# Patterns syntax is very, very rudimentary.  Essentially, you can
# check strict match, anchor at the beginning of line, and use shell-
# style '*' which means 'any number of any characters'.  No fancy regex
# matching and no 'any single character' designator.
# First character in the line tells whether matching is done in the
# (E)nvelope, (H)eaders or (B)ody of the message.
# Empty lines are ignored, as are the lines bebinning with hash mark '#'.

# Viruses in attachments
B^Content-Type:*NAME=*.scr
B^Content-Type:*NAME=*.pif
B^Content-Type:*name=*.scr
B^Content-Type:*name=*.pif
B^Content-Type: application/octet-stream;^	*NAME=*.scr
B^Content-Type: application/octet-stream;^	*NAME=*.pif
B^Content-Type: application/octet-stream;^	*name=*.scr
B^Content-Type: application/octet-stream;^	*name=*.pif
B^Content-Type:*NAME=your_details.zip
B^Content-Type:*name=your_details.zip
B^Content-Type:*NAME="your_details.zip"
B^Content-Type:*name="your_details.zip"
B^email address. This email address will be expiring.

# Some spam has this
H^To: ""<>

H^Received: from *.advertisingfever.com
H^X-Mailer: Advanced Mass Sender
H^X-Mailer: OutLook Express 3.14159
H^X-Mailer: Mega-Mailer
H^X-Mailer: 'WE' Group Spamer
H^From: Hahaha <hahaha@sexyfun.net>
H^From:   <stop-sex-
H^Subject: Worm Klez.E immunity
H^Subject: W32.Klez.E removal tools
H^Subject: A special  new game

H^From:*<big@boss.com>