alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu.bbtu01.cn"; content:"|05|baidu|06|bbtu01|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097091; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu.bbtu02.cn"; content:"|05|baidu|06|bbtu02|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097092; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu.bbtu03.cn"; content:"|05|baidu|06|bbtu03|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097093; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu.bbtu04.cn"; content:"|05|baidu|06|bbtu04|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097094; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu.bbtu05.cn"; content:"|05|baidu|06|bbtu05|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097095; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu.bbtu06.cn"; content:"|05|baidu|06|bbtu06|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097096; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu.bbtu07.cn"; content:"|05|baidu|06|bbtu07|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097097; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-baiduxin1.cn"; content:"|0f|baidu-baiduxin1|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097098; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-baiduxin3.cn"; content:"|0f|baidu-baiduxin3|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097099; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-baiduxin4.cn"; content:"|0f|baidu-baiduxin4|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097100; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-baiduxin5.cn"; content:"|0f|baidu-baiduxin5|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097101; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-baiduxin6.cn"; content:"|0f|baidu-baiduxin6|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097102; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-baiduxin7.cn"; content:"|0f|baidu-baiduxin7|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097103; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-baiduxin8.cn"; content:"|0f|baidu-baiduxin8|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097104; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-baiduxin9.cn"; content:"|0f|baidu-baiduxin9|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097105; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-baiduzi1.cn"; content:"|0e|baidu-baiduzi1|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097106; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-baiduzi2.cn"; content:"|0e|baidu-baiduzi2|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097107; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-baiduzi3.cn"; content:"|0e|baidu-baiduzi3|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097108; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-baiduzi4.cn"; content:"|0e|baidu-baiduzi4|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097109; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-baiduzi5.cn"; content:"|0e|baidu-baiduzi5|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097110; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-baiduzi6.cn"; content:"|0e|baidu-baiduzi6|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097111; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-baiduzi7.cn"; content:"|0e|baidu-baiduzi7|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097112; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-baiduzi8.cn"; content:"|0e|baidu-baiduzi8|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097113; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-du1.cn"; content:"|09|baidu-du1|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097114; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-du2.cn"; content:"|09|baidu-du2|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097115; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-du3.cn"; content:"|09|baidu-du3|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097116; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-du4.cn"; content:"|09|baidu-du4|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097117; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-du5.cn"; content:"|09|baidu-du5|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097118; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-du6.cn"; content:"|09|baidu-du6|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097119; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-du7.cn"; content:"|09|baidu-du7|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097120; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-du8.cn"; content:"|09|baidu-du8|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097121; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu-du9.cn"; content:"|09|baidu-du9|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097122; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwrnm1.cn"; content:"|08|sllwrnm1|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097123; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwrnm2.cn"; content:"|08|sllwrnm2|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097124; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwrnm4.cn"; content:"|08|sllwrnm4|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097125; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwrnm5.cn"; content:"|08|sllwrnm5|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097126; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwrnm6.cn"; content:"|08|sllwrnm6|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097127; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwrnm7.cn"; content:"|08|sllwrnm7|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097128; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwrnm8.cn"; content:"|08|sllwrnm8|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097129; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwrnm9.cn"; content:"|08|sllwrnm9|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097130; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwrnm10.cn"; content:"|09|sllwrnm10|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097131; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwbd1.cn"; content:"|07|sllwbd1|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097132; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwbd2.cn"; content:"|07|sllwbd2|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097133; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwbd3.cn"; content:"|07|sllwbd3|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097134; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwbd4.cn"; content:"|07|sllwbd4|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097135; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwbd5.cn"; content:"|07|sllwbd5|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097136; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwbd6.cn"; content:"|07|sllwbd6|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097137; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwbd7.cn"; content:"|07|sllwbd7|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097138; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwbd8.cn"; content:"|07|sllwbd8|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097139; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwbd9.cn"; content:"|07|sllwbd9|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097140; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sllwbd10.cn"; content:"|08|sllwbd10|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097141; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup zlwrnm5.cn"; content:"|07|zlwrnm5|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097142; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup zlwrnm7.cn"; content:"|07|zlwrnm7|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097143; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup zlwrnm8.cn"; content:"|07|zlwrnm8|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097144; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup zlwrnm9.cn"; content:"|07|zlwrnm9|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097145; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup zlwrnm10.cn"; content:"|08|zlwrnm10|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097146; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup zlwrnm11.cn"; content:"|08|zlwrnm11|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097147; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup zlwrnm12.cn"; content:"|08|zlwrnm12|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097148; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup zlwrnm13.cn"; content:"|08|zlwrnm13|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097149; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup zlwrnm14.cn"; content:"|08|zlwrnm14|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097150; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup zlwrnm15.cn"; content:"|08|zlwrnm15|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097151; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup zlwrnm17.cn"; content:"|08|zlwrnm17|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097152; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup zlwrnm18.cn"; content:"|08|zlwrnm18|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097153; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup zlwrnm19.cn"; content:"|08|zlwrnm19|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097154; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup zlwrnm20.cn"; content:"|08|zlwrnm20|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097155; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup 360avva.akvvv.cn"; content:"|07|360avva|05|akvvv|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097156; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup vip.4s3w.cn"; content:"|03|vip|04|4s3w|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097157; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup cc4y7.cn"; content:"|05|cc4y7|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097158; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup hhhh8886.cn"; content:"|08|hhhh8886|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097159; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup qqqqttrr.cn"; content:"|08|qqqqttrr|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097160; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup rrrrrrryyy.cn"; content:"|0a|rrrrrrryyy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097161; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup wwwwyyyyy.cn"; content:"|09|wwwwyyyyy|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097162; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup fyesn.cn"; content:"|05|fyesn|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097163; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu.baibai1.cn"; content:"|05|baidu|07|baibai1|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097164; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu.xinlang1.cn"; content:"|05|baidu|08|xinlang1|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097165; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup cc4y6.cn"; content:"|05|cc4y6|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097166; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup cc4y8.cn"; content:"|05|cc4y8|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097167; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup cc4y1.cn"; content:"|05|cc4y1|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097168; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup cc4y2.cn"; content:"|05|cc4y2|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097169; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup cc4y3.cn"; content:"|05|cc4y3|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097170; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup cc4y4.cn"; content:"|05|cc4y4|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097171; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup cc4y5.cn"; content:"|05|cc4y5|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097172; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup cc4y9.cn"; content:"|05|cc4y9|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097173; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu.baibai2.cn"; content:"|05|baidu|07|baibai2|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097174; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu.baibai3.cn"; content:"|05|baidu|07|baibai3|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097175; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu.baibai4.cn"; content:"|05|baidu|07|baibai4|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097176; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu.baibai5.cn"; content:"|05|baidu|07|baibai5|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097177; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu.xinlang2.cn"; content:"|05|baidu|08|xinlang2|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097178; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu.xinlang3.cn"; content:"|05|baidu|08|xinlang3|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097179; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu.xinlang4.cn"; content:"|05|baidu|08|xinlang4|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097180; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu.baibai1.cn"; content:"|05|baidu|07|baibai1|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097181; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup baidu.xinlang1.cn"; content:"|05|baidu|08|xinlang1|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097182; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup cc4y6.cn"; content:"|05|cc4y6|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097183; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup cc4y8.cn"; content:"|05|cc4y8|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097184; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup www.17gamo.com"; content:"|03|www|06|17gamo|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097185; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup www.comefood.com"; content:"|03|www|08|comefood|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097186; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup bzka.3322.org"; content:"|04|bzka|04|3322|03|org"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097187; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup lianrong.com.cn"; content:"|08|lianrong|03|com|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097188; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup doubleluck.com.cn"; content:"|0a|doubleluck|03|com|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097189; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup dingli.net"; content:"|06|dingli|03|net"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097190; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup www.mianfei58.cn"; content:"|03|www|09|mianfei58|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097191; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup www.yhgames.com"; content:"|03|www|07|yhgames|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097192; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup iuwei.com"; content:"|05|iuwei|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097193; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup www.6dsoft.cn"; content:"|03|www|06|6dsoft|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097194; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup w.c66i.cn"; content:"|01|w|04|c66i|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097195; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup b81.8800.org"; content:"|03|b81|04|8800|03|org"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097196; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup vw.wd2a.cn"; content:"|02|vw|04|wd2a|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097197; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup 927.bigwww.com"; content:"|03|927|06|bigwww|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097198; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup h3hs4.cn"; content:"|05|h3hs4|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097199; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup buxhere.com"; content:"|07|buxhere|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097200; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup 517wyt.com"; content:"|06|517wyt|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097201; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup vw.wd2a.cn"; content:"|02|vw|04|wd2a|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097202; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup 927.bigwww.com"; content:"|03|927|06|bigwww|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097203; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup h3hs4.cn"; content:"|05|h3hs4|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097204; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup buxhere.com"; content:"|07|buxhere|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097205; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup 517wyt.com"; content:"|06|517wyt|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097206; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup vw.wd2a.cn"; content:"|02|vw|04|wd2a|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097207; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup 927.bigwww.com"; content:"|03|927|06|bigwww|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097208; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup h3hs4.cn"; content:"|05|h3hs4|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097209; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup buxhere.com"; content:"|07|buxhere|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097210; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup 517wyt.com"; content:"|06|517wyt|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097211; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup googlehk.3322.org"; content:"|08|googlehk|04|3322|03|org"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097212; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup congs.zziyuan.com"; content:"|05|congs|07|zziyuan|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097213; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup cookie7.cn"; content:"|07|cookie7|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097214; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup mm.hacker315.cn"; content:"|02|mm|09|hacker315|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097215; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup ak136.justcctv6.cn"; content:"|05|ak136|09|justcctv6|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097216; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup china-jinpin.com"; content:"|0c|china-jinpin|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097217; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup 1ku.cn"; content:"|03|1ku|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097218; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup kkkkppp.cn"; content:"|07|kkkkppp|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097219; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup ptxk.com"; content:"|04|ptxk|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097220; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup 1ku.cn"; content:"|03|1ku|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097221; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup 97.zjz-004.com"; content:"|02|97|07|zjz-004|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097222; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup ok16899.cn"; content:"|07|ok16899|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097223; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup entmba.com"; content:"|06|entmba|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097224; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup cznutchuei.cn"; content:"|0a|cznutchuei|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097225; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup dmc.hb.cn"; content:"|03|dmc|02|hb|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097226; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup mba.beisen.com"; content:"|03|mba|06|beisen|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097227; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup worldvedrcoo.com"; content:"|0c|worldvedrcoo|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097228; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sothink1.cn"; content:"|08|sothink1|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097229; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sothink2.cn"; content:"|08|sothink2|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097230; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sothink3.cn"; content:"|08|sothink3|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097231; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sothink4.cn"; content:"|08|sothink4|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097232; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sothink5.cn"; content:"|08|sothink5|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097233; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sothink6.cn"; content:"|08|sothink6|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097234; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sothink7.cn"; content:"|08|sothink7|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097235; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sothink8.cn"; content:"|08|sothink8|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097236; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sothink9.cn"; content:"|08|sothink9|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097237; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup sothink10.cn"; content:"|09|sothink10|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097238; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup s.ardoshanghai.com"; content:"|01|s|0c|ardoshanghai|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097239; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup wieyou.com"; content:"|06|wieyou|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097240; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup abcrot.cn"; content:"|06|abcrot|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097241; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup ak136.justbt1.cn"; content:"|05|ak136|07|justbt1|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097242; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup www.golfinau.com"; content:"|03|www|08|golfinau|03|com"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097243; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup w.c66b.cn"; content:"|01|w|04|c66b|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097244; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup w.c66d.cn"; content:"|01|w|04|c66d|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097245; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup w.c66f.cn"; content:"|01|w|04|c66f|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097246; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup w.c66g.cn"; content:"|01|w|04|c66g|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097247; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup jcl-0006.cn"; content:"|08|jcl-0006|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097248; rev:3;)
alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"MALWARE Inside host may be infected with IE7 worm Dec2008 based on DNS lookup jcl-0007.cn"; content:"|08|jcl-0007|02|cn"; nocase; classtype:trojan-activity; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210; reference:url,www.kb.cert.org/vuls/id/493881; sid:1097249; rev:3;)