SHELL=/bin/csh
LOGFILE=/var/log/procmail.log

VIRUSBOX=/home/spool/virus
SPAMBOX=/home/spool/spam

#
# klez virus
#
:0 B
* ^Content-Transfer-Encoding: base64
* name=.*\.(exe|bat|scr|pif)
$VIRUSBOX

#
# goner virus
#
:0 B
* ^Content-Transfer-Encoding: base64
* name=.*gone\.scr
$VIRUSBOX


#
# badtrans
#
:0 B
* ^Content-Transfer-Encoding: base64
* name=.*\.(doc|mp3|txt|zip)\.(pif|scr)
$VIRUSBOX



#
# sircam
#
:0 B
* (Hi.*How.are.you|Hola.como.estas)
* (See.you.later.*Thanks|Nos.vemos.pronto.*gracias)
* ^Content-Transfer-Encoding: base64
$VIRUSBOX



#
# spammer rules
#
:0 B
* ^(To|From|Received|Reply-To|Sender):.*\<horriblespammer\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<emailaccount\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<scientist\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<semicustomwebsites\.net\>
* ^(To|From|Received|Reply-To|Sender):.*\<eros\.stoen\>
* ^(To|From|Received|Reply-To|Sender):.*\<fullpromote\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<hirenetwork\.net\>
* ^(To|From|Received|Reply-To|Sender):.*\<semo\.net\>
* ^(To|From|Received|Reply-To|Sender):.*\<godmail\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<myownemail\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<address\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<domainmarketingmailers\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<doramail\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<witty\.org\>
* ^(To|From|Received|Reply-To|Sender):.*\<explicit\.net\>
* ^(To|From|Received|Reply-To|Sender):.*\<adexec\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<mod-web\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<afreeinternet\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<emailchoice\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<mail3\.9netway\>
* ^(To|From|Received|Reply-To|Sender):.*\<bollywoodz\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<1freemail\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<semicustomwebsites\.org\>
* ^(To|From|Received|Reply-To|Sender):.*\<azcappy\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<lovemail\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<163\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<hirenetwork\.org\>
* ^(To|From|Received|Reply-To|Sender):.*\<browso\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<computeremail\.net\>
* ^(To|From|Received|Reply-To|Sender):.*\<advantagesmail\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<btamail\.net\>
* ^(To|From|Received|Reply-To|Sender):.*\<seanic-promotions\.net\>
* ^(To|From|Received|Reply-To|Sender):.*\<elo\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<trafficmagnet\.net\>
* ^(To|From|Received|Reply-To|Sender):.*\<mail\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<seekercenter\.net\>
* ^(To|From|Received|Reply-To|Sender):.*\<axisww\.org\>
* ^(To|From|Received|Reply-To|Sender):.*\<theprofessor\.org\>
* ^(To|From|Received|Reply-To|Sender):.*\<engineer\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<semicustomwebsites\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<hotbot\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<venus\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<thecloser\.net\>
* ^(To|From|Received|Reply-To|Sender):.*\<fiberia\.com\>
* ^(To|From|Received|Reply-To|Sender):.*\<hirenetwork\.com\>
$SPAMBOX