score DOTNET 3
# blarson 2010-02-02
-body REMBOX /\b(?:rembox|disappear|stopping|delrem|remfiles?|exit)\s?\@/
+body REMBOX /\b(?:rembo[xt]|disappear|stopping|delrem|remfiles?|exit|takemeoff|offthelist|purgefile)\s?\@/
describe REMBOX rembox
score REMBOX 3
score FROMCASINO 3
# don 2010-06-10
-header CTOCTET_STREAM ContentType =~ /octet-stream/i
+header CTOCTET_STREAM Content-Type =~ /octet-stream/i
describe CTOCTET_STREAM Content type is octet-stream
score CTOCTET_STREAM 0.5
-header RTF_ATTACH ContentType =~ /name=.+\.rtf/i
+header RTF_ATTACH Content-Type =~ /name=.+\.rtf/i
describe RTF_ATTACH Contains an RTF Attachment
score RTF_ATTACH 0.5
-meta RTF_SPAM CTOCTET_STREAM & RTF_ATTACH
+meta RTF_SPAM CTOCTET_STREAM && RTF_ATTACH
describe RTF_SPAM Content type is octet-stream and has an RTF Attachment
-score RTF_SPAM 3
\ No newline at end of file
+score RTF_SPAM 3