alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "BLEEDING-EDGE VIRUS Zafi.d
P2P? Infection Attempt (2)"; flow: established; content:"ICQ 2005A NEW!.EXE"; nocase; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_ZAFI.D; classtype: trojan-activity; sid: 2001593; rev:6; )