# bogus-virus-warnings.cf version 1.160 (2005-06-22) - NB new Rules Emporium address
# NB (2005-06-07) I still have a backlog of submissions so if yours hasn't 
#   made it in yet, it's nothing personal. Bear with me - thanks, TJ.

# Collated and maintained by Tim Jackson (tim@timj.co.uk)
# Latest version at: 
#
#  - http://www.rulesemporium.com/rules/bogus-virus-warnings.cf
#  - http://www.timj.co.uk/linux/bogus-virus-warnings.cf
#
# Lists bogus virus warnings and similar
# This file is encoded using ISO-8859-1

# ------------ NEWS - 2004-04-03 --------------
# READ THIS CAREFULLY - CHECK YOUR SETUP!
# To reduce the risk of false positives, some rules now have checks to make
# sure that the message is a bounce. This checking is currently only enabled
# for rules that would match it irrelevant of Return-Path, but will soon
# be added to rules for which we need to determine for certain that the 
# envelope sender (return path) is null. However, if you are scanning at SMTP 
# time, and your MTA hasn't at that time inserted the Return-Path header 
# (e.g. Exim/Exiscan), or an X-Envelope-From header (which I am told is added
# by amavisd-new), we can't necessarily tell that it is a bounce, so in 
# that case you need to either get your MTA to add a header X-Is-A-Bounce: 1
# which tells us that it has a null sender, or disable the bounce checking.
# To disable bounce-checking, put this in your local.cf:
# meta __REPORT_DSN 1
#
# You can add an X-Is-A-Bounce header with Exim 4 using the following rule
# in your RCPT ACL:
#
# warn message = X-Is-A-Bounce: 1
#      senders = :
#
# (You may wish to add "headers_remove"/"headers remove" directives to your 
# remote_smtp router and system filter respectively, to strip these out again
# before the message is delivered)


# ----------- UPDATES & CONTRIBUTIONS ---------
# This ruleset is updated regularly; check for updates every now and then
# Automatic updates are OK, although please don't check too often.
# (More than once per day is too often)
# If you are checking automatically, please use appropriate methods
# (including HTTP HEAD) to avoid downloading unchanged versions.
# You can use the Rules du Jour script to easily check for updates in a
# responsible way: http://www.exit0.us/index.php/RulesDuJour

# Contributions/comments/corrections etc. are more than welcome, particularly
# complete samples of bogus warnings not caught by this rule. Please send to
# the following e-mail address: spam \-at/ timj.co.uk (replacing " \-at/ " with "@")
# PLEASE send complete samples (ideally as an attachment) if at all possible - 
# it helps me maintain an archive for regression testing and so on.

# There is a Postfix derivative of this (not identical) by Niels 
# Callesøe at: http://www.t29.dk/antiantivirus.txt

# A procmail derivative (derivative of a derivative!) of Niels's Postfix
# version is here: http://pekaje.homeip.net/antiantivirus_procmail.txt

# A useful ruleset by Martin Blapp that has some overlap with this but has
# slightly different aims can be found at: http://mx.imp.ch/worm_found.cf

# Contributors: (if I've missed anyone, I apologise - please let me know)
# TJ  = Tim Jackson <tim@timj.co.uk>
# DD  = Dennis Davis <ccsdhd/at\bath.ac.uk>
# BM  = Brian Martin (indirectly via website article)
#       see http://www.attrition.org/security/rant/av-spammers.html
# PV  = Paul Vixie (indirectly via NANOG mailing list)
#       see http://www.merit.edu/mail.archives/nanog/2004-01/msg00821.html
#       and http://www.merit.edu/mail.archives/nanog/msg01014.html
# AF  = Alan J. Flavell <a-dot-flavell/at/physics.gla.ac.uk>
# CE  = Chris Edwards <C\dot\Edwards-at@-compserv.gla.ac.uk>
# NC  = Niels Callesoe <nica\at/t29-dot-dk>
# JB  = Jethro R Binks <jethro=dot=binks\@strath.ac.uk>
# ESR = Eric S. Raymond <esr\\a@t/snark.thyrsus^com>
# EA  = Ed Avis <ed\at/membled.com>
# HP  = Herb Peyerl <hpeyerl//at.beer.org>
# JBB = John B Batzel <batzel a t seas.upenn.edu>
# SC  = Stephane Clodic <sclodic//at\teaser.fr>
# MK  = Martin Kutschker <Martin-dot-Kutschker'at'blackbox.net>
# PB  = Pieter B <PieterB-at/gewis.nl>
# PSI = Per Steinar Iversen <PerSteinar.Iversen/at/adm.hio.no>
# HPK = Homer Parker <hparker-at-pcsrvc.com>
# DJM = Damian Miller <djm/at/mindrot.org>
# VS  = Jay 'veggiespam' Ball <jay//-at=veggiespam.com>
# NL  = Nick Leverton <nick\-at$leverton.org>
# MR  = Michael Roth <mroth%at%nessie.de>
# JT  = Jona Tallieu <jona=at=tnt.be>
# VD  = Vincent Deffontaines <vincent.deffontaines/at/coe.int>
# HD  = Harald Deppeler
# DP  = David Precious <dave=at=preshweb.co.uk>
# AS  = Andreas Steinmetz <ast!at!domdv.de>
# GD  = Guido Dorssers <g/dot/h/dot/j/dot/dorssers-at\ruiver.frontierfleet.net>
# MB  = Martin Blapp <mb-at-imp.ch>
# RP  = Rob van der Putten <rob=at-sput.nl>
# PBR = Peter Bieringer <pb\\at\bieringer.de>
# PC  = Paul Cormier <pcormier--at--win-soft.com>
# TV  = Tjerk Vonck <tjerk^^at/mirc.com>
# ML  = Maurice Lucas <mslucas%at%taos-it.nl>
# MM  = Marek Michalkiewicz <marekm(at)amelek.gda.pl>
# HB  = Hanno Boeck <mail$at*hboeck.de>
# RN  = Ronald I. Nutter <ronald_nutter#@!georgetowncollege.edu>
# JK  = Josh Kelley <josh@@@@jbc.edu>


# ---------- BOUNCE DETECTION ---------
# General rule to indicate bounce or otherwise - used for some other rules
header __BOUNCE_HEADER		X-Is-A-Bounce =~ /.{1,50}/

# This won't match for scanning done at SMTP time, at least with Exim
header __BOUNCE_RP1		Return-Path =~  /^<>$/

# NL says this is added by amavisd-new before passing to SA
header __BOUNCE_RP2		X-Return-Path =~ /^<>$/

# Mark Martinec says the above is incorrect, and it's X-Envelope-From
header __BOUNCE_RP3		X-Envelope-From =~ /^<>$/

meta __NULL_SENDER		__BOUNCE_HEADER || __BOUNCE_RP1 || __BOUNCE_RP2 || __BOUNCE_RP3

# Thanks to AF
header __CT_DEL_STATUS		Content-Type =~ /report-type=delivery-status/

meta __REPORT_DSN		__NULL_SENDER || __CT_DEL_STATUS


# The rules are now slowly getting meta-information added to them, in the
# form of a "DSN:" message above the rule. The codes in this correspond to
# the following meanings:
#
# Null    = Messages always come with null sender
# CT      = Message always come with Content-Type =~ /report-type=delivery-status/
# !Attach = This rule matches the content of an attachment which has replaced
#           a virus, so the Null/CT rules could conceivably vary
# A rule with a leading question mark means status unknown, for example:
# "DSN: Null, ?CT" means we know it always has a null sender, but not sure
# whether it has the Content-Type match.


# ---------- THE RULES PROPER -----------

blacklist_from antivirus@webtar.hu
blacklist_from asterix@ars.de
blacklist_from deadletter@wingateweb.com
blacklist_from mailsweeper@tso.co.uk
blacklist_from us-interscan.admins@alcatel.com
blacklist_from virus@praca.gov.pl


# TJ/HPK
header VIRUS_WARNING1		Subject =~ /^(NDN: )?\{(Virus|Filename)\?\}/i
describe VIRUS_WARNING1		Unhelpful 'virus warning' (1)
score VIRUS_WARNING1		20

# TJ
header VIRUS_WARNING2           Subject =~ /Virus Detected by Network Associates, Inc\. Webshield/
describe VIRUS_WARNING2         Unhelpful NAI Webshield 'virus warning' (2)
score VIRUS_WARNING2            20

# TJ
header VIRUS_WARNING3           Subject =~ /^---- Virus Detected ----$/
describe VIRUS_WARNING3         Unhelpful Mail Marshal 'virus warning' (3)
score VIRUS_WARNING3            20
   
# TJ/TV
# "Virus detected" is Tobit. "Virus Detected" seen from bang.ca. 
header VIRUS_WARNING4           Subject =~ /^Virus detected$/i
describe VIRUS_WARNING4         Unhelpful 'virus warning' (4)
score VIRUS_WARNING4            20

# TJ
header VIRUS_WARNING4A		Subject =~ /^Virus Detected:status/
describe VIRUS_WARNING4A	Unhelpful MailSweeper 'virus warning' (4A)
score VIRUS_WARNING4A		20

# TJ/HPK/AF
header VIRUS_WARNING5           Subject =~ /^Virus (Alert|Warning|intercepted)!?$/i
describe VIRUS_WARNING5         Unhelpful 'virus warning' (5)
score VIRUS_WARNING5            20

# TJ/VS
header VIRUS_WARNING6           Subject =~/^InterScan (NT|Virus) Alert$/
describe VIRUS_WARNING6         Unhelpful InterScan 'virus warning' (6)
score VIRUS_WARNING6            20

# TJ
header VIRUS_WARNING7           Subject =~/^Virus found in the message$/
describe VIRUS_WARNING7         Unhelpful 'virus warning' (7)
score VIRUS_WARNING7            20

# TJ                                                                             
header VIRUS_WARNING8           Subject =~/^Message quarantined$/
describe VIRUS_WARNING8         Unhelpful 'virus warning' (8)
score VIRUS_WARNING8            20

# TJ
# VIRUS_WARNING9 now rolled into VIRUS_WARNING5

# TJ
header VIRUS_WARNING10          Subject =~/^Virus found in e-mail \(/
describe VIRUS_WARNING10        Unhelpful Netpilot VPN 'virus warning' (10)
score VIRUS_WARNING10           20

# TJ
header VIRUS_WARNING11          Subject =~/^MDaemon Warning - Virus Found/
describe VIRUS_WARNING11        Unhelpful MDaemon 'virus warning' (11)
score VIRUS_WARNING11           20

# TJ
header VIRUS_WARNING12		From =~/F-Secure Anti-Virus for Internet Mail/
describe VIRUS_WARNING12	Unhelpful F-Secure 'virus warning' (12)
score VIRUS_WARNING12		20

# TJ
rawbody VIRUS_WARNING13         /If you meant to send this file then please/
describe VIRUS_WARNING13        Unhelpful Exim system_filter 'virus warning'? (13)
score VIRUS_WARNING13           3

# TJ
rawbody VIRUS_WARNING14		/package it up as a zip file and resend it/
describe VIRUS_WARNING14 	Looks like Exim system_filter 'virus warning' (14)
score VIRUS_WARNING14		3

# TJ
meta VIRUS_WARNING_EXIM		VIRUS_WARNING13 && VIRUS_WARNING14
describe VIRUS_WARNING_EXIM	Unhelpful Exim system_filter 'virus warning'
score VIRUS_WARNING_EXIM	6

# TJ/JT
header VIRUS_WARNING15		Subject =~ /^(Warning: E-mail viruses detected|Waarschuwing: E-mail virus ontdekt)$/
describe VIRUS_WARNING15	Unhelpful MailScanner 'virus warning' (15)
score VIRUS_WARNING15		20

# TJ/PSI/AF
header VIRUS_WARNING16		Subject =~ /^ScanMail Message: To (Sender|Recipient) (virus found|file blocking settings matched)/
describe VIRUS_WARNING16	Unhelpful ScanMail/Exch 'virus warning' (16)
score VIRUS_WARNING16		20

# TJ
rawbody VIRUS_WARNING17		/The uncleanable file is deleted\./
describe VIRUS_WARNING17	Unhelpful Cisco 'virus warning' (17)
score VIRUS_WARNING17		10

# TJ/DD/PSI/TV
# Often customised.
# TJ: removed end-assertion (2004-06-06) to catch customisations
# NC has seen caseless version "Virus in mail from you."
# TV has seen "Banned file: "data.doc.pif" in mail from you"
header VIRUS_WARNING18		Subject =~/^(VIRUS|BANNED FILENAME|banned file:|BANNED) .{1,99}(IN YOUR MAIL|w Twoim mejlu|IN (A )?MAIL FROM YOU|NO SEU EMAIL)/i
describe VIRUS_WARNING18	Unhelpful 'virus warning' (18)
score VIRUS_WARNING18		20

# TJ
# Added optional space in v1.11 thanks to CE
# See also 299
header VIRUS_WARNING19		Subject =~/^Norton Anti ?Virus detected/
describe VIRUS_WARNING19	Unhelpful Norton AntiVirus 'virus warning' (19)
score VIRUS_WARNING19		20

# Rule 20 deprecated in favour of modified rule #18
# (DD: Subject: VIRUS (blah) IN YOUR MAIL)

# DD/MK
header VIRUS_WARNING21		Subject =~ /^Antigen found (VIRUS|FILE)/
describe VIRUS_WARNING21	Unhelpful Antigen 'virus warning' (21)
score VIRUS_WARNING21		20

# TJ
rawbody VIRUS_WARNING22		/^Panda Antivirus has taken the following actions/
describe VIRUS_WARNING22	Unhelpful Panda Antivirus 'virus warning' (22)
score VIRUS_WARNING22		20

# TJ
header VIRUS_WARNING23		Subject =~ /^Filter incident$/
describe VIRUS_WARNING23	Unhelpful Panda Antivirus 'virus warning'? (23)
score VIRUS_WARNING23		4

# TJ
rawbody VIRUS_WARNING24         /^<<< 554 TRANSACTION FAILED - Unrepairable Virus/
describe VIRUS_WARNING24        Unhelpful AOL 'virus warning' (24)
score VIRUS_WARNING24           20

# DD
rawbody VIRUS_WARNING25		/^Network Associates WebShield SMTP.{1,99}detected virus/
describe VIRUS_WARNING25	Unhelpful Network Associates 'virus warning' (25)
score VIRUS_WARNING25		20

# TJ
rawbody VIRUS_WARNING26		/^The name\(s\) of the blocked file\(s\) follow:/
describe VIRUS_WARNING26	Unhelpful 'virus warning' (26)
score VIRUS_WARNING26		20

# TJ
rawbody VIRUS_WARNING27		/V I R U S  A L E R T/
describe VIRUS_WARNING27	Unhelpful amavisd 'virus warning' (27)
score VIRUS_WARNING27		20

# TJ
# Modified to remove "^Our" (thanks CE) as is sometimes customised like so:
# "The University of xxxx virus detector...."
rawbody VIRUS_WARNING28		/virus detector has just been triggered by a message you sent/
describe VIRUS_WARNING28	Unhelpful MailScanner 'virus warning' (28)
score VIRUS_WARNING28		20

# TJ
header VIRUS_WARNING29		Subject =~ /^Vírus figyelmeztetés! Virus warning!$/
describe VIRUS_WARNING29	Unhelpful Hungarian 'virus warning' (29)
score VIRUS_WARNING29		20

# TJ
body VIRUS_WARNING30		/The mail was deleted on the mailserver. The sender was informed about this incident/
describe VIRUS_WARNING30	Unhelpful 'virus warning' (30)
score VIRUS_WARNING30		20

# DD
rawbody VIRUS_WARNING31         /^The Declude Virus.{0,50}software on our mail server detected the/
describe VIRUS_WARNING31        Unhelpful Declude Virus software warning (31)
score VIRUS_WARNING31           20

# TJ
body VIRUS_WARNING32		/^\/infected with \w/
describe VIRUS_WARNING32	Unhelpful qmail-plugin virus warning (32)
score VIRUS_WARNING32		5

# BM
body VIRUS_WARNING33		/^The virus detector said this about the message/
describe VIRUS_WARNING33	Unhelpful MailScanner virus warning (33)
score VIRUS_WARNING33		12

# BM/AF
header VIRUS_WARNING34		Subject =~ /^Symantec (AVF|Mail Security|AntiVirus(\/Filtering)?) (for (Lotus Notes|Domino) )?detected/
describe VIRUS_WARNING34	Unhelpful Symantec virus warning (34)
score VIRUS_WARNING34		20

# BM/MK
# Borderware MXtreme Firewall
body VIRUS_WARNING35		/was stopped and (Rejected|Quarantined) because it contains one or more (viruses|forbidden attachments)/
describe VIRUS_WARNING35	Unhelpful BorderWare MXtreme virus warning (35)
score VIRUS_WARNING35		8

# BM
header VIRUS_WARNING36		Subject =~ /^Returned due to virus;/
describe VIRUS_WARNING36	Unhelpful 'virus warning' (36)
score VIRUS_WARNING36		20

# PV
header VIRUS_WARNING37		Subject =~ /^Anti-Virus Notification/
describe VIRUS_WARNING37	Unhelpful 'virus warning' (37)
score VIRUS_WARNING37		12

# PV/JT
# was Subject /^BANNED FILENAME .{0,99}IN MAIL FROM YOU/
# obsoleted by 18

# PV
header VIRUS_WARNING39		Subject =~ /^File blocked - ScanMail for Lotus/
describe VIRUS_WARNING39	Unhelpful ScanMail 'virus warning' (39)
score VIRUS_WARNING39		12

# PV
header VIRUS_WARNING40		Subject =~ /^Message deleted/
describe VIRUS_WARNING40	Unhelpful 'virus warning' (40)
score VIRUS_WARNING40		20

# PV
header VIRUS_WARNING41		Subject =~ /^NAV detected a virus/
describe VIRUS_WARNING41	Unhelpful 'virus warning' (41)
score VIRUS_WARNING41		20

# PV
header VIRUS_WARNING42		Subject =~ /^RAV AntiVirus scan/
describe VIRUS_WARNING42	Unhelpful RAV 'virus warning' (42)
score VIRUS_WARNING42		20

# PV
# was header VIRUS_WARNING43		Subject =~ /^VIRUS .{0,99}IN (A )?MAIL FROM YOU/i
# obsoleted by 18

# PV
header VIRUS_WARNING44		Subject =~ /^Virus Notification:/
describe VIRUS_WARNING44	Unhelpful 'virus warning' (44)
score VIRUS_WARNING44		20

# PV
header VIRUS_WARNING45		Subject =~ /^Virus found in a message you sent/
describe VIRUS_WARNING45	Unhelpful 'virus warning' (45)
score VIRUS_WARNING45		20

# PV
# CE contributed caseless start
header VIRUS_WARNING46		Subject =~ /^[Vv]irus found in sent message/
describe VIRUS_WARNING46	Unhelpful 'virus warning' (46)
score VIRUS_WARNING46		20

# PV
header VIRUS_WARNING47		From =~ /^GroupShield for Exchange/
describe VIRUS_WARNING47	Unhelpful GroupShield/Exch 'virus warning' (47)
score VIRUS_WARNING47		10

# PV
body VIRUS_WARNING48		/^The infected message's properties are:/
describe VIRUS_WARNING48	Unhelpful McAfee 'virus warning' (48)
score VIRUS_WARNING48		20

# AF
header VIRUS_WARNING49		Subject =~ /^VIRUS EN SU CORREO/
describe VIRUS_WARNING49	Unhelpful 'virus warning' (49)
score VIRUS_WARNING49		20

# AF
header VIRUS_WARNING50		Subject =~ /^Warning: antivirus system report$/
describe VIRUS_WARNING50	Unhelpful 'virus warning' (50)
score VIRUS_WARNING50		20

# AF
header VIRUS_WARNING51		Subject =~ /^MDaemon Notification -- Attachment Removed$/
describe VIRUS_WARNING51	Unhelpful 'virus warning' (51)
score VIRUS_WARNING51		20

# AF
header VIRUS_WARNING52		Subject =~ /^Information - Antivirus$/
describe VIRUS_WARNING52	Unhelpful 'virus warning' (52)
score VIRUS_WARNING52		20

# AF
header VIRUS_WARNING53		Subject =~ /^Symantec AntiVirus detected a violation/
describe VIRUS_WARNING53	Unhelpful 'virus warning' (53)
score VIRUS_WARNING53		20

# AF
header VIRUS_WARNING54		Subject =~ /^WARNING: YOU WERE SENT A VIRUS/
describe VIRUS_WARNING54	Unhelpful 'virus warning' (54)
score VIRUS_WARNING54		20

# AF
header VIRUS_WARNING55		Subject =~ /^SAV detected a violation in a/
describe VIRUS_WARNING55	Unhelpful SAV 'virus warning' (55)
score VIRUS_WARNING55		20

# AF/CE
# Virus version seen as "...a Virus in your message", not sure about other
header VIRUS_WARNING56		Subject =~ /^MailMarshal has detected a (Virus|suspect attachment)/
describe VIRUS_WARNING56	Unhelpful MailMarshal 'virus warning' (56)
score VIRUS_WARNING56		20

# AF/TV
header VIRUS_WARNING57		Subject =~ /^A virus was detected in your (mail|message)/i
describe VIRUS_WARNING57	Unhelpful 'virus warning' (57)
score VIRUS_WARNING57		20

# AF
header VIRUS_WARNING58		Subject =~ /^Recipient Virus-alert/
describe VIRUS_WARNING58	Unhelpful 'virus warning' (58)
score VIRUS_WARNING58		20

# AF/PBR
#lowercase version is VirusGuard "^Virus found in message to you!$"
header VIRUS_WARNING59		Subject =~ /^Virus [fF]ound in message/
describe VIRUS_WARNING59	Unhelpful 'virus warning' (59)
score VIRUS_WARNING59		20

# AF
# Roll into VIRUS_WARNING15?
header VIRUS_WARNING60		Subject =~ /^E-?mail viruses detected/
describe VIRUS_WARNING60	Unhelpful 'virus warning' (60)
score VIRUS_WARNING60		20

# AF
header VIRUS_WARNING61		Subject =~ /^Undelivered mail: VIRUS FOUND/
describe VIRUS_WARNING61	Unhelpful 'virus warning' (61)
score VIRUS_WARNING61		20

# AF/TJ/PB/HD/JT
# 2004-12-15: the Symantec@ doesn't seem to work, for reasons that are opaque to me
header VIRUS_WARNING62		From =~ /Antivirus|InterScan|MailScanner|virusscan|WebShield SMTP|NortonAV|DrWeb-DAEMON|amavisd-new|virenscanner|GateLockX200|Filtermails|MailMonitor|Symantec\@|Symantec E-Mail-Proxy/i
describe VIRUS_WARNING62	'From' indicates unhelpful 'virus warning' (62)
score VIRUS_WARNING62		3.5

# AF/TJ
# care: double count of this & 62 for 'amavisd-new'
header VIRUS_WARNING62A		From =~ /amavis\@/
describe VIRUS_WARNING62A	'From' contains 'amavis'; 'virus warning'? (62A)
score VIRUS_WARNING62A		0.8

# AF/TJ/MK/JT
# Case-sensitive strong indications
header VIRUS_WARNING63		From =~ /mail.marshal\@|InterScan Notification|Antivirus-Daemon|Nemx Power Tools for MS Exchange Server|NAVMSE-|Norton_AntiVirus_|Unicom Anti-Virus|Symantec_AntiVirus_for_SMTP|ANTIVIRUS-SYSTEM|\"System Anti-Virus Administrator\"|Eclipse-VirusShield|Anti-Virus Scanner|SymantecSMTPSecurityServer|_WatchDog_Demon|MAILsweeper|InterScan Notification|eTrust_Antivirus_Lotus_Notes|BorderWare MXtreme Mail Firewall|DinaScanner|vba_filter|KAV for Microsoft Exchange|Guinevere Anti-Virus|Barracuda Spam Firewall|'Watchdog' Demon|Virus Scanner/
describe VIRUS_WARNING63	'From' strongly indicates 'virus warning' (63)
score VIRUS_WARNING63		8

# TJ/AF
# Case-insensitive strong indications
header VIRUS_WARNING63A		From =~ /mailsweeper\@|avmailwall\@|virusscreen\@|virus-alert\@|antigen_|escanuser\@/i
describe VIRUS_WARNING63A	'From' strongly indicates 'virus warning' (63A)
score VIRUS_WARNING63A		8

# ML
# blacklist_from not used, because resent-from (added by some mailing lists) overrides.
header VIRUS_WARNING63B		From =~ /viruscheckservice\@virusguardman\.com/i
describe VIRUS_WARNING63B	Unhelpful 'virus warning' (blacklisted) (63B)
score VIRUS_WARNING63B		20

# AF
# False positive reported by Dan Miller <dan-dot-miller/at/ci-pinkerton.com>
# Has had a score of 20 for a long time.
# What a pain; Google shows huge amounts of junk
# 2004-08-09: removed after another FP report. Would love to know more about this.
#header VIRUS_WARNING64		X-BLTSYMAVREINSERT =~ /./
#describe VIRUS_WARNING64	Looks like unhelpful 'virus warning' (64)
#score VIRUS_WARNING64		3

# AF
header VIRUS_WARNING65		X-Virus-Scan-Result =~ /Repaired/
describe VIRUS_WARNING65	Unhelpful 'virus warning' (65)
score VIRUS_WARNING65		20

# AF
# This pattern has been seen as X-AtHome-MailScanner, X-Virus-Scanner, 
# X-MailScanner, X-Antivirus, X-CTC-Iris-MailScanner, X-UTwente-MailScanner
header VIRUS_WARNING66		ALL =~ /Found to be infected/
describe VIRUS_WARNING66	Unhelpful 'virus warning' (66)
score VIRUS_WARNING66		20

# AF
header VIRUS_WARNING67		X-Scanned =~ /Symantec Antivirus Scan - Virus found/
describe VIRUS_WARNING67	Unhelpful 'virus warning' (67)
score VIRUS_WARNING67		20

# AF
header VIRUS_WARNING68		X-Sender =~ /NetMail AntiVirus Agent/
describe VIRUS_WARNING68	Unhelpful 'virus warning' (68)
score VIRUS_WARNING68		20

# Rule 69 was obsoleted by modified version of rule #66
# (AF: X-yoursite-Mailscanner: Found to be infected)

# AF
header VIRUS_WARNING70		Subject =~ /^Quarantined Mail: virus from/
describe VIRUS_WARNING70	Unhelpful 'virus warning' (70)
score VIRUS_WARNING70		20

# TJ
header VIRUS_WARNING71		Subject =~ /^Failed to clean virus/
describe VIRUS_WARNING71	Unhelpful InterScan 'virus warning' (71)
score VIRUS_WARNING71		20

# TJ
rawbody VIRUS_WARNING72		/^   Attempted to clean the file but it is not cleanable/
describe VIRUS_WARNING72	Unhelpful InterScan 'virus warning' (72)
score VIRUS_WARNING72		20

# AF
header VIRUS_WARNING73		X-Mirapoint-Virus =~ /DELETED/
describe VIRUS_WARNING73	Unhelpful Mirapoint 'virus warning' (73)
score VIRUS_WARNING73		20

# AF
# Part of "Attenzione Virus - Virus Alert"
header VIRUS_WARNING74		Subject =~ /^Attenzione Virus/
describe VIRUS_WARNING74	Unhelpful 'virus warning' (74)
score VIRUS_WARNING74		20

# AF
header VIRUS_WARNING75		X-Auto-Generated =~ /^Sophos antivirus plugin/
describe VIRUS_WARNING75	Unhelpful 'virus warning' (75)
score VIRUS_WARNING75		10

# AF/TJ
# Variant on #16
header VIRUS_WARNING76		Subject =~ /^\[MailServer Notification\]\s?To (Sender|External Sender|Recipient):? (virus found|a virus was found|file blocking settings matched|Message matched eManager setting)/
describe VIRUS_WARNING76	Unhelpful ScanMail 'virus warning' (76)
score VIRUS_WARNING76		20

# AF
header VIRUS_WARNING77		Subject =~ /^virus in verschickter Nachricht gefunden/
describe VIRUS_WARNING77	Unhelpful 'virus warning' (77)
score VIRUS_WARNING77		20

# AF
rawbody VIRUS_WARNING78		/Status: 5\.7\.0 \(other or undefined security status\)/
describe VIRUS_WARNING78	Could be a bogus virus warning (78)
score VIRUS_WARNING78		0.5

# AF
rawbody VIRUS_WARNING79		/Message-ID: <[^>]{1,50}> \(added by postmaster/
describe VIRUS_WARNING79	Could be a bogus virus warning (79)
score VIRUS_WARNING79		0.5

# AF
meta VIRUS_WARNING80		VIRUS_WARNING78 && VIRUS_WARNING79 && __REPORT_DSN
describe VIRUS_WARNING80	Likely to be a bogus virus warning (80)
score VIRUS_WARNING80		3.5

# Rule 81 combined with 56

# CE
header VIRUS_WARNING82		Subject =~ /^Virus encontrado en el mensaje enviado/
score VIRUS_WARNING82		20

# CE
header VIRUS_WARNING83		Subject =~ /^Security Alert - ScanMail for Lotus Notes/
describe VIRUS_WARNING83	Unhelpful ScanMail 'virus warning' (83)
score VIRUS_WARNING83		20

# CE/MK
# TJ: ...Detected is right-anchored
header VIRUS_WARNING84		Subject =~ /^Virus Infection (Alert|Detected)/
score VIRUS_WARNING84		20

# CE
header VIRUS_WARNING85		Subject =~ /^Warning - Virus Detected:/
score VIRUS_WARNING85		20

# CE
header VIRUS_WARNING86		Subject =~ /^Skynet Mail Protection scan results/
score VIRUS_WARNING86		20

# CE
rawbody VIRUS_WARNING87		/RAV AntiVirus plugin for CommuniGate Pro has found a virus in the e-mail you are about to send/
describe VIRUS_WARNING87	Unhelpful RAV 'virus warning' (87)
score VIRUS_WARNING87		20

# CE
rawbody VIRUS_WARNING88		/This is an automated return email from McAfee Virus Scan/
describe VIRUS_WARNING88	Unhelpful McAfee 'virus warning' (88)
score VIRUS_WARNING88		20

# CE
rawbody VIRUS_WARNING89		/------------------  Virus Warning Message/
describe VIRUS_WARNING89	Unhelpful 'virus warning' (89)
score VIRUS_WARNING89		20

# JB
body VIRUS_WARNING90		/^contained an attachment of a type that is frequently used to transport/
describe VIRUS_WARNING90	Looks like unhelpful ScanMail 'virus warning' (90)
score VIRUS_WARNING90		6

# JB
# Seen in "-- KO/Office has blocked your mail due to an email policy."
header VIRUS_WARNING91		Subject =~ /has blocked your mail due to an email policy\./
describe VIRUS_WARNING91	Looks like unhelpful ScanMail 'virus warning' (91)
score VIRUS_WARNING91		6

# NC: Contributed by "Safari" in n.a.n-a.e
header VIRUS_WARNING92		Subject =~ /^Virusveszely! Virus warning!/
score VIRUS_WARNING92		20

# NC
header VIRUS_WARNING93		Subject =~ /^Virus infection notice/
score VIRUS_WARNING93		20

# NC
header VIRUS_WARNING94		Subject =~ /^Possible virus found in message you sent/
score VIRUS_WARNING94		20

# NC
header VIRUS_WARNING95		Subject =~ /^AntiVir ALERT/
score VIRUS_WARNING95		20

# NC
# TJ: I suspect this may be specific to a site
header VIRUS_WARNING96		Subject =~ /^Centrale Anti-Virus melding/
score VIRUS_WARNING96		20

# NC
# Looks like #95
header VIRUS_WARNING97		Subject =~ /^Vexira ALERT/
score VIRUS_WARNING97		20

# NC
# TJ: again, suspect site-specific. Maybe change to ALL =~ ...?
header VIRUS_WARNING98		X-ELTE-VirusStatus =~ /^was_infected/
score VIRUS_WARNING98		20

# NC: contributed by B Briggs in n.a.n-a.e
header VIRUS_WARNING99		Subject =~ /^You sent potentially unsafe content/
score VIRUS_WARNING99		20

# NC
# TJ: looks site-specific to me
header VIRUS_WARNING100		Subject =~ /^Hov, du har sendt Jubii en virus !!!$/
score VIRUS_WARNING100		20

# NC
header VIRUS_WARNING101		Subject =~ /^\[message from .{0,99}virus detect system\]$/
score VIRUS_WARNING101		20

# NC
header VIRUS_WARNING102		Subject =~ /^Net Integrator Virus Alert$/
score VIRUS_WARNING102		20

# NC
header VIRUS_WARNING103		Subject =~ /^Information - Antivirus$/
score VIRUS_WARNING103		20

# NC
header VIRUS_WARNING104		Subject =~ /^AntiVirus Alert!$/
score VIRUS_WARNING104		20

# NC
header VIRUS_WARNING105		Subject =~ /^\{ALERTA DE VIRUS\}/
score VIRUS_WARNING105		20

# NC
header VIRUS_WARNING106		Subject =~ /^Virus in una mail per lei/
score VIRUS_WARNING106		20

# NC
header VIRUS_WARNING107		Subject =~ /AntiVirus scan results/
describe VIRUS_WARNING107	Looks like an unhelpful 'virus warning' (107)
score VIRUS_WARNING107		7

# TJ
header VIRUS_WARNING108		Subject =~ /^Returned due to - ATTACHMENT BLOCKINGS/
describe VIRUS_WARNING108	Unhelpful WebShield 'virus warning' (108)
score VIRUS_WARNING108		20

# TJ
# deprecated in favour of 186

# JB/TJ
body VIRUS_WARNING110		/^Please inform your (system)? administrator (and have your virus scanning|or check your machine for viruses)/
describe VIRUS_WARNING110	Unhelpful MIMEsweeper 'virus warning'? (110)
score VIRUS_WARNING110		8

# JB
body VIRUS_WARNING111		/^Scan: Threat: '[^']{1,50}' detected by/
describe VIRUS_WARNING111	Unhelpful MIMEsweeper 'virus warning'? (111)
score VIRUS_WARNING111		6

# ESR
header VIRUS_WARNING112		Subject =~ /^Virus Detected in your Email message!/
describe VIRUS_WARNING112	Unhelpful Norton Antivirus 'virus warning' (112)
score VIRUS_WARNING112		20

# ESR
rawbody VIRUS_WARNING113	/infected with the W32.Mydoom.A\@mm virus/
describe VIRUS_WARNING113	Unhelpful Mydoom virus warning (113)
score VIRUS_WARNING113		6

# TJ
body VIRUS_WARNING114		/RAV AntiVirus plugin for .{1,50} has found a virus/
describe VIRUS_WARNING114	Unhelpful RAV plugin 'virus warning' (114)
score VIRUS_WARNING114		7.5

# TJ
body VIRUS_WARNING115		/^Remote host said: 5.. Message rejected due to possible virus/
describe VIRUS_WARNING115	Qmail bounce of unhelpful virus warning (115)
score VIRUS_WARNING115		10

# ESR
# Similar to rule 23
header VIRUS_WARNING116		Subject =~ /^Virus incident/
describe VIRUS_WARNING116	Unhelpful Panda virus warning (116)
score VIRUS_WARNING116		6

# TJ
rawbody VIRUS_WARNING117	/^A known virus was discovered and deleted\./
describe VIRUS_WARNING117	Looks like MIMEDefang 'virus warning' (117)
score VIRUS_WARNING117		4

# TJ/AF
rawbody VIRUS_WARNING117A	/^WARNING: This e-mail has been altered by (SATN-)?MIMEDefang/
describe VIRUS_WARNING117A	MIMEDefang modified message (117A)
score VIRUS_WARNING117A		0.2

# AF
rawbody VIRUS_WARNING117B	/^I found the \S+ virus\.$/
describe VIRUS_WARNING117B	Unhelpful MIMEDefang 'virus warning' (117B)
score VIRUS_WARNING117B		5

# TJ
meta VIRUS_WARNING_DEFANG	VIRUS_WARNING117 && VIRUS_WARNING117A
describe VIRUS_WARNING_DEFANG	Unhelpful MIMEDefang 'virus warning'
score VIRUS_WARNING_DEFANG	10

# EA
# Sample at: http://article.gmane.org/gmane.comp.tv.xmltv.devel/2772
body VIRUS_WARNING118		/^The delivery of this message has been rejected.  This message appears to have a.{0,99} virus/
describe VIRUS_WARNING118	Unhelpful 'virus warning' (118)
score VIRUS_WARNING118		10

# EA
# Sample at: http://article.gmane.org/gmane.comp.tv.xmltv.devel/2773
header VIRUS_WARNING119		Subject =~ /^WARNING: YOU MAY HAVE A VIRUS/
describe VIRUS_WARNING119	Unhelpful 'virus warning' (119)
score VIRUS_WARNING119		20

# EA
# Sample at: http://article.gmane.org/gmane.comp.tv.xmltv.devel/2773
body VIRUS_WARNING120		/^The E-mail containing the virus has been removed/
describe VIRUS_WARNING120	Unhelpful 'virus warning' (120)
score VIRUS_WARNING120		10

# PV
header VIRUS_WARNING121		Subject =~ /^ALERTE \- Vous avez envoye un mail avec virus/
describe VIRUS_WARNING121	Unhelpful 'virus warning' (121)
score VIRUS_WARNING121		20

# PV
header VIRUS_WARNING122		Subject =~ /^ALERTE: un virus a /
describe VIRUS_WARNING122	Unhelpful 'virus warning' (122)
score VIRUS_WARNING122		20

# PV
header VIRUS_WARNING123		Subject =~ /^Anti-Virus Notification/
describe VIRUS_WARNING123	Unhelpful 'virus warning/ (123)
score VIRUS_WARNING123		20

# PV
header VIRUS_WARNING124		Subject =~ /^Antigen Notification/
describe VIRUS_WARNING124	Unhelpful Antigen 'virus warning' (124)
score VIRUS_WARNING124		20

# PV
header VIRUS_WARNING125		Subject =~ /Antivirus stopped your message/
describe VIRUS_WARNING125	Unhelpful 'virus warning' (125)
score VIRUS_WARNING125		10

# PV
header VIRUS_WARNING126		Subject =~ /^Email Quarantined Due to Virus/
score VIRUS_WARNING126		10

# PV/MK
# TJ: often anchored to start, but can have prefix
header VIRUS_WARNING127		Subject =~ /Inflex scan report \[\d+\]$/
describe VIRUS_WARNING127	Unhelpful Inflex 'virus warning' (127)
score VIRUS_WARNING127		20

# PV
header VIRUS_WARNING128		Subject =~ /^MMS Notification/
score VIRUS_WARNING128		4.5

# PV
header VIRUS_WARNING129		Subject =~ /MailSure Virus Alert/
score VIRUS_WARNING129		10

# PV
header VIRUS_WARNING130		Subject =~ /Ochrona antywirusowa/
score VIRUS_WARNING130		5

# PV
header VIRUS_WARNING131		Subject =~ /(SENDER|RECIPIENT) \! Virus Notify \!/
score VIRUS_WARNING131		10

# PV/TJ
header VIRUS_WARNING132		Subject =~ /VIRUS (NO|EM) SEU EMAIL/i
score VIRUS_WARNING132		20

# PV
header VIRUS_WARNING133		Subject =~ /Virus Check Alert/
score VIRUS_WARNING133		10

# TJ
# Variation on 133
header VIRUS_WARNING133A	Subject =~ /^\#\# Virus Check Alert \#\#$/
score VIRUS_WARNING133A		20

# PV
# Seen as 'Virus Notification from Redstone'
# TJ: checked
header VIRUS_WARNING134		Subject =~ /^Virus Notification from/
score VIRUS_WARNING134		20

# PV
# TJ: checked
header VIRUS_WARNING135		Subject =~ /^Virus Quarantine Notification$/
score VIRUS_WARNING135		20

# PV/TJ
# TJ: checked, and seen separately with optional virus name
header VIRUS_WARNING136		Subject =~ /^Virus (\(.{1,50}\) )?in Ihrer Nachricht/i
describe VIRUS_WARNING136	Unhelpful amavisd-new 'virus warning' [DE] (136)
score VIRUS_WARNING136		10

# PV
header VIRUS_WARNING137		Subject =~ /Votre message contient un virus/
score VIRUS_WARNING137		8

# PV
# TJ: checked
header VIRUS_WARNING138		Subject =~ /^WorldSecure Server notification$/
describe VIRUS_WARNING138	Unhelpful WorldSecure 'virus warning' (138)
score VIRUS_WARNING138		20

# PV
header VIRUS_WARNING139		Subject =~ /\[SmartFilter\] Virus Alert /
score VIRUS_WARNING139		8

# PV
header VIRUS_WARNING140		Subject =~ /\[Virus detected\]/
score VIRUS_WARNING140		6

# 141 obsoleted by 142

# PV/TJ
header VIRUS_WARNING142		Subject =~ /^virus (trouve dans le message envoye|trovato in un messaggio inviato)/
describe VIRUS_WARNING142	Unhelpful 'virus warning'
score VIRUS_WARNING142		20

# HP
# BorderWare Mail Gateway
rawbody VIRUS_WARNING143	/^This is a recorded message from the BorderWare Mail Gateway/
describe VIRUS_WARNING143	Unhelpful BorderWare 'virus warning' (143)
score VIRUS_WARNING143		6

# HP
# Also from BorderWare Mail Gateway
header VIRUS_WARNING144		Subject =~ /^Discarded Email/
describe VIRUS_WARNING144	Unhelpful BorderWare 'virus warning'? (144)
score VIRUS_WARNING144		5

# TJ
body VIRUS_WARNING145		/A L E R T A\s+D E\s+V [IÍ] R U S/
describe VIRUS_WARNING145	Unhelpful MailScanner 'virus warning' (145)
score VIRUS_WARNING145		4

# AF
body VIRUS_WARNING146		/^The content of the following email has been checked by the HBOS plc/
describe VIRUS_WARNING146	Unhelpful 'virus warning' - HBOS/Halifax? (146)
score VIRUS_WARNING146		3.5

# AF
body VIRUS_WARNING147		/Aquest missatge contenia un fitxer adjunt amb virus que s'ha eliminat/
score VIRUS_WARNING147		4

# AF 
header VIRUS_WARNING148		Subject =~ /^HBOS plc Automated Email Administrator/
describe VIRUS_WARNING148	Unhelpful 'virus warning'- HBOS plc/Halifax (148)
score VIRUS_WARNING148		10

# TJ
header VIRUS_WARNING149		Subject =~ /^Disallowed attachment type found in sent message/
describe VIRUS_WARNING149	Unhelpful 'virus warning' (149)
score VIRUS_WARNING149		20

# TJ
body VIRUS_WARNING150		/550 Error: VB0007 - Rejected: Probably a virus/
describe VIRUS_WARNING150	Probably a virus bounce (club-internet.fr) (150)
score VIRUS_WARNING150		4

# TJ
rawbody VIRUS_WARNING151	/^Virus\(es\) found\.$/
describe VIRUS_WARNING151	McAfee/CommuniGate Pro 'virus warning' (151)
score VIRUS_WARNING151		7

# TJ
body VIRUS_WARNING152		/^Captured by McAfee antivirus plugin/
describe VIRUS_WARNING152	Unhelpful McAfee plugin 'virus warning' (152)
score VIRUS_WARNING152		4

# TJ
rawbody VIRUS_WARNING153	/^\S+ is infected with/
describe VIRUS_WARNING153	Unhelpful McAfee plugin 'virus warning'? (153)
score VIRUS_WARNING153		3

# TJ
rawbody VIRUS_WARNING154	/^WARNING! Your message was infected by VIRUS:$/
describe VIRUS_WARNING154	Unhelpful 'virus warning' (154)
score VIRUS_WARNING154		15

# TJ
rawbody VIRUS_WARNING155	/^Antiviral program output:$/
describe VIRUS_WARNING155	Unhelpful 'virus warning' (155)
score VIRUS_WARNING155		3

# AF
header VIRUS_WARNING156		Subject =~ /^Virus found:/
describe VIRUS_WARNING156	Unhelpful SurfControl 'virus warning' (156)
score VIRUS_WARNING156		20

# AF - should normally be caught by 156
rawbody VIRUS_WARNING157	/^SurfControl E-mail Anti-Virus Agent and has detected the Virus/
describe VIRUS_WARNING157	Unhelpful SurfControl 'virus warning' (157)
score VIRUS_WARNING157		5

# JBB
header VIRUS_WARNING158         Subject =~ /^Your mail server sent us a virus/
describe VIRUS_WARNING158       Unhelpful Declude 'virus warning' (158)
score VIRUS_WARNING158		20

# AF
header VIRUS_WARNING159		Subject =~ /^This is an alert from eSafe$/
describe VIRUS_WARNING159	Unhelpful eSafe 'virus warning' (159)
score VIRUS_WARNING159		20

# AF/PB - sometimes, but not always caught by 159
rawbody VIRUS_WARNING160	/^\*\*\* eSafe detected (a )?hostile content in this email( and removed it)?. \*\*\*$/
describe VIRUS_WARNING160	Unhelpful eSafe 'virus warning' (160)
score VIRUS_WARNING160		12

# AF
header VIRUS_WARNING161		Subject =~ /^Virus encontrado/
describe VIRUS_WARNING161	Unhelpful 'virus warning' (161)
score VIRUS_WARNING161		4

# AF
rawbody VIRUS_WARNING162	/^---uvscan results ---$/
describe VIRUS_WARNING162	Looks like unhelpful 'virus warning' (162)
score VIRUS_WARNING162		3.5

# TJ
rawbody VIRUS_WARNING162A	/^---perlscanner results ---$/
describe VIRUS_WARNING162A	Looks like unhelpful 'virus warning' (162A)
score VIRUS_WARNING162A		2.0

# AF
rawbody VIRUS_WARNING163	/^Scan result/
describe VIRUS_WARNING163	Unhelpful 'virus warning'? (163)
score VIRUS_WARNING163		2

# SC - seen as 2Notification du serveur antivirus SEII"
# TrendMicro Viruswall
header VIRUS_WARNING164		Subject =~ /^Notification du serveur antivirus/
describe VIRUS_WARNING164	Unhelpful Viruswall 'virus warning' (164)
score VIRUS_WARNING164		6

# SC
rawbody VIRUS_WARNING165	/^Un virus a été détecté dans votre $/
describe VIRUS_WARNING165	Unhelpful Viruswall 'virus warning'? (165)
score VIRUS_WARNING165		4

# SC
rawbody VIRUS_WARNING166	/^Un virus \(.{1,50}\) a été déte/
describe VIRUS_WARNING166	Unhelpful Viruswall 'virus warning'? (166)
score VIRUS_WARNING166		4

# SC
header VIRUS_WARNING167		Subject =~ /^NAV ha rilevato un virus in un documento inviato$/
describe VIRUS_WARNING167	Unhelpful NAV 'virus warning' (167)
score VIRUS_WARNING167		100

# SC
rawbody VIRUS_WARNING168	/^Il documento analizzato è in QUARANTEA\.$/
describe VIRUS_WARNING168	Unhelpful NAV 'virus warning' (168)
score VIRUS_WARNING168		4

# SC
rawbody VIRUS_WARNING169	/^Informazioni sul virus:$/
describe VIRUS_WARNING169	Unhelpful NAV 'virus warning' (169)
score VIRUS_WARNING169		4

# AF
# Hmm, maybe use X-WSS-ID: <uid> header? Looks like it's a NAI WS spamsign
header VIRUS_WARNING170		Subject =~ /^Network Associates Webshield -  e-mail Content Alert$/
describe VIRUS_WARNING170	Unhelpful Webshield 'attachment warning' (170)
score VIRUS_WARNING170		20

# AF
rawbody VIRUS_WARNING171	/^Network Associates WebShield SMTP.{1,50}intercepted a mail/
describe VIRUS_WARNING171	Unhelpful Webshield 'attachment warning' (171)
score VIRUS_WARNING171		5

# TJ
rawbody VIRUS_WARNING172	/^Virus identity found:/
describe VIRUS_WARNING172	Unhelpful MailMonitor 'virus warning' (172)
score VIRUS_WARNING172		5

# TJ
rawbody VIRUS_WARNING173	/^The Firstnet Anti-Virus \(FAV\) system intercepted it/
describe VIRUS_WARNING173	Unhelpful Firstnet AV 'virus warning' (173)
score VIRUS_WARNING173		5

# TJ - this is generated by the braindead qmail-scanner patch
header VIRUS_WARNING174		X-Tnz-Problem-Type =~ /.{1,50}/
describe VIRUS_WARNING174	Unhelpful qmail-scanner 'virus warning' (174)
score VIRUS_WARNING174		1

# TJ
rawbody VIRUS_WARNING175	/^Panda Antivirus has found the following viruses in the message:$/
describe VIRUS_WARNING175	Unhelpful Panda Antivirus 'virus warning' (175)
score VIRUS_WARNING175		8

# TJ - can't assert the end of this string for some reason
rawbody VIRUS_WARNING176	/^Report generated by Panda Antivirus/
describe VIRUS_WARNING176	Unhelpful Panda Antivirus 'virus warning' (176)
score VIRUS_WARNING176		5

# AF
# as in "...virus in a document you authored"
header VIRUS_WARNING177		Subject =~ /^Symantec AntiVirus\/Filtering for Domino detected a virus/
describe VIRUS_WARNING177	Unhelpful Symantec for Domino 'virus warning'(177)
score VIRUS_WARNING177		20

# TJ
# Honestly, ISPs should know better than this. Idiots.
header VIRUS_WARNING178		Subject =~ /^Eclipse Internet VIRUSshield detected VIRUS/
describe VIRUS_WARNING178	Unhelpful Eclipse Internet 'virus warning' (178)
score VIRUS_WARNING178		20

# TJ
# see also 390
rawbody VIRUS_WARNING179	/^VIRUS ALERT/
describe VIRUS_WARNING179	Could be a bogus 'virus warning' (179)
score VIRUS_WARNING179		2.5

# TJ
# Norton Antivirus Gateway
header VIRUS_WARNING180		Subject =~ /^VIRUS MESSAGE$/
describe VIRUS_WARNING180	Unhelpful Norton AV Gateway 'virus warning' (180)
score VIRUS_WARNING180		4.5

# AF
header VIRUS_WARNING181		Subject =~ /^Internet Mail Failure - Virus Alert$/
describe VIRUS_WARNING181	Unhelpful 'virus warning' (181)
score VIRUS_WARNING181		20

# AF
rawbody VIRUS_WARNING182	/^Virus Scanner found the$/
describe VIRUS_WARNING182	Unhelpful 'virus warning'? (182)
score VIRUS_WARNING182		1.5

# TJ
rawbody VIRUS_WARNING183	/^YOUR MAIL HAD THE VIRUS/
describe VIRUS_WARNING183	Unhelpful 'virus warning' (WebShield?) (183)
score VIRUS_WARNING183		2.0

# TJ
header VIRUS_WARNING184		Subject =~ /^FOUND VIRUS IN YOUR MAIL TO:/
describe VIRUS_WARNING184	Unhelpful ArmourPlate 'virus warning' (184)
score VIRUS_WARNING184		10.0

# TJ
rawbody VIRUS_WARNING185	/^ArmourPlate protects organisations/
describe VIRUS_WARNING185	Unhelpful ArmourPlate 'virus warning' spam (185)
score VIRUS_WARNING185		3.0

# AF
rawbody VIRUS_WARNING186	/^<p>The WebShield&reg; .{1,50} Appliance discovered a virus/
describe VIRUS_WARNING186	Unhelpful WebShield 'virus warning' (186)
score VIRUS_WARNING186		10.0

# AF
header VIRUS_WARNING187		Subject =~ /^\s*"Returned due to virus/
describe VIRUS_WARNING187	Unhelpful WebShield 'virus warning' (187)
score VIRUS_WARNING187		2.0

# AF
# TJ: From WebShield, but fairly generic
rawbody VIRUS_WARNING188	/^\s*(Virus name|diagnostics\/Diagnose):/i
describe VIRUS_WARNING188	Looks like unhelpful 'virus warning' (188)
score VIRUS_WARNING188		1.5

# AF
# From some kind of Exchange-based scanner
header VIRUS_WARNING189		Subject =~ /^ALERT - Virus .{1,50} found/
describe VIRUS_WARNING189	Unhelpful 'virus warning' (189)
score VIRUS_WARNING189		8.0

# AF/TJ
rawbody VIRUS_WARNING190	/^(Infected\? Yes|Stato file:\s*Infetto)$/i
describe VIRUS_WARNING190	Unhelpful 'virus warning' (190)
score VIRUS_WARNING190		2.0

# TJ
# Mis-spelling is intentional!
rawbody VIRUS_WARNING191	/^WARNING! Virus foudn in attachment/
describe VIRUS_WARNING191	Unhelpful Wharf T&T 'virus warning' (191)
score VIRUS_WARNING191		10

# TJ
# Something to do with VirusWall?
# matches Mirapoint too (2004-07-14)
rawbody __VIRUS_WARNING192A	/^.{1,50} is removed from here because it contains a virus\.$/
rawbody __VIRUS_WARNING192B	/^-{40,80}( \(on .{1,50}\))?$/
meta VIRUS_WARNING192		__VIRUS_WARNING192A && __VIRUS_WARNING192B
describe VIRUS_WARNING192	Unhelpful 'virus warning' (192)
score VIRUS_WARNING192		20

# AF
header VIRUS_WARNING193		Subject =~ /Suppresion du Virus/
describe VIRUS_WARNING193	Looks like unhelpful 'virus warning' (193)
score VIRUS_WARNING193		2.0

# TJ
rawbody VIRUS_WARNING194	/^A possible virus was detected in your message/
describe VIRUS_WARNING194	Looks like unhelpful 'virus warning' (194)
score VIRUS_WARNING194		2.0

# TJ
rawbody VIRUS_WARNING195	/^.{1,50}\@.{1,50}: Email Content Not Allowed/
describe VIRUS_WARNING195	Could be unhelpful 'virus warning' (195)
score VIRUS_WARNING195		0.5

# AF
# From postmaster@
rawbody VIRUS_WARNING196	/^[a-zA-Z0-9_\-\.] detected a hostile content in this email and removed it/
describe VIRUS_WARNING196	Unhelpful 'virus warning' (196)
score VIRUS_WARNING196		6.0

# AF
header VIRUS_WARNING197		Subject =~ /^Tipo de arquivo anexo nao permitido!/
describe VIRUS_WARNING197	Unhelpful 'virus warning' (197)
score VIRUS_WARNING197		8.0

# TJ
header VIRUS_WARNING198		Subject =~ /^Illegal attachment type found in sent message/
describe VIRUS_WARNING198	Unhelpful qmail-scanner 'virus warning' (198)
score VIRUS_WARNING198		10

# TJ
rawbody VIRUS_WARNING199	/A Illegal attachment type was found in an Email message you sent\.$/
describe VIRUS_WARNING199	Unhelpful qmail-scanner 'virus warning' (199)
score VIRUS_WARNING199		4.0

# TJ
header VIRUS_WARNING200		Subject =~ /^Message Deleted:/
describe VIRUS_WARNING200	Unhelpful 'virus warning' (200)
score VIRUS_WARNING200		6.0

# TJ
rawbody VIRUS_WARNING201	/^An attachment \(.{0,99}\) in the message violated system permissions/
describe VIRUS_WARNING201	Unhelpful 'virus warning' (201)
score VIRUS_WARNING201		2.0

# TJ
meta VIRUS_WARNING201A		VIRUS_WARNING200 && VIRUS_WARNING201
describe VIRUS_WARNING201A	Unhelpful 'virus warning' (201A)
score VIRUS_WARNING201A		4.0

# TJ
# Seen from ipworldcom.ch
rawbody VIRUS_WARNING202	/^\s*\S+ is infected with/
describe VIRUS_WARNING202	Unhelpful 'virus warning' (202)
score VIRUS_WARNING202		3.0

# TJ
rawbody VIRUS_WARNING203	/^Your computer seems to send a message containing a virus/
describe VIRUS_WARNING203	Unhelpful 'virus warning' (203)
score VIRUS_WARNING203		3.0

# TJ
meta VIRUS_WARNING203A		VIRUS_WARNING202 && VIRUS_WARNING203
describe VIRUS_WARNING203A	Unhelpful 'virus warning' (203A)
score VIRUS_WARNING203A		4.0

# TJ
rawbody VIRUS_WARNING204	/^file contains virus:/
describe VIRUS_WARNING204	Unhelpful 'virus warning' (204)
score VIRUS_WARNING204		3.0

# TJ
header VIRUS_WARNING205		Subject =~ /\[.{1,50}: Virus detected\]$/
describe VIRUS_WARNING205	Unhelpful 'virus warning' (205)
score VIRUS_WARNING205		3.0

# TJ
rawbody VIRUS_WARNING206	/^This e-mail contained attachments which were virus infected/
describe VIRUS_WARNING206	Unhelpful 'virus warning' (206)
score VIRUS_WARNING206		2.5

# TJ
header VIRUS_WARNING207		Subject =~ /^RAV[0-9]+ Antivirus notification/
describe VIRUS_WARNING207	Unhelpful RAV 'virus warning' (207)
score VIRUS_WARNING207		20

# TJ
header VIRUS_WARNING208		Subject =~ /^Invalid content in mail message/
describe VIRUS_WARNING208	Unhelpful Kerio Mailserver 'virus warning' (208)
score VIRUS_WARNING208		7.5

# TJ
meta VIRUS_WARNING209		VIRUS_WARNING208 && VIRUS_WARNING188
describe VIRUS_WARNING209	Unhelpful Kerio Mailserver 'virus warning' (209)
score VIRUS_WARNING209		5.0

# TJ
rawbody VIRUS_WARNING210	/^This virus has been deleted/i
describe VIRUS_WARNING210	Unhelpful 'virus warning' (210)
score VIRUS_WARNING210		2.0

# AF
header VIRUS_WARNING211		Subject =~ /^IcoMailServer: Virus détect$/
describe VIRUS_WARNING211	Unhelpful IcoMailServer 'virus warning' (211)
score VIRUS_WARNING211		20

# AF
rawbody VIRUS_WARNING212	/^IcoMailServer Antivirus v[0-9\.]+ a détectén virus/
describe VIRUS_WARNING212	Unhelpful IcoMailServer 'virus warning' (212)
score VIRUS_WARNING212		5

# TJ
rawbody VIRUS_WARNING213	/^Bola Vam poslana elektronicka posta s prilohou. Obsahuje VIRUS!$/
describe VIRUS_WARNING213	Unhelpful 'virus warning'
score VIRUS_WARNING213		20

# MK
header VIRUS_WARNING214		Subject =~ /^ALERT!! Infected mail sent by you!$/
describe VIRUS_WARNING214	Unhelpful NAVMSE 'virus warning' (214)
score VIRUS_WARNING214		20

# AF
header VIRUS_WARNING215		Subject =~ /^NAV hat einen Virus oder nicht erlaubten Inhalt/
describe VIRUS_WARNING215	Unhelpful NAV 'virus warning' (215)
score VIRUS_WARNING215		20

# AF
rawbody VIRUS_WARNING216	/^The infected component in the scanned document was deleted\.$/
describe VIRUS_WARNING216	Unhelpful NAV 'virus warning' (216)
score VIRUS_WARNING216		5

# AF
rawbody VIRUS_WARNING217	/^The attachment \S+ contained the virus \S+/
describe VIRUS_WARNING217	Unhelpful NAV 'virus warning' (217)
score VIRUS_WARNING217		5

# PB/JT
# DSN: None
# note 2004-08-18: sometimes has trailing space
header VIRUS_WARNING218		Subject =~ /McAfee GroupShield Alert\s*$/
describe VIRUS_WARNING218	Unhelpful GroupShield 'virus warning'? (218)
score VIRUS_WARNING218		4

rawbody VIRUS_WARNING218A	/^Reason: Anti-Virus/

meta VIRUS_WARNING218B		VIRUS_WARNING218 && VIRUS_WARNING218A
describe VIRUS_WARNING218B	Definitely GroupShield 'virus warning' (218B)
score VIRUS_WARNING218B		20

# TJ
header VIRUS_WARNING219		Subject =~ /^Illegal Content Violation - Message [0-9]+$/
describe VIRUS_WARNING219	Unhelpful 'virus warning' (219)
score VIRUS_WARNING219		20

# MK
# Seen alonside 221
header VIRUS_WARNING220		Subject =~ /^Virus found in message from you!$/
describe VIRUS_WARNING220	Unhelpful Kaspersky 'virus warning' (220)
score VIRUS_WARNING220		20

# MK
header VIRUS_WARNING221		X-Mailer =~ /^Kaspersky SMTPSCAN/
describe VIRUS_WARNING221	Could be unhelpful Kaspersky 'virus warning' (221)
score VIRUS_WARNING221		2

# TJ
rawbody VIRUS_WARNING222	/^X-NAI-WebShield[a-zA-Z0-9]+-mimepp: Attachment repaired$/
describe VIRUS_WARNING222	Could be unhelpful NAI 'virus warning' (222)
score VIRUS_WARNING222		8

# MK/JT
header VIRUS_WARNING223		Subject =~ /^(Spam mail warning notification!|VirusWall has detected a sensitive e-mail !!!) \(Attachment Removal\)$/
describe VIRUS_WARNING223	Unhelpful eManager 'virus warning' (223)
score VIRUS_WARNING223		20

# MK/JT
rawbody VIRUS_WARNING224	/^(The following mail was blocked since it contains sensitive content|eManager has removed a sensitive attachment file in the email)\.$/
describe VIRUS_WARNING224	Unhelpful eManager 'virus warning'? (224)
score VIRUS_WARNING224		2.5

# PSI
header VIRUS_WARNING225		Subject =~ /^A Virus was detected in the message you sent$/i
describe VIRUS_WARNING225	Unhelpful MAILsweeper 'virus warning' (225)
score VIRUS_WARNING225		20

# TJ
rawbody VIRUS_WARNING226	/^\/var\/spool\/mailscanner.{1,50} Infection:/
describe VIRUS_WARNING226	Unhelpful MailScanner 'virus warning' (226)
score VIRUS_WARNING226		5

# AF
# BT-specific
body VIRUS_WARNING227		/^"An attempt has been made to send a file called \S+ into BT's e-mail/
describe VIRUS_WARNING227	Unhelpful BT 'virus warning' (227)
score VIRUS_WARNING227		10

# TJ
# Goes alonside 229
rawbody VIRUS_WARNING228	/^Found the \S+in message\.$/
describe VIRUS_WARNING228	Unhelpful 'virus warning' (228)
score VIRUS_WARNING228		2.5

# TJ
rawbody VIRUS_WARNING229	/^Found the (W32\/\S+|.{1,50}\@MM\S*)in message\.$/
describe VIRUS_WARNING229	Unhelpful 'virus warning' (229)
score VIRUS_WARNING229		10

# TJ
# Don't double count
meta VIRUS_WARNING229A	VIRUS_WARNING228 && VIRUS_WARNING229
describe VIRUS_WARNING229A	Don't double-count 228/229
score VIRUS_WARNING229A	-3.5

# PB
rawbody VIRUS_WARNING230	/^Dr\. Web (detailed )?report:$/
describe VIRUS_WARNING230	Unhelpful Dr. Web 'virus warning' (230)
score VIRUS_WARNING230		10

# PB
header VIRUS_WARNING231		Content-Type =~ /boundary="001-DrWeb-MailFilter-Notification"$/
describe VIRUS_WARNING231	Looks like Dr. Web notification (231)
score VIRUS_WARNING231		10

# PSI
rawbody VIRUS_WARNING232	/^Found virus .{1,50} in file .{1,50}$/
describe VIRUS_WARNING232	Unhelpful 'virus warning' (232)
score VIRUS_WARNING232		5

# PSI
rawbody VIRUS_WARNING233	/^The file is deleted\.$/
describe VIRUS_WARNING233	Looks like unhelpful 'virus warning' (233)
score VIRUS_WARNING233		1

# PSI
rawbody VIRUS_WARNING234	/^-+\s*Virus i denne meldingen er fjernet/
describe VIRUS_WARNING234	Looks like unhelpful 'virus warning' (234)
score VIRUS_WARNING234		4

# PSI
rawbody VIRUS_WARNING235	/^550 Error: The message probably contains the .{1,50} virus/
describe VIRUS_WARNING235	Could be unhelpful 'virus warning' (235)
score VIRUS_WARNING235		2

# AF
body VIRUS_WARNING236		/^Votre mail a été rejeté car il comporte une pièce jointe qui n'est pas acceptée par notre outil de filtrage/
describe VIRUS_WARNING236	Unhelpful 'virus warning' (236)
score VIRUS_WARNING236		7

# AF
# Could be virus infection too
header VIRUS_WARNING237		X-BitDefender-Scanner =~ /^Infected/
describe VIRUS_WARNING237	Unhelpful BitDefender 'virus warning' (237)
score VIRUS_WARNING237		10

# MK
rawbody VIRUS_WARNING238	/^Ihre Mail beinhaltete verbotene Anhänge !$/
describe VIRUS_WARNING238	Unhelpful 'virus warning' (238)
score VIRUS_WARNING238		20

# MK
header VIRUS_WARNING239		Subject =~ /^<WatchDog: Verbotener Dateianhang>$/
describe VIRUS_WARNING239	Unhelpful 'virus warning' (239)
score VIRUS_WARNING239		20

# PSI
header VIRUS_WARNING240		Subject =~ /^Advarsel! Dit e-brev indeholder virus$/
describe VIRUS_WARNING240	Unhelpful 'virus warning' (240)
score VIRUS_WARNING240		20

# PSI
# TrendMicro Interscan eManager
# apparently can FP when people set it up to reject otherwise-legit attachments
rawbody VIRUS_WARNING241	/^The attachment file in the message has been removed by eManager\.$/
describe VIRUS_WARNING241	Unhelpful Interscan 'virus warning'? (241)
score VIRUS_WARNING241		3

# PSI
rawbody VIRUS_WARNING242	/^ScanMail has detected a virus during a real-time scan of the mail traffic\.$/
describe VIRUS_WARNING242	Unhelpful ScanMail 'virus warning' (242)
score VIRUS_WARNING242		5

# PSI
header VIRUS_WARNING243		Subject =~ /^Virus Alert - ScanMail for Lotus Notes -->/
describe VIRUS_WARNING243	Unhelpful ScanMail 'virus warning' (243)
score VIRUS_WARNING243		20

# TJ
body VIRUS_WARNING244		/^Our content checker found\s+viruses/
describe VIRUS_WARNING244	Could be an unhelpful 'virus warning' (244)
score VIRUS_WARNING244		5

# TJ
meta VIRUS_WARNING245		VIRUS_WARNING179 && VIRUS_WARNING244
describe VIRUS_WARNING245	Unhelpful 'virus warning' (245)
score VIRUS_WARNING245		20

# PSI
rawbody VIRUS_WARNING246	/^was stopped by MailSweeper because it contained an executable file\.$/
describe VIRUS_WARNING246	Unhelpful 'virus warning' (246)
score VIRUS_WARNING246		20

# TJ
rawbody VIRUS_WARNING247	/^Zalaczony plik (.{1,50}) zawiera wirusa +(.{1,50}) \.$/
describe VIRUS_WARNING247	Unhelpful 'virus warning' (247)
score VIRUS_WARNING247		20

# TJ
rawbody VIRUS_WARNING248	/^Disallowed attach type$/
describe VIRUS_WARNING248	Unhelpful 'virus warning' (248)
score VIRUS_WARNING248		20

# PSI
body VIRUS_WARNING249		/^This mail is not complete because a part of it \(body or attachment\) violated Norman Gateway Protection/
describe VIRUS_WARNING249	Unhelpful 'virus warning' (249)
score VIRUS_WARNING249		20

# HPK
# This is a general rule which will catch lots of MailScanner stuff.
# MailScanner is a real PITA.
rawbody VIRUS_WARNING250	/^This is a message from the MailScanner E-Mail Virus Protection Service/
describe VIRUS_WARNING250	Some kind of MailScanner notification? (250)
score VIRUS_WARNING250		1.5

# HPK
body VIRUS_WARNING251		/The file .{1,50} has been replaced as it contains the\s+.{1,50} virus\./
describe VIRUS_WARNING251	Unhelpful GroupShield/Exch 'virus warning' (251)
score VIRUS_WARNING251		20

# HPK
rawbody VIRUS_WARNING252	/^\*+\s+McAfee GroupShield for Microsoft Exchange\s+\*+$/
describe VIRUS_WARNING252	Unhelpful GroupShield/Exch 'virus warning' (252)
score VIRUS_WARNING252		10

# TJ
body VIRUS_WARNING253		/please (check your system for viruses|update your virus scanner|run an antivirus program)/i
describe VIRUS_WARNING253	Asks you to check for viruses (253)
score VIRUS_WARNING253		0.5

# MK
# Variant on 43
header VIRUS_WARNING254		Subject =~ /^VIRUS \(.{1,50}\) IN MAIL$/
describe VIRUS_WARNING254	Unhelpful 'virus warning' (254)
score VIRUS_WARNING254		20

# MK
rawbody VIRUS_WARNING255	/^VIRUS-WARNUNG$/
describe VIRUS_WARNING255	Looks like unhelpful 'virus warning' (255)
score VIRUS_WARNING255		5

# MK
rawbody VIRUS_WARNING256	/^Our virus checker found/i
describe VIRUS_WARNING256	Could be unhelpful 'virus warning' (256)
score VIRUS_WARNING256		3

# MK
rawbody VIRUS_WARNING257	/^Content violation found in email message\.$/
describe VIRUS_WARNING257	Unhelpful 'virus warning' (257)
score VIRUS_WARNING257		20

# MK
# Site-specific, sigh
body VIRUS_WARNING258		/had an attachment that is not accepted by the American Red Cross Email System/
describe VIRUS_WARNING258	Unhelpful 'virus warning' (258)
score VIRUS_WARNING258		20

# TJ
# The bit in the middle has been seen as "Inbound Messages"/"Anti-Virus (Inbound)"/"Content Security (Inbound)"
rawbody VIRUS_WARNING259	/^MailMarshal Rule: .{1,50} : Block (Dangerous Attachments|EXECUTABLE Files|Known Virus Attachments|Virus|Stripped Attachments|Executables|Script and Code)$/
describe VIRUS_WARNING259	Unhelpful MailMarshal 'virus warning' (259)
score VIRUS_WARNING259		20

# DJM/AF
rawbody VIRUS_WARNING260	/^(ScanMail for Microsoft Exchange has detected virus-infected attachment\(s\)\.|Warning to sender\. ScanMail has detected a virus in an email you sent\.)$/
describe VIRUS_WARNING260	Unhelpful ScanMail/Exch 'virus warning' (260)
score VIRUS_WARNING260		20

# AF
# Not null-sender
header VIRUS_WARNING261		Subject =~ /^Alerte de l'Anti-virus$/
describe VIRUS_WARNING261	Unhelpful 'virus warning' (261)
score VIRUS_WARNING261		20

# AF
# Seen with 261
rawbody VIRUS_WARNING262	/^Details: (.{1,50}) Infected with/
describe VIRUS_WARNING262	Unhelpful 'virus warning'? (262)
score VIRUS_WARNING262		5

# AF
header VIRUS_WARNING263		Subject =~ /^Attachment Filter$/
describe VIRUS_WARNING263	Unhelpful 'virus warning' (263)
score VIRUS_WARNING263		10

# AF
# With/without null sender
body VIRUS_WARNING264		/\*\*\*L'anti-virus AXERGY a détecté un virus (et l'a enlevé|ou une pièce jointe interdite dans ce mail)/
describe VIRUS_WARNING264	Unhelpful 'virus warning' (264)
score VIRUS_WARNING264		20

# AF
# DSN: Null, CT
# Big thanks to Alan for helping to get rid of this big annoyance!
# AOL handle aol.com, netscape.net, cs.com
full __VIRUS_WARNING265		/mx\.aol\.com..The original message was received.{35,45}^from ([-.\w]+ (?<!aol\.com )\[[.\d]+\]).{1,99}^Content-Type: text\/rfc822-headers..Received: from\s\s(aol\.com|netscape\.net|cs\.com) \(\1\)/ms
meta VIRUS_WARNING265		__REPORT_DSN && __VIRUS_WARNING265
describe VIRUS_WARNING265	Unhelpful AOL bounce fake aol.com HELO (265)
score VIRUS_WARNING265		15

# AF/TJ
# DSN: Null, CT
# Similar to 265, but catches unqualified HELOs that aren't aol.com
full __VIRUS_WARNING265A        /mx\.aol\.com..The original message was received.{35,45}^from ([-.\w]+ (?<!aol\.com )\[[.\d]+\]).{1,99}^Content-Type: text\/rfc822-headers..Received: from\s\s[a-zA-Z0-9]+ \(\1\)/ms
meta VIRUS_WARNING265A          __REPORT_DSN && __VIRUS_WARNING265A
describe VIRUS_WARNING265A      Looks like unhelpful AOL virus bounce (265A)
score VIRUS_WARNING265A         5

# AF
# DSN: Null, CT
# Similar to 265, but catches mail received from hosts with no rDNS
full __VIRUS_WARNING265B	/mx\.aol\.com..The original message was received.{35,45}^from\s\s(\[[.\d]+\]).{1,99}^Content-Type: text\/rfc822-headers..Received: from\s\saol\.com \(\1\)/ms
meta VIRUS_WARNING265B		__REPORT_DSN && __VIRUS_WARNING265B
describe VIRUS_WARNING265B	AOL accept faked aol.com HELO (no PTR) (265B)
score VIRUS_WARNING265B		15

# PSI
# DSN: Null, CT
rawbody __VIRUS_WARNING266	/^Telenor Plus Virus Scan detected a virus in an e-mail you sent/
meta VIRUS_WARNING266		__REPORT_DSN && __VIRUS_WARNING266
describe VIRUS_WARNING266	Unhelpful Telenor 'virus warning' (266)
score VIRUS_WARNING266		15

# AF
# DSN: Null
# Another stupid big ISP which should know better
header VIRUS_WARNING267		Subject =~ /^Mail virus incident report$/
describe VIRUS_WARNING267	Unhelpful Via Networks 'virus warning' (267)
score VIRUS_WARNING267		20

# AF/TJ
# General proactive rule - catches stuff about infections, asserted to start
# of line (optionally with spaces)
rawbody __VIRUS_WARNING268X	/^\s*(infected(:|\s(with|file))|contain(ed|s) (a|the) (virus|viruses):|quarantine$)/i
describe __VIRUS_WARNING268X	Could be unhelpful 'virus warning'? (268X)

# TJ
# We split Sender and To off and only match if they have a preceding space
# to avoid hits on forwards etc. with a Sender: header in the body
rawbody __VIRUS_WARNING268A	/^\s*(mail from|originator)\s*[:=]/i
rawbody __VIRUS_WARNING268B	/^(\s+(sender|from)\s*:|\s*(sender|from)\s*=)/i
rawbody __VIRUS_WARNING268C	/^\s*(((the )?(e-?)?mail )?recipient(s|\(s\))?|(e-?)?mail sent to)\s*[:=]/i
rawbody __VIRUS_WARNING268D	/^(\s+to\s*:|\s*to\s*=)/i
meta __VIRUS_WARNING_SENDREC	(__VIRUS_WARNING268A || __VIRUS_WARNING268B) && (__VIRUS_WARNING268C || __VIRUS_WARNING268D)

meta VIRUS_WARNING268E		(__VIRUS_WARNING268X && __VIRUS_WARNING_SENDREC)
describe VIRUS_WARNING268E	Looks like an unhelpful 'virus warning' (268E)
score VIRUS_WARNING268E		3

# May catch FP's - forwards etc. with Sender: in the body
rawbody __VIRUS_WARNING268F	/^(sender|from)\s*:.{1,50}/i
body __VIRUS_WARNING268G	/contain(ed|s) (a|the) virus/

# This may catch some FP's - hence score low
meta VIRUS_WARNING268H		(__VIRUS_WARNING268C || __VIRUS_WARNING268D) && __VIRUS_WARNING268F && (__VIRUS_WARNING268X || __VIRUS_WARNING268G)
describe VIRUS_WARNING268H	Could be unhelpful 'virus warning' (268H)
score VIRUS_WARNING268H		1


# TJ
rawbody VIRUS_WARNING269	/^This Email scanner intercepted it and stopped the entire message/
describe VIRUS_WARNING269	Unhelpful 'virus warning' (269)
score VIRUS_WARNING269		15

# NL
header VIRUS_WARNING270		Subject =~ /^Trovato virus nel messaggio/
describe VIRUS_WARNING270	Unhelpful 'virus warning' (270)
score VIRUS_WARNING270		10

# NL
rawbody VIRUS_WARNING271	/^Symantec AntiVirus ha trovato un virus in un allegato inviato/
describe VIRUS_WARNING271	Unhelpful 'virus warning' (271)
score VIRUS_WARNING271		5

# MR
header VIRUS_WARNING272		Subject =~ /^Viruswarnung$/
describe VIRUS_WARNING272	Unhelpful 'virus warning' (272)
score VIRUS_WARNING272		10

# DJM
header VIRUS_WARNING273		Subject =~ /^MailMonitor for Exchange has processed a suspicious mail$/
describe VIRUS_WARNING273	Unhelpful MailMonitor/Exch 'virus warning' (273)
score VIRUS_WARNING273		10

# TJ
body VIRUS_WARNING274		/The email you have sent to (\S+) has the virus/
describe VIRUS_WARNING274	Unhelpful MIMEsweeper 'virus warning' (274)
score VIRUS_WARNING274		5

# TJ
body VIRUS_WARNING275		/Scenarios\/Incoming/
describe VIRUS_WARNING275	Unhelpful (MIMESweeper?) 'virus warning'? (275)
score VIRUS_WARNING275		1

# TJ
# MIMESweeper?
body VIRUS_WARNING276		/Threat: '[^']{1,50}' detected by '[^']{1,50}'/
describe VIRUS_WARNING276	Unhelpful MIMEsweeper 'virus warning'? (276)
score VIRUS_WARNING276		1

# TJ
body VIRUS_WARNING277		/A filename matching the file mask was detected: '[^']{1,50}'\./
describe VIRUS_WARNING277	Unhelpful (MIMESweeper?) 'virus warning'? (277)
score VIRUS_WARNING277		1

# TJ
# Sophos/MIMEsweeper
meta VIRUS_WARNING278		((VIRUS_WARNING110 + VIRUS_WARNING274 + VIRUS_WARNING275 + VIRUS_WARNING276 + VIRUS_WARNING277) > 2)
describe VIRUS_WARNING278	Unhelpful Sophos/MIMEswp 'virus warning'? (277)
score VIRUS_WARNING278		5

# TJ
# Another sadly misguided/out of date Exim user
rawbody VIRUS_WARNING279	/^===== WARNING! WARNING! WARNING! - POSSIBLE VIRUS!/
describe VIRUS_WARNING279	Unhelpful 'virus warning' (279)
score VIRUS_WARNING279		20

# JT
# eTrust Lotus Notes Domino
header VIRUS_WARNING280		Subject =~ /^eTrust Antivirus Lotus Notes Domino Option detected virus!$/
describe VIRUS_WARNING280	Unhelpful eTrust/Domino 'virus warning' (280)
score VIRUS_WARNING280		20

# TJ
rawbody VIRUS_WARNING281	/^The Ansbacher Email Gateway has stopped the following message:$/
describe VIRUS_WARNING281	Unhelpful 'virus warning' (281)
score VIRUS_WARNING281		20

# TJ
rawbody VIRUS_WARNING282	/^Status: 550 .{1,50} Unacceptable attachment \(170\)./
describe VIRUS_WARNING282	Unhelpful 'virus warning' (282)
score VIRUS_WARNING282		10

# PSI
header VIRUS_WARNING283		Subject =~ /^Symantec Mail Security detected that you sent a message containing prohibited content$/
describe VIRUS_WARNING283	Unhelpful Symantec 'virus warning' (283)
score VIRUS_WARNING283		20

# VD
header VIRUS_WARNING284		Subject =~ /^Virus infection detected!!!$/
describe VIRUS_WARNING284	Unhelpful 'virus warning' (284)
score VIRUS_WARNING284		20

# AF
header VIRUS_WARNING285		Subject =~ /^gefaehrlicher Anhang \(.{1,50}\) FROM YOUR E- MAIL ADDRESS$/
describe VIRUS_WARNING285	Unhelpful 'virus warning' (285)
score VIRUS_WARNING285		20

# TJ
# Not null sender, or any other DSN indications
header VIRUS_WARNING286		Subject =~ /^Warning - Virus detected in email$/
describe VIRUS_WARNING286	Unhelpful 'virus warning' (286)
score VIRUS_WARNING286		20

# TJ
# Seen from postmaster@g-icap.com, no DSN indications
rawbody VIRUS_WARNING287	/^This message has been blocked because it contains a virus\./
describe VIRUS_WARNING287	Unhelpful 'virus warning' (287)
score VIRUS_WARNING287		20

# HD
header VIRUS_WARNING288		Subject =~ /-- Email Scanner Report \[\d+\]$/
describe VIRUS_WARNING288	Looks like unhelpful 'virus warning' (288)
score VIRUS_WARNING288		5

# HD
rawbody VIRUS_WARNING289	/^Your email to <[^>]{1,50}> was blocked by our email scanning system!$/
describe VIRUS_WARNING289	Unhelpful 'virus warning' (289)
score VIRUS_WARNING289		20

# PSI
# No DSN indications
header VIRUS_WARNING290		X-Originator =~ /^MailScan$/
describe VIRUS_WARNING290	Unhelpful MailScan 'virus warning' (290)
score VIRUS_WARNING290		5

# PSI
# See also 290
header VIRUS_WARNING291		Subject =~ /^Virus Warning from MailScan to Mail-Sender!$/
describe VIRUS_WARNING291	Unhelpful MailScan 'virus warning' (291)
score VIRUS_WARNING291		20

# TJ
# DSN: Null, CT, !Attach
# This rule MUST check for DSN; InterScan sometimes adds this junk to
# non-infected mails
rawbody __VIRUS_WARNING292	/^\*+\s*Message from InterScan E-Mail VirusWall NT\s*\*+$/
meta VIRUS_WARNING292		__REPORT_DSN && __VIRUS_WARNING292
describe VIRUS_WARNING292	Unhelpful InterScan 'virus warning' (292)
score VIRUS_WARNING292		20

# TJ
# DSN: No DSN indications
# Seen from MAILsweeper@Dyson.com
header VIRUS_WARNING293		Subject =~ /^Warning Possible Virus Alert !!!$/
describe VIRUS_WARNING293	Unhelpful MAILsweeper 'virus warning' (293)
score VIRUS_WARNING293		20

# TJ
# DSN: Null, CT, !Attach
rawbody VIRUS_WARNING294	/^The attachment to your E-mail has been disabled by the SonicWALL Virus Filter\./
describe VIRUS_WARNING294	Unhelpful SonicWALL 'virus warning' (294)
score VIRUS_WARNING294		20

# AF
# DSN: None
rawbody VIRUS_WARNING295	/^A message filter removed the following attachment\(s\) from this message: .{1,50}/
describe VIRUS_WARNING295	Unhelpful 'virus warning' (295)
score VIRUS_WARNING295		10

# AF
# DSN: Null
# Custom message from some particularly clue-impaired people at iucindore.ernet.in
rawbody VIRUS_WARNING296	/^Viruswall at IUC server has scaned the mail\.$/
describe VIRUS_WARNING296	Unhelpful 'virus warning' (296)
score VIRUS_WARNING296		20

# AF
# DSN: Null, but could potentially vary as we're trying to catch instances
# where someone scans the mail but bounces the infected version
rawbody VIRUS_WARNING297	/^X-AMaViS-Alert: INFECTED, message contains virus:/
describe VIRUS_WARNING297	Unhelpful 'virus warning' (297)
score VIRUS_WARNING297		20

# TJ
header VIRUS_WARNING298         Subject =~ /^\[Magic OnLine\] Suppression du Virus/
describe VIRUS_WARNING298       Unhelpful Magic OnLine 'virus warning' (296)
score VIRUS_WARNING298          20

# PB
# See also 19
rawbody VIRUS_WARNING299	/^Recipient of the infected attachment:/
describe VIRUS_WARNING299	Unhelpful Norton Antivirus 'virus warning' (299)
score VIRUS_WARNING299		5

# AF
# This should be caught by other MailScanner rules, but is here in case
# they fail (e.g. bounced bounce etc.)
rawbody VIRUS_WARNING300	/^Warning: Please read the "VirusWarning\.txt" attachment\(s\) for more information\.$/
describe VIRUS_WARNING300	Unhelpful MailScanner 'virus warning' (300)
score VIRUS_WARNING300		20

# HD
#Trend Micro GateLock
header VIRUS_WARNING301		Subject =~ /^GateLock (Virus Notification|Viren-Benachrichtigung)\.$/
describe VIRUS_WARNING301	Unhelpful GateLock 'virus warning' (301)
score VIRUS_WARNING301		20

# DP
header VIRUS_WARNING302		Subject =~ /^NOTICE - Rejected atta?chment$/
describe VIRUS_WARNING302	Unhelpful Watchdog 'virus warning' (302)
score VIRUS_WARNING302		20

# TJ
# DSN: Null
# Seen with "Creative Labs corporate" in place of .{1,50}; not sure if a customised
# message or not
# MessageSoft StormMail
header VIRUS_WARNING303		Subject =~ /^The .{1,50} email system has detected a banned or restricted attachment in your mail\./
describe VIRUS_WARNING303	Unhelpful StormMail 'virus warning' (303)
score VIRUS_WARNING303		20

# TJ
# see also 303
# MessageSoft StormMail
header VIRUS_WARNING304		X-Mailer =~ /^MessageSoft StormMail$/
describe VIRUS_WARNING304	Unhelpful StormMail 'virus warning'? (304)
score VIRUS_WARNING304		5

# HD
rawbody VIRUS_WARNING305	/^A potentially dangerous document attachment not complying with our IT Security policy has been detected/
describe VIRUS_WARNING305	Unhelpful 'virus warning' (305)
score VIRUS_WARNING305		10

# MK
header VIRUS_WARNING306		Subject =~ /^VIRUS WARNING( :)?$/
describe VIRUS_WARNING306	Unhelpful 'virus warning' (306)
score VIRUS_WARNING306		20

# MK/JT
header VIRUS_WARNING307		Subject =~ /^Virus Found\.?$/i
describe VIRUS_WARNING307	Unhelpful 'virus warning' (307)
score VIRUS_WARNING307		20

# MK
header VIRUS_WARNING308		Subject =~ /^AVAST ALERT$/
describe VIRUS_WARNING308	Unhelpful Avast/Exch 'virus warning' (308)
score VIRUS_WARNING308		20

# MK
# Seen with 308
rawbody VIRUS_WARNING309	/^You sent an infected message!$/
describe VIRUS_WARNING309	Unhelpful Avast/Exch 'virus warning' (309)
score VIRUS_WARNING309		5

# MK
header VIRUS_WARNING310		Subject =~ /^Atención: Virus detectado en e-mail$/
describe VIRUS_WARNING310	Unhelpful 'virus warning' (310)
score VIRUS_WARNING310		20

# MK
header VIRUS_WARNING311		Subject =~ /^Virus detected in:/
describe VIRUS_WARNING311	Unhelpful 'virus warning' (311)
score VIRUS_WARNING311		10

# MK/TJ
header VIRUS_WARNING312		Subject =~ /^\[GWAVA:[a-z0-9]+\] (Attachment block|Virus detect) message notification$/
describe VIRUS_WARNING312	Unhelpful Novell GroupWise 'virus warning' (312)
score VIRUS_WARNING312		20

# MK/JT
rawbody VIRUS_WARNING313	/^\*+ (eManager|Content Filter) Notification \*+$/
describe VIRUS_WARNING313	Unhelpful eManager 'virus warning' (313)
score VIRUS_WARNING313		20

# MK
rawbody VIRUS_WARNING314	/^Rejected by Kingsoft-EYOU Antivirus Gateway for the following reason:$/
describe VIRUS_WARNING314	Unhelpful Kingsoft 'virus warning' (314)
score VIRUS_WARNING314		20

# MK
header VIRUS_WARNING315		Subject =~ /^Message Blocked /
describe VIRUS_WARNING315	Could be an unhelpful 'virus warning' (315)
score VIRUS_WARNING315		3

# MK
header VIRUS_WARNING316		Subject =~ /^\s*File was infected with a virus$/
describe VIRUS_WARNING316	Unhelpful 'virus warning' (316)
score VIRUS_WARNING316		20

# MK
header VIRUS_WARNING317		Subject =~ /^\*\*\* You have sent a virus !$/
describe VIRUS_WARNING317	Unhelpful 'virus warning' (317)
score VIRUS_WARNING317		20

# MK
rawbody VIRUS_WARNING318	/^WARNING - Virus detected in message:$/
describe VIRUS_WARNING318	Unhelpful 'virus warning' (318)
score VIRUS_WARNING318		20

# TJ
rawbody VIRUS_WARNING319	/^Requested action not taken: virus detected$/
describe VIRUS_WARNING319	Unhelpful 'virus warning' (319)
score VIRUS_WARNING319		20

# PSI
# DSN: Null
rawbody VIRUS_WARNING320	/^This following attachments is removed by TBS Virus Scan/
describe VIRUS_WARNING320	Unhelpful TBS Virus Scan 'virus warning' (320)
score VIRUS_WARNING320		20

# PSI
# See also 320
# DSN: Null
header VIRUS_WARNING321		Subject =~ /^NOTICE - Attachments removed$/
describe VIRUS_WARNING321	Unhelpful TBS Virus Scan 'virus warning' (321)
score VIRUS_WARNING321		10

# MK
header VIRUS_WARNING322A	Subject =~ /\(Blocked attachment\)$/
describe VIRUS_WARNING322A	Looks like unhelpful XWall 'virus warning' (322A)
score VIRUS_WARNING322A		2

header __VIRUS_WARNING322B	X-Mailer =~ /^XWall v/

meta VIRUS_WARNING322		VIRUS_WARNING322A && __VIRUS_WARNING322B
describe VIRUS_WARNING322	Unhelpful XWall 'virus warning' (322)
score VIRUS_WARNING322		20

# AF
# Also seen bounced, see 324
header VIRUS_WARNING323		Subject =~ /^\[VIRUS FOUND AND REMOVED\]/
describe VIRUS_WARNING323	Unhelpful 'virus warning' (323)
score VIRUS_WARNING323		10

# AF
rawbody __VIRUS_WARNING324	/^Subject: \[VIRUS FOUND AND REMOVED\]/
meta VIRUS_WARNING324		__VIRUS_WARNING324 && __REPORT_DSN
describe VIRUS_WARNING324	Unhelpful 'virus warning' (324)
score VIRUS_WARNING324		10

# AF
# DSN: Null, CT
rawbody VIRUS_WARNING325	/^\s*Reason: Virus \S+ is detected!$/
describe VIRUS_WARNING325	Unhelpful 'virus warning' (325)
score VIRUS_WARNING325		20

# AF/TJ
full VIRUS_WARNING326		/Content-type: text\/plain; Name=VirusAlert.txt/
describe VIRUS_WARNING326	Unhelpful MailScanner 'virus warning'? (326)
score VIRUS_WARNING326		3

# AF
# DSN: Anyone's guess. Has been seen forging the victim as RP etc.
# TJ: There has got to be a better way of doing "multiline text anchored 
# to start of a line" than this...if anyone knows please tell me!
body __VIRUS_WARNING327A	/An attachment named \S+ was removed from this document as it constituted a security hazard\./
rawbody __VIRUS_WARNING327B	/^An attachment named \S+ was removed from this document as it$/
meta VIRUS_WARNING327		__VIRUS_WARNING327A && __VIRUS_WARNING327B
describe VIRUS_WARNING327	Unhelpful MIMEDefang 'virus warning' (327)
score VIRUS_WARNING327		10

# TJ
# DSN: Null
header VIRUS_WARNING328		Subject =~ /^VIRUS REJECT$/
describe VIRUS_WARNING328	Unhelpful 'virus warning' (328)
score VIRUS_WARNING328		20

# AS
header VIRUS_WARNING329		Subject =~ /^BitDefender found an infected object$/
describe VIRUS_WARNING329	Unhelpful 'virus warning' (329)
score VIRUS_WARNING329		20

# TJ
# DSN: None
body VIRUS_WARNING330		/the message with following attributes has not been delivered, because it contains infected object\(s\)./
describe VIRUS_WARNING330	Unhelpful 'virus warning' (330)
score VIRUS_WARNING330 		10

# TJ
body VIRUS_WARNING331		/A message sent from, or apparently sent from, your email address, failed due to the presence of files frequently used to transmit viruses \(\.scr\/\.zip\/\.bat\/\.com\/\.exe\)\./
describe VIRUS_WARNING331	Unhelpful 'virus warning' (331)
score VIRUS_WARNING331		15

# AF
# DSN: None
header VIRUS_WARNING332		Subject =~ /^\[Computer Cops\] Infected Email Found$/
describe VIRUS_WARNING332	Unhelpful 'virus warning' (332)
score VIRUS_WARNING332		20

# AF
rawbody VIRUS_WARNING333	/^\*+ UNSAFE FILE IS REJECTED! \*+$/
describe VIRUS_WARNING333	Unhelpful 'virus warning' (333)
score VIRUS_WARNING333		20

# AF
rawbody VIRUS_WARNING334	/^\s*Reason: This email is rejected because an unsafe file is found:/
describe VIRUS_WARNING334	Unhelpful 'virus warning' (334)
score VIRUS_WARNING334		10

# TJ
# Custom? From Uni. of Sydney
# DSN: Null, CT
rawbody VIRUS_WARNING335	/^\# The following files were found to be malicious and removed:$/
describe VIRUS_WARNING335	Unhelpful 'virus warning' (335)
score VIRUS_WARNING335		20

# AF
rawbody VIRUS_WARNING336	/^the message contains virus/
describe VIRUS_WARNING336	Could be unhelpful KAV 'virus warning' (336)
score VIRUS_WARNING336		1

# AF
rawbody VIRUS_WARNING337	/^\s*The message contains file attachments that are not permitted\.\s*$/
describe VIRUS_WARNING337	Unhelpful Guinevere AV 'virus warning' (337)
score VIRUS_WARNING337		10

# TJ
# Could be custom message - seen from postmaster@disney.com
# DSN: Null
header VIRUS_WARNING338		Subject =~ /^Warning: Message Not Delivered - Attachment Restriction$/
describe VIRUS_WARNING338	Unhelpful 'virus warning' (338)
score VIRUS_WARNING338		20

# TJ
# DSN: Null, CT, !Attach
rawbody VIRUS_WARNING339	/^Warning: Please read the "ISSWarning\.txt" attachment\(s\) for more information\.$/
describe VIRUS_WARNING339	Unhelpful MailScanner 'virus warning' (339)
score VIRUS_WARNING339		20

# TJ
rawbody VIRUS_WARNING340	/^Warning: This message has had one or more attachments removed$/
describe VIRUS_WARNING340	Unhelpful MailScanner 'virus warning' (340)
score VIRUS_WARNING340		10

# TJ/TV
header VIRUS_WARNING341		Subject =~ /^eTrust Antivirus Gateway (SMTP|POP3): Virus notification message$/
describe VIRUS_WARNING341	Unhelpful eTrust 'virus warning' (341)
score VIRUS_WARNING341		20

# TJ
header VIRUS_WARNING342		Subject =~ /^AUTOMATED EMAIL BLOCK: VIRUS$/
describe VIRUS_WARNING342	Unhelpful 'virus warning' (342)
score VIRUS_WARNING342		20

# TJ
# Hopefully this should really kill all the variations of VirusWall/eManager junk
header VIRUS_WARNING343		InterScan-Notification =~ /^yes$/
describe VIRUS_WARNING343	Unhelpful InterScan 'virus warning' (343)
score VIRUS_WARNING343		20

# TJ
# seen as VIRUS (foobar) EM SUA MENSAGEM
# DSN: Null, CT
header VIRUS_WARNING344		Subject =~ /^VIRUS.{0,99} EM SUA MENSAGEM$/
describe VIRUS_WARNING344	Unhelpful 'virus warning' (344)
score VIRUS_WARNING344		20

# AF
body VIRUS_WARNING345		/(This message contained attachments that have been blocked by Guinevere|This is an automatic message from the Guinevere Internet Antivirus Scanner)\./
describe VIRUS_WARNING345	Unhelpful Guinevere 'virus warning' (345)
score VIRUS_WARNING345		5

rawbody VIRUS_WARNING345A	/^\s*The message (apparently|probably) contains a virus\.\s*$/
describe VIRUS_WARNING345A	Uhelpful Guinevere 'virus warning'? (345A)
score VIRUS_WARNING345A		2

meta VIRUS_WARNING345B		VIRUS_WARNING345 && VIRUS_WARNING345A
describe VIRUS_WARNING345B	Unhelpful Guinevere 'virus warning' (345B)
score VIRUS_WARNING345B		10

# AF
# Guinevere crap again
rawbody VIRUS_WARNING346	/^\w+\s+attachment type\(s\) blocked\s*$/
describe VIRUS_WARNING346	Unhelpful Guinevere 'virus warning' (346)
score VIRUS_WARNING346		5

# AF
rawbody VIRUS_WARNING347	/^KAV for MS Exchange Report on detecting virus in the following message:$/
describe VIRUS_WARNING347	Unhelpful KAV 'virus warning' (347)
score VIRUS_WARNING347		10

# AF
header VIRUS_WARNING348		Subject =~ /Report Message from KAV for MS Exchange Server/
describe VIRUS_WARNING348	Unhelpful KAV 'virus warning'? (348)
score VIRUS_WARNING348		3

# TJ
# DSN: none, modified message
full VIRUS_WARNING349		/filename="Panda_Alert\.txt"/
describe VIRUS_WARNING349	Unhelpful Panda Antivirus 'virus warning' (349)
score VIRUS_WARNING349		10

# TJ
# DSN: none, modified message
rawbody VIRUS_WARNING350	/^Panda Antivirus has found a virus in:/
describe VIRUS_WARNING350	Unhelpful Panda Antivirus 'virus warning' (350)
score VIRUS_WARNING350		10

# TJ
# DSN: unknown
rawbody VIRUS_WARNING351	/^Message from SENDER was quarantined because it contained banned$/
describe VIRUS_WARNING351	Unhelpful 'virus warning' (351)
score VIRUS_WARNING351		20

# AF
# DSN: None
rawbody VIRUS_WARNING352	/^This Mail has a Virus and has been blocked!$/
describe VIRUS_WARNING352	Unhelpful 'virus warning' (352)
score VIRUS_WARNING352		20

# TJ
# DSN: Null, CT
# This regex is extraordinarily sensitive for some reason (surely "\s+.{1,50}\s+" 
# should be the same as "[^"]{1,50}" ? Apparently not!); handle with care!
full VIRUS_WARNING353		/Your message was not delivered to the following recipients:\s*.{1,50}\s*:\s*Email rejected\s+because the attachment\s+.{1,50}\s+could contain a virus\./m
describe VIRUS_WARNING353	Unhelpful 'virus warning' (353)
score VIRUS_WARNING353		20

# PSI
# DSN: None
rawbody __VIRUS_WARNING354A	/\s*The email contained the virus: .{0,99}$/
header __VIRUS_WARNING354B	X-Nmp-Notice-Type =~ /^A message from you was blocked/
meta VIRUS_WARNING354           __VIRUS_WARNING354A && __VIRUS_WARNING354B
describe VIRUS_WARNING354	Unhelpful 'virus warning' (354)
score VIRUS_WARNING354		20

# GD/JT
# DSN: None
# TJ: This is sometimes sent in HTML, so cannot assert the body text
header __VIRUS_WARNING355A	Subject =~ /^Report to Sender$/
body __VIRUS_WARNING355B	/Incident Information:-/
body __VIRUS_WARNING355C	/infected with the \S+ virus and was/
meta VIRUS_WARNING355		__VIRUS_WARNING355A && __VIRUS_WARNING355B && __VIRUS_WARNING355C
describe VIRUS_WARNING355	Unhelpful Lotus Notes 'virus warning' (355)
score VIRUS_WARNING355		20

# HD
# DSN: None
rawbody VIRUS_WARNING356	/^A mail message with subject "[^"]{1,50}" has been found to contain a virus!$/
describe VIRUS_WARNING356	Unhelpful 'virus warning' (356)
score VIRUS_WARNING356		20

# AF
# DSN: Null, CT
header VIRUS_WARNING357		Subject =~ /^\*\*Message you sent blocked by our bulk email filter\*\*$/
describe VIRUS_WARNING357	Unhelpful 'virus warning' (357)
score VIRUS_WARNING357		20

# TJ
# DSN: Null
rawbody VIRUS_WARNING358	/^The above email was not delivered to the intended recipient as it was found to contain a virus\. The details of the message are as follows:$/
describe VIRUS_WARNING358	Unhelpful 'virus warning' (358)
score VIRUS_WARNING358		20

# AF
# DSN: None
header __VIRUS_WARNING359A	Subject =~ /^VIRUS POSLAN SA VASE ADRESE/
rawbody __VIRUS_WARNING359B	/^UPOZORENJE O VIRUSIMA!$/
meta VIRUS_WARNING359		__VIRUS_WARNING359A || __VIRUS_WARNING359B
describe VIRUS_WARNING359	Unhelpful 'virus warning' (359)
score VIRUS_WARNING359		20

# HD
header VIRUS_WARNING360		Subject =~ /^virus in outgoing mail$/
describe VIRUS_WARNING360	Unhelpful 'virus warning' (360)
score VIRUS_WARNING360		20

# JT
# DSN: Null, CT
rawbody VIRUS_WARNING361	/^WARNING -- A POSSIBLE VIRUS WAS DETECTED IN THIS MAIL MESSAGE$/
describe VIRUS_WARNING361	Unhelpful 'virus warning' (361)
score VIRUS_WARNING361		20

# MB
body VIRUS_WARNING362           /\bThe mail you have sent to one of our users is infected by a virus\b/
describe VIRUS_WARNING362       Unhelpful 'virus warning' (361)
score VIRUS_WARNING362          20

# TJ
header VIRUS_WARNING363		Subject =~ /^Warning: Virus found by AVAS Anti-Virus module$/
describe VIRUS_WARNING363	Unhelpful AVAS 'virus warning' (363)
score VIRUS_WARNING363		20

# TJ
# see http://www.antespam.co.uk/, run by David Pinnegar; further information at:
#  http://www.antespam.co.uk/how-we-filter-spam/
#  http://www.info-team.co.uk/david.pinnegar/
#  http://www.hammerwood.mistral.co.uk/compdoc.htm
#  http://www.info-world.com/spam.diagnosis/
#  http://www.info-team.co.uk/spam-stopper.php
# Although acknowledging that they arise, David asserts that BVAs from his
# systems are not sent out as a "blanket" response to viruses.
# 
# This rule is therefore commented out by default for now.
# Make your own decision about whether to enable it or not; you can contact
# David via the above site to discuss his policies.
#rawbody VIRUS_WARNING364	/^www.antespam.co.uk has intercepted a message from your address:-$/
#describe VIRUS_WARNING364	Unhelpful 'virus warning' (364)
#score VIRUS_WARNING364		20

# AF/TJ
full __VIRUS_WARNING365	/Content-Disposition: attachment;\s*filename=\"DELETED0.TXT\"/m
meta VIRUS_WARNING365		__REPORT_DSN && __VIRUS_WARNING365
describe VIRUS_WARNING365	Unhelpful 'virus warning' (365)
score VIRUS_WARNING365		20

# TJ
full __VIRUS_WARNING366        /Content-Disposition: attachment;\s*filename=\"AV_nocleanMsg\.txt\"/m
meta VIRUS_WARNING366           __REPORT_DSN && __VIRUS_WARNING366
describe VIRUS_WARNING366       Unhelpful 'virus warning' (366)
score VIRUS_WARNING366         20

# JT
# DSN: Null, CT
rawbody __VIRUS_WARNING367	/^554 5\.7\.1 Virus \S+ found in mail - rejected$/
meta VIRUS_WARNING367		__REPORT_DSN && __VIRUS_WARNING367
describe VIRUS_WARNING367	Unhelpful 'virus warning' (367)
score VIRUS_WARNING367		20

# AF
# DSN: Null, CT
rawbody VIRUS_WARNING368	/^\[Attachment denied by WatchGuard SMTP proxy/
describe VIRUS_WARNING368	Unhelpful 'virus warning' (368)
score VIRUS_WARNING368		20

# TJ
# DSN: Null
header VIRUS_WARNING369		Subject =~ /^Warning: E-mail virus detected$/
describe VIRUS_WARNING369	Unhelpful 'virus warning' (369)
score VIRUS_WARNING369		20

# AF
# DSN: Null
header VIRUS_WARNING370		X-Mailer =~ /^ProScan Mail scanner$/
describe VIRUS_WARNING370	Unhelpful ProScan 'virus warning' (370)
score VIRUS_WARNING370		20

# AF
# DSN: Null
# See also 370 - goes alongside it
rawbody VIRUS_WARNING371	/^\s*The file attached to following mail is infected with virus\.$/
describe VIRUS_WARNING371	Unhelpful 'virus warning' (371)
score VIRUS_WARNING371		20

# AF
# DSN: Null, CT
# This is for bounced collateral munged by a scanner
rawbody  VIRUS_WARNING372	/Subject: \[PMX:suspect attachment\]/
describe VIRUS_WARNING372	Unhelpful 'virus warning' (372)
score VIRUS_WARNING372		20

# PB
rawbody VIRUS_WARNING373	/^Il contenait un fichier attache non autoris/
describe VIRUS_WARNING373	Unhelpful 'virus warning' (373)
score VIRUS_WARNING373		20

# PB
rawbody VIRUS_WARNING374	/^Our SPAM\/CONTENT filter has rejected your message/
describe VIRUS_WARNING374	Unhelpful 'virus warning' (374)
score VIRUS_WARNING374		20

# AF
# DSN: None
rawbody VIRUS_WARNING375	/^\s*AAPT Anti Virus has detected a virus contained in this email attachment/
describe VIRUS_WARNING375	Unhelpful 'virus warning' (375)
score VIRUS_WARNING375		20

# TJ
# DSN: Null
# It's a shame some of the largest e-mail providers in the world
# (Yahoo in this case) are such idiots and hypocrites (wrt "anti-spam")
body VIRUS_WARNING376		/554 5\.7\.1 Message cannot be accepted, virus found/
describe VIRUS_WARNING376	Unhelpful 'virus warning' (376)
score VIRUS_WARNING376		20

# AF
# DSN: Null, CT
header VIRUS_WARNING377		Subject =~ /^ALERTE VIRUS !$/
describe VIRUS_WARNING377	Unhelpful 'virus warning' (377)
score VIRUS_WARNING377		20

# TJ
# DSN: Null
rawbody VIRUS_WARNING378	/^Attachment has been removed due to the presence of the following virus:$/
describe VIRUS_WARNING378	Unhelpful 'virus warning' (378)
score VIRUS_WARNING378		20

# TJ
# as seen in 378
full VIRUS_WARNING379		/filename="ReplText6\.txt"/
describe VIRUS_WARNING379	Could be unhelpful 'virus warning' (379)
score VIRUS_WARNING379		0.8

# RP
rawbody VIRUS_WARNING380	/^This message was rejected due to a possible virus\.$/
describe VIRUS_WARNING380	Unhelpful 'virus warning' (380)
score VIRUS_WARNING380		20

# PSI
# DSN: Null
rawbody VIRUS_WARNING381	/^Sender Note - Inbound Virus Found$/
describe VIRUS_WARNING381	Unhelpful 'virus warning' (381)
score VIRUS_WARNING381		20

# TJ
# DSN: None
body VIRUS_WARNING382		/it contains an attachment that does not conform to the HMV Email Policy/
describe VIRUS_WARNING382	Unhelpful HMV 'virus warning' (382)
score VIRUS_WARNING382		20

# TJ
# DSN: Null
header VIRUS_WARNING383		Subject =~ /^Unfortunately your message was blocked as a possible Virus was detected\.$/
describe VIRUS_WARNING383	Unhelpful 'virus warning' (383)
score VIRUS_WARNING383		20

# MB
# DSN: Null
header VIRUS_WARNING384		Subject =~ /^Virus trovato in un messaggio inviato/
describe VIRUS_WARNING384	Unhelpful 'virus warning' (384)
score VIRUS_WARNING384		20

# MB
# DSN: Null
header VIRUS_WARNING385		Subject =~ /^ACHTUNG! Sie haben eine mit einem Virus infizierte Mail verschickt\.$/
describe VIRUS_WARNING385	Unhelpful 'virus warning' (385)
score VIRUS_WARNING385		20

# AF
rawbody VIRUS_WARNING386	/^The following message attachments were flagged by the antivirus scanner:$/
describe VIRUS_WARNING386	Unhelpful Mirapoint 'virus warning' (386)
score VIRUS_WARNING386		20

# AF
# DSN: none
# Seen from postmaster@fife.gov.uk
# They even KNOW that virus spew is forged, but still send you the junk anyway...
# surely incriminating themselves!
rawbody VIRUS_WARNING387	/^has not been delivered as a virus has been detected. This e-mail may not have originated from you/
describe VIRUS_WARNING387	Unhelpful 'virus warning' (387)
score VIRUS_WARNING387		20

# AF
# DSN: none
header VIRUS_WARNING388		Subject =~ /^Virus Alert -/
describe VIRUS_WARNING388	Unhelpful 'virus warning' (388)
score VIRUS_WARNING388		10

# TJ
# DSN: none
# seen from administrator@shgroup.org.uk
rawbody VIRUS_WARNING389	/^A message with Subject: \S+ contains a virus and has been quarantined\.$/
describe VIRUS_WARNING389	Unhelpful 'virus warning' (389)
score VIRUS_WARNING389		20

# TJ/JT
# DSN: varies, this is a general rule
# see also 179
header VIRUS_WARNING390		Subject =~ /^VIRUS ALERT:/
describe VIRUS_WARNING390	Unhelpful 'virus warning' (390)
score VIRUS_WARNING390		20

# JT
# DSN: None
# usually caught also by 390
header VIRUS_WARNING391		X-Mailer =~ /^OdeiaVir/
describe VIRUS_WARNING391	Unhelpful OdeiaVir 'virus warning' (391)
score VIRUS_WARNING391		20

# AF
# DSN: null
header VIRUS_WARNING392		Subject =~ /^Suppression de fichier due a un virusMail Delivery/
describe VIRUS_WARNING392	Unhelpful 'virus warning' (392)
score VIRUS_WARNING392		20

# AF
# DSN: null
body VIRUS_WARNING393		/The Attachment \S+ is replaced by this message because it contained a virus:/
describe VIRUS_WARNING393	Unhelpful 'virus warning' (393)
score VIRUS_WARNING393		20 

# JT
# DSN: !Attach
body VIRUS_WARNING394		/A virus \(\S+\) was detected in the file \(.{1,50}\)\. Action taken\s*= remove/
describe VIRUS_WARNING394	Unhelpful 'virus warning' (394)
score VIRUS_WARNING394		20

# AF
header VIRUS_WARNING395		Received =~ /from MailMarshal/
describe VIRUS_WARNING395	MailMarshal bogus 'virus warning'? (395)
score VIRUS_WARNING395		3

# AF
header VIRUS_WARNING396		Subject =~ /^McAfee detected a virus in a document sent to you\.$/
describe VIRUS_WARNING396	Unhelpful McAfee 'virus warning' (396)
score VIRUS_WARNING396		20

# HPK
# DSN: none
body VIRUS_WARNING397		/A virus was found in a message sent by this account\./
describe VIRUS_WARNING397	Unhelpful 'virus warning' (397)
score VIRUS_WARNING397		8

# HPK
# see also 397
rawbody VIRUS_WARNING398	/^Result: Virus Detected$/
describe VIRUS_WARNING398	Unhelpful 'virus warning' (398)
score VIRUS_WARNING398		5

# AF
# DSN: none
# matches 400 too
body VIRUS_WARNING399	/The file attached to this email was removed because it is infected with the (\S+) virus\./
describe VIRUS_WARNING399	Unhelpful 'virus warning' (399)
score VIRUS_WARNING399		20

# AF
# General
rawbody VIRUS_WARNING400	/^\s*name="DELETED0.TXT"$/
describe VIRUS_WARNING400	Looks like unhelpful 'virus warning' (400)
score VIRUS_WARNING400		5

# AF/TV
# DSN: none
header VIRUS_WARNING401		Subject =~ /^\[VIRUS\??\]/i
describe VIRUS_WARNING401	Unhelpful 'virus warning' (401)
score VIRUS_WARNING401		10


# HPK
# DSN: CT
# the next two come together
rawbody VIRUS_WARNING402A	/^Virus scanner reported virus infection for/
describe VIRUS_WARNING402A	Looks like unhelpful 'virus warning' (402A)
score VIRUS_WARNING402A		5

rawbody VIRUS_WARNING402B	/^Reason: Virus infection$/
describe VIRUS_WARNING402B	Looks like unhelpful 'virus warning' (402B)
score VIRUS_WARNING402B		5

meta VIRUS_WARNING402C		VIRUS_WARNING402A && VIRUS_WARNING402B
describe VIRUS_WARNING402C	Looks a lot like unhelpful 'virus warning' (402C)
score VIRUS_WARNING402C		10


# JT
# DSN: null,CT
header VIRUS_WARNING403		Subject =~ /^Returned mail: Possible Virus Infection$/
describe VIRUS_WARNING403	Unhelpful 'virus warning' (403)
score VIRUS_WARNING403		20

# PBR
# DSN: null, !Attach
rawbody VIRUS_WARNING404	/^= Message body deleted by antivirus subsystem on e-mail gateway=$/
describe VIRUS_WARNING404	Unhelpful 'virus warning' (404)
score VIRUS_WARNING404		20

# PC
# DSN: unknown
rawbody VIRUS_WARNING405	/^Virus: "\S+" found!$/
describe VIRUS_WARNING405	Unhelpful WinProxy 'virus warning' (405)
score VIRUS_WARNING405		20

#AF
# DSN: none
header VIRUS_WARNING406		Subject =~ /^\[NOD32: deleted\]/
describe VIRUS_WARNING406	Unhelpful NOD32 'virus warning' (406)
score VIRUS_WARNING406		20

# AF
# double-check for 406
rawbody VIRUS_WARNING407	/^Warning: NOD32 Antivirus System for Linux Mail Server found the following infiltrations in this message/
describe VIRUS_WARNING407	Unhelpful NOD32 'virus warning' (407)
score VIRUS_WARNING407		10

# TV
header VIRUS_WARNING408		Subject =~ /^AVISO: Email rejeitado: VIRUS Detectado$/
describe VIRUS_WARNING408	Unhelpful 'virus warning' (408)
score VIRUS_WARNING408		20

# TV
header VIRUS_WARNING409		Subject =~ /^MDaemon Notificacion - Virus Encontrado!!!!$/
describe VIRUS_WARNING409	Unhelpful MDaemon 'virus warning' (409)
score VIRUS_WARNING409		20

# TV
# the Netcabo version appears to be a customised Antigen install
header VIRUS_WARNING410		Subject =~ /^(Antigen|Netcabo Antivirus) found \S+ virus$/
describe VIRUS_WARNING410	Unhelpful MDaemon 'virus warning' (410)
score VIRUS_WARNING410		20

# TV
header VIRUS_WARNING411		Subject =~ /^ATENTIE !!! Virusi detectati$/
describe VIRUS_WARNING411	Unhelpful 'virus warning' (411)
score VIRUS_WARNING411		20

#TV
rawbody VIRUS_WARNING412	/^Vírus no seu e-mail\./
describe VIRUS_WARNING412	Unhelpful 'virus warning' (412)
score VIRUS_WARNING412		20

# TV
header VIRUS_WARNING413		Subject =~ /^Virus found, original message not delivered\.$/
describe VIRUS_WARNING413	Unhelpful InterScan 'virus warning' (413)
score VIRUS_WARNING413		20

# TV
rawbody VIRUS_WARNING414	/^We received a message from you containing a virus or other harmful content\.$/
describe VIRUS_WARNING414	Unhelpful 'virus warning' (414)
score VIRUS_WARNING414		20

# PC
rawbody VIRUS_WARNING415	/^RAV AntiVirus for Linux i686 version: \d/
describe VIRUS_WARNING415	Unhelpful 'virus warning'? (415)
score VIRUS_WARNING415		2

# PC
# not sure what the munged character is or whether this rule will even catch it
# email forwarded to me had munged character encoding
header VIRUS_WARNING416		Subject =~ /Resultado da procura por V.rus$/
describe VIRUS_WARNING416	Unhelpful 'virus warning' (416)
score VIRUS_WARNING416		3

# PC
header VIRUS_WARNING417		X-Mailer =~ /^ravmd\/\d/
describe VIRUS_WARNING417	Unhelpful 'virus warning'? (417)
score VIRUS_WARNING417		3

# ML
rawbody VIRUS_WARNING418	/^This attachment contained a virus and was stripped\.$/
describe VIRUS_WARNING418	Unhelpful 'virus warning' (418)
score VIRUS_WARNING418		20

# ML
header VIRUS_WARNING419		Subject =~ /^\[Virus attachment removed\]/
describe VIRUS_WARNING419	Unhelpful 'virus warning' (419)
score VIRUS_WARNING419		20

# MM
rawbody VIRUS_WARNING420	/^O Symantec Email Proxy excluiu a seguinte mensagem de e-mail:$/
describe VIRUS_WARNING420	Unhelpful 'virus warning' (420)
score VIRUS_WARNING420		20

# PBR
rawbody VIRUS_WARNING421	/^Disallowed file (.{1,50}) assosiated with unrelated MIME type (.{1,50}) - potential virus$/
describe VIRUS_WARNING421	Unhelpful 'virus warning' (421)
score VIRUS_WARNING421		4

# PC
rawbody VIRUS_WARNING422	/^Content-Disposition: attachment; filename="Norton AntiVirus Deleted1.txt"$/
describe VIRUS_WARNING422	Unhelpful 'virus warning'? (422)
score VIRUS_WARNING422		8

header VIRUS_WARNING423		Subject =~ /^Policy Violation$/
describe VIRUS_WARNING423	Unhelpful 'virus warning'? (423)
score VIRUS_WARNING423		0.1

meta VIRUS_WARNING424		VIRUS_WARNING188 && VIRUS_WARNING423
describe VIRUS_WARNING424	Unhelpful 'virus warning' (424)
score VIRUS_WARNING424		10

header VIRUS_WARNING425		Subject =~ /^Mail rejected: Executable attachment "[^"]{1,50}" not permitted\.$/
describe VIRUS_WARNING425	Unhelpful 'virus warning' (425)
score VIRUS_WARNING425		20

header VIRUS_WARNING426		Subject =~ /^Antivirus Notification$/
describe VIRUS_WARNING426	Unhelpful 'virus warning' (426)
score VIRUS_WARNING426		20

# TV
header VIRUS_WARNING427		Subject =~ /^Mail delivery error : Virus found$/
describe VIRUS_WARNING427	Unhelpful 'virus warning' (427)
score VIRUS_WARNING427		20

# TV
header VIRUS_WARNING428		Subject =~ /^Virus Detected in Email...$/
describe VIRUS_WARNING428	Unhelpful InteProtectNow! 'virus warning' (428)
score VIRUS_WARNING428		20

# TV
header VIRUS_WARNING429		Subject =~ /^Mass Mailing Virus Detected - Message was deleted.$/
describe VIRUS_WARNING429	Unhelpful 'virus warning' (429)
score VIRUS_WARNING429		20

# AF
header VIRUS_WARNING430		Subject =~ /^Iflex Mail Server detected an unrepairable virus in a message you sent/
describe VIRUS_WARNING430	Unhelpful Iflex 'virus warning' (430)
score VIRUS_WARNING430		20

# TV
rawbody VIRUS_WARNING431	/^Norton AntiVirus (hat folgende E-Mail gelöscht, da sie einen Virus enthielt:|ha eliminato il seguente messaggio di posta elettronica )$/
describe VIRUS_WARNING431	Unhelpful Norton 'virus warning' (431)
score VIRUS_WARNING431		20

# NL
# see also 420
header VIRUS_WARNING432		Subject =~ /^Symantec Email Proxy Deleted Message$/
describe VIRUS_WARNING432	Unhelpful Symantec 'virus warning' (432)
score VIRUS_WARNING432	20

# PB
rawbody VIRUS_WARNING433	/^diagnostics\/Diagnose: (Worm|Virus)\./
describe VIRUS_WARNING433	Unhelpful 'virus warning'? (433)
score VIRUS_WARNING433		4

# PB
header VIRUS_WARNING434		X-Autoreply-Reason =~ /^(Worm|Virus)\./
describe VIRUS_WARNING434	Unhelpful 'virus warning' (434)
score VIRUS_WARNING434		20

# AF
# DSN: null
rawbody VIRUS_WARNING435	/^<<< 554 5\.7\.1 Message from .{7,30} rejected because  is infected/
describe VIRUS_WARNING435	Unhelpful 'virus warning' (435)
score VIRUS_WARNING435		20

# ML
header VIRUS_WARNING436		Subject =~ /^Virus in einer E-Mail von Ihnen gefunden!$/
describe VIRUS_WARNING436	Unhelpful AntiVir MailGate 'virus warning' (436)
score VIRUS_WARNING436		20

# MB
# TJ: this has no relation to 436, I just numbered it wrongly. Thanks Donald Dawson for spotting.
rawbody VIRUS_WARNING436a	/^550 This message contains malware/
describe VIRUS_WARNING436a	Unhelpful 'virus warning' (436)
score VIRUS_WARNING436a		20

# TJ
rawbody VIRUS_WARNING437	/^(Symantec E-Mail-Proxy hat folgende E-Mail-Nachricht gelöscht|Le proxy de messagerie Symantec a supprimé l'message suivant ):$/
describe VIRUS_WARNING437	Unhelpful Symantec 'virus warning' (437)
score VIRUS_WARNING437		20

# TV
header VIRUS_WARNING438		Subject =~ /^VIRUS DETECTADO PARA /
describe VIRUS_WARNING438	Unhelpful 'virus warning' (438)
score VIRUS_WARNING438		20

# TJ
rawbody VIRUS_WARNING439	/^\*\*\* Aquest missatge contenia virus. \*\*\*$/
describe VIRUS_WARNING439	Unhelpful Trend 'virus warning' (439)
score VIRUS_WARNING439		20

# JT
header VIRUS_WARNING440		Subject =~ /^WARNING VIRUS FOUND!!!$/
describe VIRUS_WARNING440	Unhelpful 'virus warning' (440)
score VIRUS_WARNING440		20

# TV
header VIRUS_WARNING441		Subject =~ /^mensagem com virus$/
describe VIRUS_WARNING441	Unhelpful 'virus warning' (441)
score VIRUS_WARNING441		20

# JT
rawbody VIRUS_WARNING442	/^Viruses were detected in the following components:$/
describe VIRUS_WARNING442	Unhelpful 'virus warning' (442)
score VIRUS_WARNING442		10

# TV
header VIRUS_WARNING443		Subject =~ /^Panda ClientShield warning$/
describe VIRUS_WARNING443	Unhelpful 'virus warning' (443)
score VIRUS_WARNING443		10

# JT
rawbody VIRUS_WARNING444	/^The original email was deleted because it contained the virus .{1,50}$/
describe VIRUS_WARNING444	Unhelpful 'virus warning' (444)
score VIRUS_WARNING444		10

# TV
header VIRUS_WARNING445		Subject =~ /^Your mail was deleted by Norton Antivirus$/
describe VIRUS_WARNING445	Unhelpful Norton 'virus warning' (445)
score VIRUS_WARNING445		20

# TV
header VIRUS_WARNING446		Subject =~ /^Auto Notification : Virus Detected!!$/
describe VIRUS_WARNING446	Unhelpful 'virus warning' (446)
score VIRUS_WARNING446		20

# AF
header VIRUS_WARNING447		Subject =~ /^Warning: Possible Virus Infection$/
describe VIRUS_WARNING447	Unhelpful Guinevere 'virus warning' (447)
score VIRUS_WARNING447		20

# TV
header VIRUS_WARNING448		Subject =~ /^Anti-Virus Alert$/
describe VIRUS_WARNING448	Unhelpful 'virus warning' (448)
score VIRUS_WARNING448		20

# TV
header VIRUS_WARNING449		Subject =~ /^Aviso: Detectado formato de ficheiros invalido\.$/
describe VIRUS_WARNING449	Unhelpful 'virus warning'? (449)
score VIRUS_WARNING449		10

# TJ
header VIRUS_WARNING450		Subject =~ /^VIRUS ALERT !$/
describe VIRUS_WARNING450	Unhelpful 'virus warning' (450)
score VIRUS_WARNING450		20

# TV
header VIRUS_WARNING451		Subject =~ /^Content Filter Processed Your E-Mail$/
describe VIRUS_WARNING451	Unhelpful 'virus warning'? (451)
score VIRUS_WARNING451		2

# TV
rawbody VIRUS_WARNING452	/^Reason: Anti Virus$/
describe VIRUS_WARNING452	Unhelpful 'virus warning'? (452)
score VIRUS_WARNING452		2

# TV
meta VIRUS_WARNING453		VIRUS_WARNING451 && VIRUS_WARNING452
describe VIRUS_WARNING453	Unhelpful virus warning (453)
score VIRUS_WARNING453		10

# PB
# TODO:needs work, subject is encoded
header VIRUS_WARNING454		Subject =~ /InterScan MSS has deleted a message/
describe VIRUS_WARNING454	Unhelpful virus warning (454)
score VIRUS_WARNING454		20

# HB
header VIRUS_WARNING455		Subject =~ /^\[WatchDog: Virus gefunden\]$/
describe VIRUS_WARNING455	Unhelpful virus warning (455)
score VIRUS_WARNING455		20

# TV
header VIRUS_WARNING456	Subject =~ /^AVISO: VIRUS Detectado$/
describe VIRUS_WARNING456	Unhelpful virus warning (456)
score VIRUS_WARNING456		20

# TV
header VIRUS_WARNING457	Subject =~ /^\[avast! - INFECTED\]/
describe VIRUS_WARNING457	Unhelpful virus warning (457)
score VIRUS_WARNING457		20

# JT
rawbody VIRUS_WARNING458	/^A message you sent was virus infected\.$/
describe VIRUS_WARNING458	Unhelpful virus warning? (458)
score VIRUS_WARNING458		3

meta VIRUS_WARNING459	VIRUS_WARNING458 && VIRUS_WARNING63
describe VIRUS_WARNING459	Unhelpful virus warning (459)
score VIRUS_WARNING459	10

# NL
# DSN: none
header VIRUS_WARNING460	Subject =~ /^\[VIRUS-DETECTED\]/
describe VIRUS_WARNING460	Unhelpful virus warning (460)
score VIRUS_WARNING460	20

# TV
# DSN: unknown
header VIRUS_WARNING461	Subject =~ /^VIRUS DETECTED IN MESSAGE:/
describe VIRUS_WARNING461	Unhelpful virus warning (461)
score VIRUS_WARNING461	20

# PB
# DSN: unknown
header VIRUS_WARNING462	Subject =~ /^CSAV for Exchange - Virus Alert$/
describe VIRUS_WARNING462	Unhelpful virus warning (462)
score VIRUS_WARNING462	20

# TV
# DSN: unknown
header VIRUS_WARNING463	Subject =~ / VIRUS FOUND$/
describe VIRUS_WARNING463	Unhelpful virus warning? (463)
score VIRUS_WARNING463	2

rawbody __VIRUS_WARNING464	/^You have sent a virus infected email message/
meta VIRUS_WARNING464	VIRUS_WARNING463 && __VIRUS_WARNING464
describe VIRUS_WARNING464	Unhelpful virus warning (464)
score VIRUS_WARNING464	20

# TV
header VIRUS_WARNING465	Subject =~ /^SENDER! Virus found in message from you!$/
describe VIRUS_WARNING465	Unhelpful virus warning (465)
score VIRUS_WARNING465	20

# ML
header VIRUS_WARNING466	Subject =~ /^Virus Warning from eScan to Mail-Sender!$/
describe VIRUS_WARNING466	Unhelpful eScan virus warning (466)
score VIRUS_WARNING466	20

# JT
header VIRUS_WARNING467	Subject =~ /^Warning generated by Panda GateDefender\.$/
describe VIRUS_WARNING467	Unhelpful Panda virus warning (467)
score VIRUS_WARNING467	20

# JK
# TJ: Juno *really* should know better...
header VIRUS_WARNING468	Subject =~ /^ALERT: Email you sent may have contained a virus$/
describe VIRUS_WARNING468	Unhelpful Juno virus warning (468)
score VIRUS_WARNING468	20

# ML
header VIRUS_WARNING469	Subject =~ /^\*\*VIRUS\*\*/
describe VIRUS_WARNING469	Unhelpful virus warning (468)
score VIRUS_WARNING469	20


### TJ: Executable. Could be a virus
# See http://archives.neohapsis.com/archives/postfix/2002-04/1841.html
# and http://archives.neohapsis.com/archives/postfix/2002-04/1931.html
rawbody VIRUS_WARNING_EXE1	/^TV[nopqr][A-Z]...[AB]..A.A....{1,99}AAAA...{1,99}AAAA/
describe VIRUS_WARNING_EXE1	Message appears to contain a Windows executable
score VIRUS_WARNING_EXE1	2.0

rawbody VIRUS_WARNING_EXE2	/^M35[GHIJK].`..`..{1,99}````/i
describe VIRUS_WARNING_EXE2	Message contains a UUencoded Windows executable
score VIRUS_WARNING_EXE2	2.0


### HD/TJ: Looks like some (unknown) virus

# TJ/RN
# Sober variants which are bothering everyone at the moment (2005-05-06)
rawbody VIRUS_WARNING_SOBER	/^\*\*\* (Server-AntiVirus|Attachment-Scanner|AntiVirus): (No Virus \(Clean\)|Status OK|No Virus found)$/
describe VIRUS_WARNING_SOBER	Looks like Sober virus or bounce thereof
score VIRUS_WARNING_SOBER	20


# Netsky variation?
# line starts with +-+-+ or *** ...
rawbody VIRUS_WARNING_XXX1	/^[\+\-\*]+ (Anti-\s?Virus|X-\s?Attachment_\s?Scanner|Mail-\s?Attachment|X-\s?Mail_Scanner): (NO VIRUS|No Virus found|No Virus!?|No suspicious Virus signatures)$/
describe VIRUS_WARNING_XXX1	Unidentified virus or bounce thereof (2)
score VIRUS_WARNING_XXX1	20

### TJ: Novarg, I think
header __VIRUS_WARNING_NOVARG1A X-Virus-Scanned =~ /^Symantec AntiVirus Scan Engine$/
header __VIRUS_WARNING_NOVARG1B	X-Virus-Scan-Result =~ /^Repaired \d+/
meta VIRUS_WARNING_NOVARG1	__VIRUS_WARNING_NOVARG1A && __VIRUS_WARNING_NOVARG1B
describe VIRUS_WARNING_NOVARG1	Looks like Novarg virus
score VIRUS_WARNING_NOVARG1	20

# Bounce of Novarg
rawbody __VIRUS_WARNING_NOVARG2A /^\s*X-Virus-Scanned: Symantec AntiVirus Scan Engine$/
rawbody __VIRUS_WARNING_NOVARG2B /^\s*X-Virus-Scan-Result: Repaired \d+/
meta VIRUS_WARNING_NOVARG2      __VIRUS_WARNING_NOVARG2A && __VIRUS_WARNING_NOVARG2B
describe VIRUS_WARNING_NOVARG2	Looks like Novarg virus bounce
score VIRUS_WARNING_NOVARG2     20

### TJ: Texts normally found in the body of Bagle.B viruses

rawbody VIRUS_WARNING_BAGLE1	/^Subject: ID .{1,50}\.\.\. thanks$/
describe VIRUS_WARNING_BAGLE1	Could be a Bagle.B bounce
score VIRUS_WARNING_BAGLE1	4

rawbody VIRUS_WARNING_BAGLE2	/^Yours ID/
describe VIRUS_WARNING_BAGLE2	Could be a Bagle.B bounce
score VIRUS_WARNING_BAGLE2	1


### TJ: Bagle-Q/R virus

rawbody VIRUS_WARNING_BAGLE3	/^<OBJECT\s+STYLE="display:none"\s+DATA="http:\/\/[0-9\.]+(:81)?\/[0-9]+\.php">$/
describe VIRUS_WARNING_BAGLE3	Looks like Bagle.Q/R virus/bounce
score VIRUS_WARNING_BAGLE3	10


### TJ: Stuff to do with Netsky virus

rawbody __VIRUS_WARNING_NETSKY1	/^Subject: (unknown|fake|stolen|information|warning|something for you|read it immediately|hello)$/
#describe VIRUS_WARNING_NETSKY1	Could be a Netsky virus bounce (subject matched)
#score VIRUS_WARNING_NETSKY1	1

rawbody __VIRUS_WARNING_NETSKY2	/^(anything ok?|what does it mean?|ok|i'm waiting|read the details.|here is the document.|read it immediately!|my hero|here|is that true?|is that your name?|is that your account?|i wait for a reply!|is that from you?|you are a bad writer|I have your password!|something about you!|kill the writer of this document!|i hope it is not true!|your name is wrong|i found this document about you|yes, really?|that is bad|here it is|see you|greetings|stuff about you?|something is going wrong!|information about you|about me|from the chatter|here, the serials|here, the introduction|here, the cheats|that's funny|do you?|reply|take it easy|why?|thats wrong|misc|you earn money|you feel the same|you try to steal|you are bad|something is going wrong|something is fool)$/
#describe VIRUS_WARNING_NETSKY2	Could be a Netsky virus bounce (body matched)
#score VIRUS_WARNING_NETSKY2	1

meta VIRUS_WARNING_NETSKY	(__VIRUS_WARNING_NETSKY1 && __VIRUS_WARNING_NETSKY2)
score VIRUS_WARNING_NETSKY	3

# Netsky G - http://www.sophos.com/virusinfo/analyses/w32netskyg.html
# There are many other subjects, but many are too common to reject on, 
# and I don't want this to become a virus scanner, but here are a few.
body VIRUS_WARNING_NETSKY3	/^Subject: Re: (Re: Re: Your document|Re: Thanks!|Re: Document|Re: Message|Approved|Here is the document|Excel file|Word file)$/
describe VIRUS_WARNING_NETSKY4	Netsky virus bounce (subject matched)
score VIRUS_WARNING_NETSKY3	3

body VIRUS_WARNING_NETSKY4	/In order to read the attach you have to use the following password:/
describe VIRUS_WARNING_NETSKY4	Looks like Netsky bounce (body attached password)
score VIRUS_WARNING_NETSKY4	5

# Netsky P - http://www.sophos.com/virusinfo/analyses/w32netskyp.html
# VS/TJ
rawbody VIRUS_WARNING_NETSKY5A	/^\++\s*Attachment: No Virus found$/
describe VIRUS_WARNING_NETSKY5A	Looks like Netsky/P bounce (5A)
score VIRUS_WARNING_NETSKY5A	10

rawbody VIRUS_WARNING_NETSKY5B	/^\++\s*(MessageLabs|Norton|MC-Afee|Kaspersky|Norman|Panda|Kaspersky|F-Secure) AntiVirus/
describe VIRUS_WARNING_NETSKY5B	Looks like Netsky/P bounce (5B)
score VIRUS_WARNING_NETSKY5B	10

meta VIRUS_WARNING_NETSKY5	VIRUS_WARNING_NETSKY5A && VIRUS_WARNING_NETSKY5B
describe VIRUS_WARNING_NETSKY5	Looks like Netsky/P bounce (5)
score VIRUS_WARNING_NETSKY5	10

### TJ: Texts normally found in the body of MyDoom viruses

rawbody VIRUS_WARNING_MYDOOM1	/The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment/
describe VIRUS_WARNING_MYDOOM1	Body contains Mydoom text
score VIRUS_WARNING_MYDOOM1	6.0

rawbody VIRUS_WARNING_MYDOOM2	/The message contains Unicode characters and has been sent as a binary attachment\./
describe VIRUS_WARNING_MYDOOM2	Body contains Mydoom text
score VIRUS_WARNING_MYDOOM2	6.0

rawbody VIRUS_WARNING_MYDOOM3	/Mail transaction failed. Partial message is available\./
describe VIRUS_WARNING_MYDOOM3	Body contains Mydoom text
score VIRUS_WARNING_MYDOOM3	6.0

# Looks like a bounce containing a Mydoom message
# Some bounces will match both 4 and 4a, so 4a is scored low
# Next two rules used to contain a question mark at the end, to match
# empty subject lines. Now removed, since the worst has passed
rawbody __VIRUS_WARNING_MYDOOM4	/^Subject: (Hello|hi|test|mail delivery system|mail transaction failed|server report|status|error)$/i
#describe VIRUS_WARNING_MYDOOM4	Body looks like a bounce which could be from Mydoom (contains Mydoom Subject)
#score VIRUS_WARNING_MYDOOM4	1.3

rawbody __VIRUS_WARNING_MYDOOM4A	/\sSubject: (Hello|hi|test|mail delivery system|mail transaction failed|server report|status|error)$/i
#describe VIRUS_WARNING_MYDOOM4A	Body could be a Mydoom bounce (contains Mydoom Subject)
#score VIRUS_WARNING_MYDOOM4A	0.5

rawbody TJ_EMPTY_SUBJECT	/^Subject: $/
describe TJ_EMPTY_SUBJECT		Empty subject. Could be a MyDoom bounce.
score TJ_EMPTY_SUBJECT	0.5

# Could be a bounce containing a Mydoom message
body VIRUS_WARNING_MYDOOM5	/filename="(body|data|doc|document|file|message|readme|test)\.(bat|cmd|exe|pif|scr|zip|htm|txt|doc)/i
describe VIRUS_WARNING_MYDOOM5	Body contains possible Mydoom attachment
score VIRUS_WARNING_MYDOOM5	1.2

meta VIRUS_WARNING_DOOM_BNC	VIRUS_WARNING78 && (VIRUS_WARNING_MYDOOM4 || __VIRUS_WARNING_MYDOOM4A || VIRUS_WARNING_MYDOOM5)
describe VIRUS_WARNING_DOOM_BNC	Looks like a Mydoom bounce
score VIRUS_WARNING_DOOM_BNC	7.5


### TJ: Failed/cleaned infections
# Used to match empty subjects too
#header VIRUS_CLEANED_MYDOOM	Subject =~ /^(Hello|hi|test|mail delivery system|mail transaction failed|server report|status|error)$/i
#describe VIRUS_CLEANED_MYDOOM	Failed/cleaned Mydoom infection?
#score VIRUS_CLEANED_MYDOOM	1

# TJ/VS
header VIRUS_CLEANED_SOBIG_F1	Subject =~ /^(Re: )?(Approved|Wicked screensaver|That movie|Thank you!)$/
describe VIRUS_CLEANED_SOBIG_F1	Failed/cleaned Sobig/F infection? (1)
score VIRUS_CLEANED_SOBIG_F1	2

header VIRUS_CLEANED_SOBIG_F2	Subject =~ /^Re: (Re: )?((My|Your) )?Details$/
describe VIRUS_CLEANED_SOBIG_F2	Failed/cleaned Sobig/F infection? (2)
score VIRUS_CLEANED_SOBIG_F2	2

header VIRUS_CLEANED_1		Subject =~ /^Re: Your application$/
describe VIRUS_CLEANED_1	Failed/cleaned Sobig/F or Netsky/K infection? (1)
score VIRUS_CLEANED_1		1