I know it has already been out for a bit, and most people have virus
scanners, but here is a spamassassin rule for NETSKY. If one was posted
earlier, I'm sorry I missed it as my mail this morning was not working.
Beware of line breaks. The __B_NETSKY should all be on one line. The score
is very high to avoid white lists.
header __HS_NETSKY Subject =~ /^(?:hi|hello|read it immediately|something
for you|warning|information|stolen|fake|unknown)\s*$/
body __B_NETSKY /^\s*(?:anything ok?|what does it mean?|ok|i'm waiting|read
the details.|here is the document.|read it immediately!|my hero|here|is
that true?|is that your name?|is that your account?|i wait for a reply!|is
that from you?|you are a bad writer|I have your password!|something about
you!|kill the writer of this document!|i hope it is not true!|your name is
wrong|i found this document about you|yes, really?|that is bad|here it
is|see you|greetings|stuff about you?|something is going wrong!|information
about you|about me|from the chatter|here, the serials|here, the
introduction|here, the cheats|that's funny|do you?|reply|take it
easy|why?|thats wrong|misc|you earn money|you feel the same|you try to
steal|you are bad|something is going wrong|something is fool)\s*$/
meta NETSKY (__HS_NETSKY && __B_NETSKY)
describe NETSKY Message contains virus
score NETSKY 200.0
Andrew
