procmail
[Top] [All Lists]

Re: YAVR (Yet Another Virus Recipe) :-)

2003-01-28 01:38:01
version 2.8  http://agriroot.aua.gr/~nikant/nkvir-rc
- added generic detection for most of nigeria scam e-mails (most of them)


here is the nigeria recipe:

###########################################################
# Nigeria Scam Filter
# will catch most of those
###########################################################
:0HB
* -1000^0
*   500^0  ^Subject[  ]*:.*(CALL
ME(:)?[-0-9]|INHERITANCE|LUCK(Y)?|COL(L)?ABORATION|\














                 PLEASE|URGENT( )?(RESPON(D|SE)|REPLY)?|ASSISTANCE|BEQUEST|\

PARTNERSHIP|PROPOSAL|TRANSACTION|DIAMOND|CONFIDENTIAL(ITY)?)
*   900^1
(TOGOLAISE|Africa|Nigeria|Congo)(n)?( )?$?^?(National)?( )?$?^?((Petrol(l)?e
um( )?$?^?(Corporation|company))|(Chamber( )?$?^?of( )?$?^?Commerce)|((Devel
opment)?( )?$?^?(Bank(s)?|Export)))
*   900^1
(Central|Union|international)?( )?$?^?Bank( )?$?^?of( )?$?^?(Nigeria|ivory( 
)?$?^?coast|Africa|Congo)( )?$?^?(Lome( )?$?^?Togo)?
*   900^1
([MB]illion|thousand|Hundred)( )?$?^?(United( )?$?^?State(s)?|U\.S|US|U
S)?( )?$?^?(US)?dollars
*   900^1 Banque( )?$?^?Internationale( )?$?^?du( )?$?^?Abidjan
*   900^1
Revolutionary( )?$?^?People(')?s( )?$?^?Front( )?$?^?(of( )?$?^?the( )?$?^?r
epublic( )?$?^?of)?( )?$?^?Sierra Leone
*   900^1
ECONOMIC( )?$?^?COM(M)?UNITY( )?$?^?OF( )?$?^?(WEST)?( )?$?^?AFRICA(N)?( )?$
?^?STATE(S)?
*   900^1
Nigeria(n)?( )?$?^?(Federal)?( )?$?^?Ministry( )?$?^?of( )?$?^?Works( )?$?^?
and( )?$?^?Housing
*   900^1 (Democratic)?( )?$?^?Republic( )?$?^?Of( )?$?^?Congo
*   900^1 National( )?$?^?Electric( )?$?^?Power( )?$?^?Authority
*   900^1 BE( )?$?^?AN( )?$?^?INTERNET( )?$?^?(MIL|BIL)(L)?IONAIRE
*   300^1
(Diamond)?( )?$?^?Min(n)?ing( )?$?^?(co(-)?operation|company|Corporation)?
*   300^1
(absolute|utmost)( )?$?^?(secrecy|confidentiality)( )?$?^?(and)?( )?$?^?(sec
recy|confidentiality)?
*   300^1 secure( )?$?^?the( )?$?^?fund
*   300^1 business( )?$?^?highly( )?$?^?confidential
*   300^1 assures( )?$?^?you( )?$?^?lots( )?$?^?of( )?$?^?money
*   200^1 (Federal( )?$?^?Republic|Central( )?$?^?Bank|Ministry)( )?$?^?of
*   200^1 foreign( )?$?^?account
*   200^1 risk( )?$?^?(involved|free)
*   200^1 (this|the)( )?$?^?transaction
*   200^1 strictly( )?$?^?confidential
*   200^1 top( )?$?^?secret
*   100^1 (Nigeria|Lagos|Congo)
  {
  LOG="---=== NIGERIA SCAM $DATE ===---${NL}"
  :0:
  $VIRDIR/nigeria-scam
  }
#END-OF-NIGERIA-SCAM



_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>