# spam
:0
* ^Subject: *=\?(big5|GB2312|KS_C_5601-1987|iso-2022-(jp|kr)|euc[_-]kr|koi8-r|[wW]indows-125[14])\?
/dev/null

:0
* ^Content-Type:.*charset[=:](big5|GB2312_CHARSET|GB2312|KS_C_5601-1987|iso-2022-(jp|kr)|euc[_-]kr|koi8-r|[wW]indows-125[14])
/dev/null

:0
* ^Content-Type:.*charset="(big5|GB2312_CHARSET|GB2312|KS_C_5601-1987|iso-2022-(jp|kr)|euc[_-]kr|koi8-r|[wW]indows-125[14])"
/dev/null

:0 B
* Content-Type: "?text/(plain|html)"?;
* charset="?(big5|gb2312|[wW]indows-125[14])"?
/dev/null

:0 B
* http-equiv.*content.*text/(plain|html)"?;
* charset=(3D)?"?(big5|gb2312|[wW]indows-125[14])"?
/dev/null

# Klez worm procmail filter
:0 B
* ^Content-Type: audio/
* ^135AAItEjhyJRI8ci0SOGIlEjxiLRI4UiUSPFItEjhCJRI8Qi0SODIlEjwyLRI4IiUSPCItE$
worm

# yet another worm
:0 B
* ^ *name=".*\.pif"$
* ^doZkwxRFEAjhFhiOBWJeAhzAAsB8VH5pMHwetAAz/3V27PEOhrZAqAnh3wxtEDCOIkBXIbtQsizL$
worm

# yet another worm
:0 B
* ^csCSVw8PsjicuKcinImNtih0jgBqp8eN\+mXM3wh/d1zgn2kWXP6i7amv3Ca78Ye6Fx7tYMVKmEHo$
worm

# this should kill most worms... it's the exe header
:0 B
* ^TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAA
worm

# yet another worm ... this is a portion of an attached gif
:0 B
* ^mXSxY0iTTLhQAC2ocKIDHGywgAwYWPDAm3AeIIVztr3E1FiFVSnQJLXc4ksxuujyiy6npNGFYBKK
worm

# yet another worm -- this appears to be a double base64 encode of the exe header
:0 B
* ^VFZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB
worm

# and now for spamassassin
:0fw
| /usr/bin/spamassassin

:0:
* ^X-Spam-Status: Yes
spam