alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP Ezula Installer Download"; flow:established,to_client; file.data; content:"|65 5a 75 6c 61 20 49 6e 73 74 61 6c 6c 61 74 69 6f 6e 00 49|"; reference:url,www.ezula.com; reference:url,www.spyany.com/program/article_spw_rm_eZuLa.html; classtype:pup-activity; sid:2001335; rev:12; metadata:created_at 2010_07_30, confidence High, signature_severity Minor, updated_at 2024_04_11;)