# Hidden executables (typical of viruses)
#
#  This catches those file attachment names like IEEE802WAPTER.doc.pif,
#  hello.doc.bat, and readme.HTML.vbs.
#
:0 BH
* ^Content.*name=.+\..+\.(hta|vbs|exe|scr|pif|lnk|bat|com).*$
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: DANGER! Hidden Executable Attachment"

 :0
 { SPAMTAG=yes }

 :0
 { DANGEROUS=yes }
}


# Embedded IFRAME
#
#  This catches email with embedded IFRAMEs, which can run remote
#  executable content on some email programs and are therefore
#  dangerous.
#
:0 BH
* -1000^0
*  1100^1    ()<iframe.*src=.*height=.*width=
*  1100^1      iframe>
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: DANGER! Embedded iframe"

 :0
 { BLOCKTAG=yes }

 :0
 { DANGEROUS=yes }
}


# Embedded Scripts
#
#  This catches HTML-based email with embedded Scripting code,
#  Javascript or others.
#
:0 BH
* -1000^0
*   600^1    ()<SCRIPT language=
*   600^1    ()</SCRIPT>
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: DANGER! Embedded Script"

 :0
 { BLOCKTAG=yes }

 :0
 { DANGEROUS=yes }
}


# All executables (just too dangerous)
#
#  This catches any email with an executable attachment and puts it
#  in your ${BLOCKFOLDER}.  This filter should intercept most new
#  email viruses, since users are not aware that they are sending
#  them.
#
:0 BH
* EXECHECKING ?? yes
* !^Subject:.*${BYPASSWD}
*  ^(Content.*(file)?name=.+\.(hta|vbs|exe|scr|pif|lnk|bat).*$|\
     Content-Type:(.*$)+.*(file)?name=.+\.(hta|vbs|exe|scr|pif|lnk|bat).*$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: DANGER! Executable Attachment"

 :0
 { BLOCKTAG=yes }

 :0
 { DANGEROUS=yes }
}


# Document Files with Executable Code (also too dangerous)
#
#  This catches any email containing a document file of a type that
#  can contain executable macros, such as most Microsoft Office files
#  can, and puts it in your ${BLOCKFOLDER}.  This filter should
#  intercept many new email viruses.
#
:0 BH
* EXEDOCCHECKING ?? yes
* !^Subject:.*${BYPASSWD}
*  ^(Content.*(file)?name=.+\.(cd.|doc|pdf|ppt|prj|vs.|xl.).*$|\
     Content-Type:(.*$)+.*(file)?name=.+\.(cd.|doc|pdf|ppt|prj|vs.|xl.).*$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: DANGER! Executable Document"

 :0
 { BLOCKTAG=yes }

 :0
 { DANGEROUS=yes }
}
