Action01=send note|"to <postmaster@$PRIMARYDOMAIN$>","from <MDaemon@$PRIMARYDOMAIN$>","subject <Message infected with X97M.Melissa.A macro virus detected!>","","A message with the X97M.Melissa.A macro virus has been detected!","The message has been moved to the bad message queue for further examination by you.","","From: $HEADER:FROM$","To: $HEADER:X-MDAEMON-DELIVER-TO$","Subject: $HEADER:SUBJECT$"
Action02=move to bad Msg|
[Rule002]
RuleName=X97M.Papa.B Macro Virus [Move to bad message queue]
Enable=Yes
ThisRuleCondition=ALL
ProcessQueue=BOTH
Condition01=SUBJECT|contains|AND|FWD: WORKBOOK FROM ALL.NET AND|
Condition02=body|has attachment|AND|
Action01=send note|"to <postmaster@$PRIMARYDOMAIN$>","from <MDaemon@$PRIMARYDOMAIN$>","subject <Message infected with X97M.Papa.B macro virus detected!>","","A message with the X97M.Papa.B macro virus has been detected!","The message has been moved to the bad message queue for further examination by you.","","From: $HEADER:FROM:","To: $HEADER:X-MDAEMON-DELIVER-TO$","Subject: $HEADER:SUBJECT$"
Action02=move to bad Msg|
[Rule003]
RuleName=ExploreZIP worm [Move to bad message queue]
Enable=Yes
ThisRuleCondition=ALL
ProcessQueue=BOTH
Condition01=SUBJECT|contains|AND|I received your email and I shall send you a reply ASAP|
Condition02=body|has attachment|AND|
Action01=send note|"to <postmaster@$PRIMARYDOMAIN$>","from <MDaemon@$PRIMARYDOMAIN$>","subject <Message infected with ExploreZIP internet worm detected!>","","A message with the ExploreZIP internet worm has been detected!","The message has been moved to the bad message queue for further examination by you.","","From: $HEADER:FROM$","To: $HEADER:X-MDAEMON-DELIVER-TO$","Subject: $HEADER:SUBJECT$"
Action02=move to bad Msg|
[Rule004]
RuleName=ILOVEYOU worm [Move to bad message queue]
Enable=Yes
ThisRuleCondition=ALL
ProcessQueue=BOTH
Condition01=SUBJECT|contains|AND|ILOVEYOU|
Condition02=body|attachment name|AND|.vbs
Action01=send note|"to <postmaster@$PRIMARYDOMAIN$>","from <MDaemon@$PRIMARYDOMAIN$>","subject <Message infected with ExploreZIP internet worm detected!>","","A message with the ILOVEYOU internet worm has been detected!","The message has been moved to the bad message queue for further examination by you.","","From: $HEADER:FROM$","To: $HEADER:X-MDAEMON-DELIVER-TO$","Subject: $HEADER:SUBJECT$"
Action02=move to bad Msg|
[Rule005]
RuleName=X97M.Melissa.A Macro Virus [Remove attachments and append footer]
Action01=send note|"to <postmaster@$PRIMARYDOMAIN$>","from <MDaemon@$PRIMARYDOMAIN$>","subject <Message infected with X97M.Melissa.A macro virus detected!>","","A message with the X97M.Melissa.A macro virus has been detected!","Message will be delivered after all attachments have been removed.","","From: $HEADER:FROM$","To: $HEADER:X-MDAEMON-DELIVER-TO$","Subject: $HEADER:SUBJECT$"
Action02=remove attachments|
Action03=remove digital signature|
Action04=add footer|"********************** Warning! ***********************************","The X97M.Melissa.A MACRO virus was detected in this message!","All attachments have been removed from this message to protect you.","If this message had a digital signature it has been removed.","For more information please contact your administrator who can ","usually be reached at postmaster@$PRIMARYDOMAIN$","*******************************************************************"
[Rule006]
RuleName=X97M.Papa.B Macro Virus [Remove attachments and append footer]
Enable=No
ThisRuleCondition=ALL
ProcessQueue=BOTH
Condition01=SUBJECT|contains|AND|FWD: WORKBOOK FROM ALL.NET AND|
Condition02=body|has attachment|AND|
Action01=send note|"to <postmaster@$PRIMARYDOMAIN$>","from <MDaemon@$PRIMARYDOMAIN$>","subject <Message infected with X97M.Papa.B macro virus detected!>","","A message with the X97M.Papa.B macro virus has been detected!","Message will be delivered after all attachments have been removed.","","From: $HEADER:FROM$","To: $HEADER:X-MDAEMON-DELIVER-TO$","Subject: $HEADER:SUBJECT$"
Action02=remove attachments|
Action03=remove digital signature|
Action04=add footer|"********************** Warning! ***********************************","The X97M.Papa.B MACRO virus was detected in this message!","All attachments have been removed from this message to protect you.","If this message had a digital signature it has been removed.","For more information please contact your administrator who can ","usually be reached at postmaster@$PRIMARYDOMAIN$","*******************************************************************"
[Rule007]
RuleName=ExploreZIP Worm [Remove attachments and append footer]
Enable=No
ThisRuleCondition=ALL
ProcessQueue=BOTH
Condition01=SUBJECT|contains|AND|I received your email and I shall send you a reply ASAP|
Condition02=body|has attachment|AND|
Action01=send note|"to <postmaster@$PRIMARYDOMAIN$>","from <MDaemon@$PRIMARYDOMAIN$>","subject <Message infected with ExploreZIP internet worm detected!>","","Message infected with ExploreZIP internet worm detected!","Message will be delivered after all attachments have been removed.","","From: $HEADER:FROM$","To: $HEADER:X-MDAEMON-DELIVER-TO$","Subject: $HEADER:SUBJECT$"
Action02=remove attachments|
Action03=remove digital signature|
Action04=add footer|"********************** Warning! ***********************************","The ExploreZIP internet worm was detected in this message!","All attachments have been removed from this message to protect you.","If this message had a digital signature it has been removed.","For more information please contact your administrator who can ","usually be reached at postmaster@$PRIMARYDOMAIN$","*******************************************************************"
[Rule008]
RuleName=ILOVEYOU Worm [Remove attachments and append footer]
Enable=No
ThisRuleCondition=ALL
ProcessQueue=BOTH
Condition01=SUBJECT|contains|AND|ILOVEYOU|
Condition02=body|attachment name|AND|.vbs
Action01=send note|"to <postmaster@$PRIMARYDOMAIN$>","from <MDaemon@$PRIMARYDOMAIN$>","subject <Message infected with ExploreZIP internet worm detected!>","","Message infected with ILOVEYOU internet worm detected!","Message will be delivered after all attachments have been removed.","","From: $HEADER:FROM$","To: $HEADER:X-MDAEMON-DELIVER-TO$","Subject: $HEADER:SUBJECT$"
Action02=remove attachments|
Action03=remove digital signature|
Action04=add footer|"********************** Warning! ***********************************","The ILOVEYOU internet worm was detected in this message!","All attachments have been removed from this message to protect you.","If this message had a digital signature it has been removed.","For more information please contact your administrator who can ","usually be reached at postmaster@$PRIMARYDOMAIN$","*******************************************************************"
