score DOTNET 3
# blarson 2010-02-02
-body REMBOX /\b(?:rembox|disappear|stopping|delrem|remfiles?|exit)\s?\@/
+body REMBOX /\b(?:rembo[xt]|disappear|stopping|delrem|remfiles?|exit|takemeoff|offthelist|purgefile)\s?\@/
describe REMBOX rembox
score REMBOX 3
meta RTF_SPAM CTOCTET_STREAM && RTF_ATTACH
describe RTF_SPAM Content type is octet-stream and has an RTF Attachment
-score RTF_SPAM 3
\ No newline at end of file
+score RTF_SPAM 3