuex.cn"; content:"|0b|zqcvteljuex|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133978; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zqdxzzes.org"; content:"|08|zqdxzzes|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133979; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zqhgb.ws"; content:"|05|zqhgb|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133980; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zqibkk.cc"; content:"|06|zqibkk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133981; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zqjulbsu.info"; content:"|08|zqjulbsu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133982; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zqmwypunqap.cn"; content:"|0b|zqmwypunqap|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133983; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zqoldhzbs.biz"; content:"|09|zqoldhzbs|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133984; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zqpupd.cc"; content:"|06|zqpupd|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133985; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zqpzelsm.org"; content:"|08|zqpzelsm|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133986; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zqtaxae.info"; content:"|07|zqtaxae|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133987; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zqtbdube.biz"; content:"|08|zqtbdube|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133988; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zqvjb.info"; content:"|05|zqvjb|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133989; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zrczd.net"; content:"|05|zrczd|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133990; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zrdbhbdg.cc"; content:"|08|zrdbhbdg|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133991; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zrhpzz.net"; content:"|06|zrhpzz|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133992; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zrjambdjy.cc"; content:"|09|zrjambdjy|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133993; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zrjnqly.info"; content:"|07|zrjnqly|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133994; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zrmcuychv.info"; content:"|09|zrmcuychv|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133995; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zrmgk.net"; content:"|05|zrmgk|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133996; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zrohbfsu.org"; content:"|08|zrohbfsu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133997; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zrotsttd.ws"; content:"|08|zrotsttd|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133998; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zrounfrwy.ws"; content:"|09|zrounfrwy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1133999; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zrqbocaj.biz"; content:"|08|zrqbocaj|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134000; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zrqxa.biz"; content:"|05|zrqxa|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134001; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zrugt.biz"; content:"|05|zrugt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134002; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zrvabaekbr.com"; content:"|0a|zrvabaekbr|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134003; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zrvkvs.ws"; content:"|06|zrvkvs|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134004; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zryuanve.com"; content:"|08|zryuanve|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134005; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zrzzvqkiip.biz"; content:"|0a|zrzzvqkiip|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134006; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zsjan.cc"; content:"|05|zsjan|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134007; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zsjevzi.cn"; content:"|07|zsjevzi|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134008; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zsjijn.cc"; content:"|06|zsjijn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134009; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zskbwzk.cc"; content:"|07|zskbwzk|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134010; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zskwb.org"; content:"|05|zskwb|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134011; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zsonstovgzr.info"; content:"|0b|zsonstovgzr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134012; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zsozqzljko.org"; content:"|0a|zsozqzljko|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134013; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ztajzcyxnf.com"; content:"|0a|ztajzcyxnf|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134014; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ztaoghqsbs.cc"; content:"|0a|ztaoghqsbs|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134015; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ztfxuvm.cc"; content:"|07|ztfxuvm|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134016; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ztkxgblm.biz"; content:"|08|ztkxgblm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134017; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ztlguc.ws"; content:"|06|ztlguc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134018; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ztlwmkfvkjf.info"; content:"|0b|ztlwmkfvkjf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134019; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ztlxpe.cc"; content:"|06|ztlxpe|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134020; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ztmeexmr.info"; content:"|08|ztmeexmr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134021; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ztmje.info"; content:"|05|ztmje|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134022; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ztmoiqwxnn.cc"; content:"|0a|ztmoiqwxnn|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134023; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ztxxnjh.cn"; content:"|07|ztxxnjh|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134024; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ztyikz.com"; content:"|06|ztyikz|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134025; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain ztzdqvtzi.com"; content:"|09|ztzdqvtzi|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134026; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zudeixyz.org"; content:"|08|zudeixyz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134027; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zudrgvb.com"; content:"|07|zudrgvb|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134028; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zugsqsq.net"; content:"|07|zugsqsq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134029; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zunfg.cn"; content:"|05|zunfg|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134030; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zuqphtnsho.com"; content:"|0a|zuqphtnsho|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134031; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zuqyzsg.com"; content:"|07|zuqyzsg|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134032; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zutkhvyph.info"; content:"|09|zutkhvyph|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134033; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zuttvy.org"; content:"|06|zuttvy|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134034; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zuyviu.org"; content:"|06|zuyviu|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134035; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zuzuyrqpmxr.info"; content:"|0b|zuzuyrqpmxr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134036; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zviix.cc"; content:"|05|zviix|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134037; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zviyvvu.info"; content:"|07|zviyvvu|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134038; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zvrqxial.com"; content:"|08|zvrqxial|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134039; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zvujsrwucg.ws"; content:"|0a|zvujsrwucg|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134040; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zvuvmgeo.com"; content:"|08|zvuvmgeo|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134041; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zvxiohgelf.cn"; content:"|0a|zvxiohgelf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134042; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zwbogzmc.ws"; content:"|08|zwbogzmc|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134043; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zwezoxmp.org"; content:"|08|zwezoxmp|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134044; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zwhllx.ws"; content:"|06|zwhllx|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134045; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zwirtk.org"; content:"|06|zwirtk|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134046; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zwmckv.ws"; content:"|06|zwmckv|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134047; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zwmlovmt.cn"; content:"|08|zwmlovmt|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134048; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zwrjwamz.org"; content:"|08|zwrjwamz|03|org"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134049; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zwtgmzrwma.cc"; content:"|0a|zwtgmzrwma|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134050; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zwttfhf.info"; content:"|07|zwttfhf|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134051; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zwunba.com"; content:"|06|zwunba|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134052; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zwvumtgoal.ws"; content:"|0a|zwvumtgoal|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134053; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zwyduga.ws"; content:"|07|zwyduga|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134054; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zxajzsixs.cn"; content:"|09|zxajzsixs|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134055; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zxcbkiise.cn"; content:"|09|zxcbkiise|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134056; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zxfqvzxi.ws"; content:"|08|zxfqvzxi|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134057; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zxkcax.cc"; content:"|06|zxkcax|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134058; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zxkrt.biz"; content:"|05|zxkrt|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134059; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zxlpnul.biz"; content:"|07|zxlpnul|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134060; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zxrjkxy.ws"; content:"|07|zxrjkxy|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134061; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zxsrni.cn"; content:"|06|zxsrni|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134062; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zxwaexvh.net"; content:"|08|zxwaexvh|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134063; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zxxno.biz"; content:"|05|zxxno|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134064; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zxzambd.com"; content:"|07|zxzambd|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134065; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zyeonc.cn"; content:"|06|zyeonc|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134066; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zyghrku.info"; content:"|07|zyghrku|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134067; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zygibeq.net"; content:"|07|zygibeq|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134068; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zygrxwct.cc"; content:"|08|zygrxwct|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134069; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zyiohipakcn.info"; content:"|0b|zyiohipakcn|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134070; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zyjigaurnni.biz"; content:"|0b|zyjigaurnni|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134071; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zykimwbbtqp.cn"; content:"|0b|zykimwbbtqp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134072; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zyotkfbrybu.net"; content:"|0b|zyotkfbrybu|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134073; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zypudl.cc"; content:"|06|zypudl|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134074; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zyronm.biz"; content:"|06|zyronm|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134075; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zytrjibjoiv.biz"; content:"|0b|zytrjibjoiv|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134076; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zyvremmn.ws"; content:"|08|zyvremmn|02|ws"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134077; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zywwigoqzh.biz"; content:"|0a|zywwigoqzh|03|biz"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134078; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zyxtnoyl.cn"; content:"|08|zyxtnoyl|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134079; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zyydopur.com"; content:"|08|zyydopur|03|com"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134080; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zzbuvjcz.cc"; content:"|08|zzbuvjcz|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134081; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zzeeqsgt.cc"; content:"|08|zzeeqsgt|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134082; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zzimgszj.net"; content:"|08|zzimgszj|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134083; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zzlay.cn"; content:"|05|zzlay|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134084; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zzmxeytsr.info"; content:"|09|zzmxeytsr|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134085; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zzoxyjeo.cc"; content:"|08|zzoxyjeo|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134086; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zzpvqqq.info"; content:"|07|zzpvqqq|04|info"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134087; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zzubgfjx.net"; content:"|08|zzubgfjx|03|net"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134088; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zzuljlnmlbq.cc"; content:"|0b|zzuljlnmlbq|02|cc"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134089; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host looking for conficker domain zzycqxtf.cn"; content:"|08|zzycqxtf|02|cn"; nocase; classtype:trojan-activity; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_al.shtml; reference:url,www.kb.cert.org/vuls/id/493881; sid:1134090; rev:3;)