1# VIRUSCRUFT-PATTERNS.RC 2# 3# Patterns for various types of !$)(*%$#@)(*@!! *STUPID* anti-virus 4# products that send "virus notifications" to the forged senders of 5# virus emails.:( 6# 7# Last updated: 3/22/2010 8 9 10# Barracuda Spam Firewall 11# 12# Misconfigured Barracuda Spam Firewalls are sending a ton of 13# misdirected block notices to the owners of domains that 14# spammers have appropriated and used to forge the From: line 15# or sender. Earlier versions of the Barracuda spam firewall 16# came configured to do this by default; current versions do 17# not. There is a significant installed base of the earlier 18# versions, unfortunately. :( 19# 20:0 21* (^Received: from barracuda\.|\ 22 ^Subject: \*\*Message you sent blocked by our bulk email filter\*\*$) 23{ 24 SBLOG="A1R-Barracuda Spam Firewall block notice" 25 INCLUDERC=${SBDIR}/functions/loglevel.rc 26 27 :0 28 * $ ${SBSCORE}^0 29 * 10^0 30 { SBSCORE=$= } 31} 32 33# BorderWare MXtreme Mail Firewall 34# 35:0 36* ^From:.*[^0-9a-z]BorderWare MXtreme Mail Firewall([^0-9a-z]|$) 37* ^Subject: Discarded Mail: 38{ 39 SBLOG="A1R-BorderWare MXtreme backscatter" 40 INCLUDERC=${SBDIR}/functions/loglevel.rc 41 42 :0 43 * $ ${SBSCORE}^0 44 * 10^0 45 { SBSCORE=$= } 46} 47 48# MailFrontier backscatter. 49# 50:0 51* H ?? ^Subject: Summary of junk emails blocked$ 52* H ?? ^X-Mlf-Communication-Key: 53* H ?? ^X-Mlf-loginurl: 54* H ?? ^X-Mlf-version: 55{ 56 SBLOG="A1R-MailFrontier backscatter" 57 INCLUDERC=${SBDIR}/functions/loglevel.rc 58 59 :0 60 * $ ${SBSCORE}^0 61 * 10^0 62 { SBSCORE=$= } 63} 64 65# MailMarshall Backscatter 66# 67:0 BH 68* -1000^0 69* 1100^0 ^From:.*mailmarshall?@ 70* 1100^0 ^From:.*jbhblockedmail@jbhunt\.com([^a-z0-9.]|$) 71* 500^0 ^Subject: Your email message was blocked$ 72* 600^0 (^|[^-_0-9a-z]|=2E)MailMarshal(�|\.|=2E)com([^a-z0-9.]|\. |\.$|$) 73* 500^0 (^|[^-_0-9a-z]|=2E)Marshal Software([^a-z0-9.]|\. |\.$|$) 74{ 75 SBLOG="A1R-MailMarshall backscatter" 76 INCLUDERC=${SBDIR}/functions/loglevel.rc 77 78 :0 79 * $ ${SBSCORE}^0 80 * 10^0 81 { SBSCORE=$= } 82} 83 84 85# McAfee WebShield backscatter 86# 87# Lots of server-based antivirus products are sending notifications to 88# the email address in the From: line of each virus they get, including 89# to addresses in the Klez virus From: line. Since those addresses are 90# almost never the ones belonging to the owner of the infected computer, 91# these notifications are essentially spam, and extremely annoying. This 92# filter treats these notices as spam and gets rid of them. 93# 94:0 BH 95* -1000^0 96* 1100^0 ^From: Webshield\. 97* 1100^0 ^Subject: \{VIRUS?\} 98* 1100^0 ^Subject: Virus Detected by Network Associates 99* 1100^0 ^Subject: Virus Detected.*Webshield 100* 1100^0 ^X-Mailer: Network Associates 101* 800^0 ^X-NAI-WebShielde500-mimepp: 102* 1100^0 ^The.*WebShield.*(detected|discovered).* virus([^a-z0-9.]|\. |\.$|$) 103* 1100^0 (^|[^-_0-9a-z]|=2E)mcafeeb2b(�|\.|=2E)com([^a-z0-9.]|\. |\.$|$) 104{ 105 SBLOG="A1R-McAfee Webshield backscatter" 106 INCLUDERC=${SBDIR}/functions/loglevel.rc 107 108 :0 109 * $ ${SBSCORE}^0 110 * 10^0 111 { SBSCORE=$= } 112} 113 114 115# Qmail Backscatter 116# 117:0 118* H ?? ^Received: \(qmail [0-9]+ invoked( ) 119* H ?? ^Subject: (FAILURE:( )|failure notice) 120* B ?? ^Hi. This is the qmail-send program( ) 121{ 122 SBLOG="A1R-Qmail backscatter" 123 INCLUDERC=${SBDIR}/functions/loglevel.rc 124 125 :0 126 * $ ${SBSCORE}^0 127 * 10^0 128 { SBSCORE=$= } 129} 130 131 132# ScanMail forged junk :( 133# 134# ScanMail not only sends notifications to forgery victims, but 135# forges the victim's domain into the From: line of the response. 136# The jerks! 137# 138:0 HD 139* -1000^0 140* 600^0 ^Thread-Topic: ScanMail Message: 141* 600^0 ^thread-index: 142* 1100^0 ^Subject: ScanMail Message: 143{ 144 SBLOG="A1R-ScanMail AntiVirus notification spam" 145 INCLUDERC=${SBDIR}/functions/loglevel.rc 146 147 :0 148 * $ ${SBSCORE}^0 149 * 10^0 150 { SBSCORE=$= } 151} 152 153:0 B 154* -1000^0 155* 1100^0 ^ScanMail for Microsoft Exchange has detected virus-infected attachment\(s\)\.$ 156* 1100^0 ^Warning to sender\. ScanMail has detected a virus in an email you sent\.$ 157{ 158 SBLOG="A1R-ScanMail AntiVirus notification spam" 159 INCLUDERC=${SBDIR}/functions/loglevel.rc 160 161 :0 162 * $ ${SBSCORE}^0 163 * 10^0 164 { SBSCORE=$= } 165} 166 167# Symantec Norton Antivirus "Notifications" :/ 168# 169# Lots of server-based antivirus products are sending notifications to 170# the email address in the From: line of each virus they get, including 171# to addresses in the Klez virus From: line. Since those addresses are 172# almost never the ones belonging to the owner of the infected computer, 173# these notifications are essentially spam, and extremely annoying. This 174# filter treats these notices as spam and gets rid of them. 175# 176# Norton AntiVirus is one of these products. 177# 178:0 179* -1000^0 180* H ?? 1100^0 ^From:.*Symantec_AntiVirus_for_SMTP_Gateways@ 181* H ?? 1100^0 ^From: NAV for Microsoft Exchange([^0-9a-z]|$) 182* H ?? 1100^0 ^From:.*Norton_AntiVirus(_Gateway)?s?@ 183* H ?? 800^0 ^Subject: Virus Found in message \".*\"$ 184* H ?? 1100^0 ^Subject: NAV detected a virus $ 185* H ?? 1100^0 ^Subject: Norton AntiVirus detected (and quarantined )?a virus([^0-9a-z]|$) 186* H ?? 1100^0 ^Subject: Symantec Mail Security detected([^0-9a-z]|$) 187* H ?? 1100^0 ^Thread-Topic: Symantec([^0-9a-z]|$) 188* H ?? 1100^0 ^X-Virus-Scanned: Symantec AntiVirus Scan Engine$X-Virus-Scan-Result: Repaired( ) 189* B ?? 300^0 ^Norton AntiVirus found a virus in an attachment you$ 190* B ?? 300^0 ^\([0-9a-z][-_0-9a-z]+@([0-9a-z][-_0-9a-z]+\.)+[a-z][a-z][a-z]?[a-z]?\) sent to [0-9a-z][-_0-9a-z]+@([0-9a-z][-_0-9a-z]+\.)+[a-z][a-z][a-z]?[a-z]?\.$ 191* B ?? 300^0 ^To ensure the recipient\(s\) are able to use the files you sent, perform a$ 192* B ?? 300^0 ^virus scan on your computer, clean any infected files, then resend this$ 193* B ?? 300^0 ^attachment\.$ 194* B ?? 300^0 ^Attachment: [-_0-9a-z\.]+\.[0-9a-z]+$ 195* B ?? 300^0 ^Virus name: [-_0-9a-z\.@]+$ 196* B ?? 300^0 ^Action taken: Clean failed : Quarantine succeeded :$ 197* B ?? 600^0 ^All infected components in the scanned document were deleted\.$ 198* B ?? 600^0 ^Subject of the message: .*$Recipient of the message: 199{ 200 SBLOG="A1R-Symantec/Norton AntiVirus backscatter" 201 INCLUDERC=${SBDIR}/functions/loglevel.rc 202 203 :0 204 * $ ${SBSCORE}^0 205 * 10^0 206 { SBSCORE=$= } 207} 208 209 210# Generic/Lower Volume Virus Notifications 211# 212# Lots of server-based antivirus products are sending notifications to 213# the email address in the From: line of each virus they get, including 214# to addresses in the Klez virus From: line. Since those addresses are 215# almost never the ones belonging to the owner of the infected computer, 216# these notifications are essentially spam, and extremely annoying. This 217# filter treats these notices as spam and gets rid of them. 218# 219:0 BH 220* ! DANGEROUS ?? ^yes$ 221* -1000^0 222* 1100^0 ^From:.*[^0-9a-z](alert@notification\.messagelabs\.com([^a-z0-9.]|$)|\ 223 amavisd-new([^a-z0-9.]|$)|\ 224 ANTIGEN_|\ 225 \"Anti-Virus Administrator\"|\ 226 antivirus@|\ 227 antivirus-daemon@|\ 228 avadmin@|\ 229 avgroup@|\ 230 AvMailGate@|\ 231 Barracuda Spam Firewall <>|\ 232 blackhole@linklaters\.com|\ 233 (\")?DrWEB-DAEMON(\"|@)|\ 234 eSafe@|\ 235 GroupShield for Exchange|\ 236 if@|\ 237 interscan@|\ 238 ltkwhite@intergate\.bc\.ca([^a-z0-9.]|$)|\ 239 \"Mail Anti-Virus Protector\"|\ 240 mailengine@rocketmail\.net([^a-z0-9.]|$)|\ 241 \"MailScanner\"|\ 242 MAILsweeper@|\ 243 mms-notifier@|\ 244 spamCactus\.com([^a-z0-9.]|$)|\ 245 spampepper\.com([^a-z0-9.]|$)|\ 246 \"System Anti-Virus Administrator\"|\ 247 virus-checker@|\ 248 virusengelleme@|\ 249 VirusList Automaler System|\ 250 virusscanner@|\ 251 wsadmin@timewarner\.com([^a-z0-9.]|$)) 252* 600^0 ^From:.*[^0-9a-z](mailsupport|mms)@ 253* 600^0 ^Subject: Antigen found VIRUS= 254* 600^0 ^Subject: BANNED FILENAME 255* 1100^0 ^Subject: Caution: E-MAIL Quarantine Notification$ 256* 600^0 ^Subject: Content violation 257* 600^0 ^Subject: Disallowed attachment type([^a-z0-9.]|\. |\.$|$) 258* 600^0 ^Subject: eTrust Antivirus Gateway SMTP: Virus notification message$ 259* 600^0 ^Subject: \*\*\* FhG-Mailgateway: Virus-Warnung/virus alert \*\*\*$ 260* 1100^0 ^Subject: Failed to clean virus file([^a-z0-9.]|$) 261* 1100^0 ^Subject: File blocked - ScanMail for Lotus Notes -->( )*$ 262* 600^0 ^Subject: Illegal attachment type found([^a-z0-9.]|$) 263* 1100^0 ^Subject: InterScan NT Alert$ 264* 1100^0 ^Subject: [MailServer Notification] To External Sender: a virus was found([^a-z0-9.]|$) 265* 1100^0 ^Subject: MESSAGE COULD NOT BE DELIVERED$ 266* 1100^0 ^Subject: MMS notification$ 267* 600^0 ^Subject: Norton AntiVirus detected and quarantined a virus([^a-z0-9.]|$) 268* 600^0 ^Subject: PostMaster@[0-9a-z]+ notification$ 269* 600^0 ^Subject: Report to Sender$ 270* 600^0 ^Subject: Returned due to virus; 271* 600^0 ^Subject: SAV detected a violation([^a-z0-9]|$) 272* 600^0 ^Subject: Server Report$ 273* 1100^0 ^Subject: \[\*\*SPAM\*\*\] 274* 1100^0 ^Subject: Notification : Uncleanable Virus Detected$ 275* 600^0 ^Subject: Unsolicited commercial email rejected$ 276* 600^0 ^Subject: Virus (Alert|Warning)$ 277* 600^0 ^Subject: VIRUS Detected in message([^a-z0-9.]|$) 278* 600^0 ^Subject: virus found in sent message([^a-z0-9]|$) 279* 1100^0 ^Subject: VIRUS \([^)]*\) IN MAIL FROM YOU$ 280* 600^0 ^Subject: (VIRUS NOTIFICATION|Worm Klez\.E immunity)$ 281* 600^0 ^Subject: \{Virus\?\} Undelivered Message$ 282* 600^0 ^Subject: Warning! Check you computer, there is new viruses you may be infected! 283* 600^0 ^Subject: Warning: E-mail viruses detected$ 284* 1100^0 ^Subject: Warning: Possible Virus Infection$ 285* 600^0 ^Subject: WARNING. You tried to send a potential virus([^a-z0-9.]|\. |\.$|$) 286* 1100^0 ^Subject: Virus found in the mail$ 287* 1100^0 ^Thread-Topic: ScanMail Message: 288* 1100^0 ^X-Mailer: GWAVA Notification Service$ 289* 600^0 ^ contained a virus that could not be cleaned by our gateway\. 290* 600^0 ^A virus was found in a message([^a-z0-9.]|\. |\.$|$) 291* 600^0 ^Antivirus resources for.*can be found on the web at [^ ]+$ 292* 600^0 ^BANNED FILENAME ALERT$cell-direct.net 293* 600^0 ^Found virus [_0-9a-z.]+ in file [_0-9a-z.]+$ 294* 600^0 ^The uncleanable file [_0-9a-z.]+ is moved to /[-_0-9a-z.]+\.$ 295* 600^0 (^|[^-_0-9a-z])V I R U S A L E R T([^a-z0-9.]|\. |\.$|$) 296* 600^0 ^Our virus scanner found a virus in your email to the following$ 297* 600^0 ^recipient\(s\) and your email was NOT delivered:$ 298* 600^0 ^ALERT!!!$This e-mail contained one or more infected files\.$ 299* 600^0 ^The following attachments were infected and have been repaired:$ 300* 600^0 ^The following infected attachments were deleted:$ 301* 600^0 ^The following infected attachments were blocked because of Mail Policy violations:$ 302* 600^0 ^You may wish to contact the sender to notify them about their infected file\(s\)\.$ 303* 600^0 ^VIRUS-WARNUNG: Am .* hat der Viren-Checker([^a-z0-9.]|\. |\.$|$) 304* 600^0 ^The mail message (file: [0-9a-z][-_0-9a-z.]+) you sent to \ 305 [0-9a-z][-_0-9a-z]+@([0-9a-z][-_0-9a-z]+\.)+[a-z][a-z]+ contains\ 306 a virus\. \([ 0-9a-z]+\)$ 307* 600^0 ^The virus [0-9a-z][-_/@!.0-9a-z]+ was found in an attachment$ 308* 600^0 ^eTrust Antivirus Gateway SMTP on [0-9a-z][-_0-9a-z.]+$\ 309 detected a virus infection in an e-mail from$ 310* 600^0 ^the message with following attributes has not been delivered,$ 311* 600^0 ^<p>The WebShield.* Appliance discovered a virus in this file\.$ 312* 600^0 ^<p>Copyright © 1993-2002, Networks Associates Technology, Inc\.<br>$ 313* 600^0 ^Sender, InterScan has detected virus(es) in your e-mail attachmen\.$ 314* 600^0 ^This Email scanner intercepted it and stopped the entire message$ 315* 600^0 ^Halo Boss, Virus telah ditemukan dalam salah satu email anda$ 316* 600^0 ^the message with following attributes has not been delivered,$ 317* 600^0 ^because contains an infected object\.$ 318* 600^0 ^Incident Information:-$ 319* 600^0 ^Our virus detector has just been triggered by a message you sent:-$ 320* 600^0 ^The scanned document was QUARANTINED\.$ 321* 600^0 ^The Declude Virus software on ([0-9a-z][-_0-9a-z]+\.)[a-z][a-z][a-z]?[a-z]? has reported that you $ 322* 600^0 ^sent an E-mail to [0-9a-z][-_0-9a-z.]+@([0-9a-z][-_0-9a-z]+\.)[a-z][a-z][a-z]?[a-z]?, containing the : [^ ]+ virus in the$ 323* 1100^0 ^The file you have sent was infected with a virus but \ 324 InterScan E-Mail VirusWall could not clean it\.$ 325{ 326 SBLOG="A1R-Useless Automatic Virus Notification" 327 INCLUDERC=${SBDIR}/functions/loglevel.rc 328 329 :0 330 * NUKEBOUNCES ?? yes 331 { 332 SBLOG="L1-NUKEBOUNCES=${NUKEBOUNCES}" 333 INCLUDERC=${SBDIR}/functions/loglevel.rc 334 :0 335 /dev/null 336 } 337 338 :0 339 { SPAMTAG=yes } 340 341 :0 342 { DANGEROUS=yes } 343} 344 345 346# De-Fanged Virus Remnants (totally worthless) 347# 348# A number of virus filters, rather than blocking virus-laden emails 349# outright, just remove the virus binary section and then send the 350# "disinfected" email on to you. That results in a flood of useless 351# virus-produced emails that don't have a virus, but don't have anything 352# else you want either. 353# 354:0 BH 355* ! DANGEROUS ?? ^yes$ 356* -1000^0 357* 500^0 ^FROM: \"(Inet System|Internet Delivery Service)\" 358* 500^0 ^Subject: [VIRUS DETRUIT-DESTROYED] 359* 500^0 ^X-MailScanner: Found to be clean$ 360* 600^0 ^$(Please )?see the attached file for details\.$ 361* 600^0 ^this is the latest version of security update, the$ 362* 600^0 ^\"October 2003, Cumulative Patch\" update which fixes$ 363* 600^0 ^Install now to help maintain the security of your computer$ 364* 600^0 ^<TD NOWRAP><FONT SIZE=3D\"1\">Windows 95/98/Me/2000/NT/XP</FONT></TD>$ 365* 600^0 ^/\+n2/\+74//P6/\+3w8hOh/xOW6yCm/iuu/zWv/0m4/XTH/IXK95TP9qPV9bfi/tDn9tfp9OP0/93r$ 366* 600^0 ^9L3Izy6Vzj22/lrC/mfG/JvJ5JGntAyd6IbX/3zD6GzP/3jV/2uoxHqbqujv8g6MvJTj/2HF5pXV$ 367* 600^0 ^606zz6Hp/63v/7j1/8Ps88b8/rbj5RKOkE2wr3OGhoKGhv7///Dx8V2alqvm4Zni1YPRvx5uVwyO$ 368* 600^0 ^Content-type:.*name=virus_detruit-destroyed\.[0-9a-z]+$ 369* 600^0 ^()---------------- Virus Warning Message([^a-z0-9.]|\. |\.$|$) 370* 600^0 ^Found virus [^ ]+ in file [^ ]+$ 371* 600^0 ^()<BR>I'm sorry =$the message returned below could not be delivered =$to one or more destinations.<BR>$ 372* 600^0 ^()<BR><BR><BR>Undelivered message to <B>[0-9a-z][-_0-9a-z]+@yahoo\.com</B>$ 373* 600^0 ^()<iframe src="cid:[a-z]+" height=0 width=0></iframe>$<BR>This is the qmail program<BR>$ 374* 1100^0 ^The message cannot be represented in 7-bit ASCII encoding and has been sent$\ 375 as a binary attachment\. 376* 600^0 ^\*\*\*\*\*\*\*\* McAfee GroupShield for Microsoft Exchange \*\*\*\*\*\*\*\*\*\*$ 377* 600^0 ^The file ([0-9a-z][-_0-9a-z]+\.)+[a-z]+ has been replaced\. 378* 600^0 (^|[^-_0-9a-z])Reason: The file met the blocking options set in the anti-virus system\. 379* 600^0 ^Content-Type: text/plain; charset=us-ascii$Content-Transfer-Encoding: 7bit$$why\?$ 380* 600^0 ^Content-Type: application/x-zip-compressed; name=\"[0-9a-z]+\.zip\"$\ 381 Content-Transfer-Encoding: base64$\ 382 Content-Disposition: attachment; filename=\"[0-9a-z]+\.zip\"$$$-- 383* 1100^0 ^----------[a-z]+$\ 384 Content-Type: application/octet-stream; name=\"[0-9a-z][-_0-9a-z]+\.(bat|com|cmd|cpl|exe|hta|lnk|pif|scr|vbs|zip)\"$\ 385 Content-Transfer-Encoding: base64$\ 386 Content-Disposition: attachment; filename=\"[0-9a-z][-_0-9a-z]+\.(bat|com|cmd|cpl|exe|hta|lnk|pif|scr|vbs|zip)\"$([^0-9a-z]*$)+\ 387 ----------[a-z]+--$ 388* 600^0 (^|[^0-9a-z])replaced by Sophos Anti-Virus([^0-9a-z]|$) 389* 300^0 (^|[^0-9a-z])infected by a virus([^0-9a-z]|$) 390* 300^0 (^|[^0-9a-z])attachment of this message([^0-9a-z]|$) 391* 1100^0 (^|[^0-9a-z])------=_NextPart_[^ ]+$Content-Type: application/octet-stream;$\ 392 [^0-9a-z]*name=\"[0-9a-z]+\.[a-z][a-z]+\"$Content-Transfer-Encoding: base64$\ 393 Content-Disposition: attachment;$\[^0-9a-z]*filename=\"[0-9a-z]+\.[a-z][a-z]+\"$$+\ 394 ------=_NextPart_[^ ]+$ 395* 1100^0 ^\+\+\+ Attachment: .*$\ 396 \+\+\+ Panda AntiVirus - www\.pandasoftware\.com$ 397* 1100^0 ^\-\-[^ ]+$\ 398 Content-Type: application/octet-stream; name=[^ ]+$\ 399 Content-Transfer-Encoding: base64$\ 400 Content-Disposition: attachment; filename=[^ ]+$$+\ 401 \-\-[^ ]+$ 402* 1100^0 ^\-\-[^ ]+$\ 403 Content-Type: application/octet-stream;$\ 404 [^0-9a-z]*name=[^ ]+$\ 405 Content-Transfer-Encoding: base64$\ 406 Content-Disposition: attachment;$\ 407 [^0-9a-z]*filename=[^ ]+$$+\ 408 \-\-[^ ]+$ 409* 1100^0 ^--[0-9]+$\ 410 Content-Type: application/x-zip-compressed; name=\"[^ "]\.zip\"$\ 411 Content-Transfer-Encoding: base64$\ 412 Content-Disposition: attachment; filename=\"[^ "]\.zip\"$$$\ 413 --[0-9]+--$ 414* 400^0 ^Sorry Dangerous Attachment has been Removed\.$ 415* 400^0 ^The file \"[-_0-9a-z]+\.[a-z][a-z]+\" has been removed because of a virus\.$ 416* 400^0 ^It was infected with the \"[^ ]+\" virus\.$ 417* 400^0 ^Sorry Dangerous Attachment has been Removed\.$ 418* 400^0 ^The file \"[0-9a-z][-_0-9a-z]+\.[a-z]+\" has been removed because of a virus\.$ 419* 400^0 ^It was infected with the \"[^ ]+\" virus\.$ 420* 400^0 ^File quarantined as: \"[0-9a-z][-_0-9a-z]+\.data\.zip\"\.$ 421* 1100^0 ^The original message content contained a virus or was blocked due \ 422 to blocking rules and has been removed\.$ 423* 400^0 ^Found virus [^ ]+ in file [^ ]+ \(in [^ ]+\)$ 424* 400^0 ^If you have questions, contact [0-9a-z][-_0-9a-z]+@([0-9a-z][-_0-9a-z]+\.)+[a-z][a-z][a-z]?[a-z]?$ 425* 400^0 ^[^ ]+ is removed from here because it contains a virus.$ 426* 1100^0 ^--[^ ]+$\ 427 Content-Type: application/x-msdownload; name=\"[0-9a-z][-_0-9a-z]+\.exe\"$\ 428 Content-Transfer-Encoding: base64$\ 429 Content-Disposition: attachment; filename=\"[0-9a-z][-_0-9a-z]+\.exe\"$$$+\ 430 --[^ ]+$ 431* 1100^0 ^------------------ Virus Warning Message \(on [^ ]+\)$$\ 432 [^ ]+ is removed from here because it contains a virus\.$ 433{ 434 SBLOG="A1R-Defanged Virus email (worthless)" 435 INCLUDERC=${SBDIR}/functions/loglevel.rc 436 437 :0 438 * NUKEBOUNCES ?? yes 439 { 440 SBLOG="L1-NUKEBOUNCES=${NUKEBOUNCES}" 441 INCLUDERC=${SBDIR}/functions/loglevel.rc 442 :0 443 /dev/null 444 } 445 446 :0 447 { SPAMTAG=yes } 448 449 :0 450 { DANGEROUS=yes } 451} 452