#body_check pcre
########################################################
# For pattern virus checking, please, goto:
# http://psi.com.br/~julio/postfix/virus_body_checks 
########################################################
# Joe editor users: ^tw
######################################################## 
# Para melhor performance do processo cleanup,
# coloque o máximo que vc puder numa linha só, 
# separados por 'pipe' (|).
########################################################
# For beter performance for the cleanup process,
# keep in the same line all regex separated by a 'pipe' (|).
########################################################
# Use estas configurações por sua conta, não me 
# responsabilizo por quaisquer danos/reclamaçoes no teu sistema.
########################################################
# Use this script at your own risk. No warranty is given. 
########################################################
# Julio Cesar Covolato
# julio@psi.com.br
########################################################
#
/(0\.000 +e-?mails|Special +Offer|envio +de +mala +direta|Milh(o|õ|õ)es.+de.+e-?mail|Cadastramos +seu +site|S\.? +1618|3873-2894|enviamos +sua +propaganda|mail +em +massa|Mala +Direta +Digital|remov(a|er) +(seu|vosso) +(e-?mail|endere.o|nome)|NEVER SEND SPAM\. IT IS BAD|worldtradecenter\.com|econoshop\.com\.br|(desej.|queir.) receber esta mensagem|CANCELAR O (RECEBIMENTO|ENVIO) DE FUTUR.S|POR APENAS R\$|divulgaonline|uma +forma +de +ser +removido|(assunto|titulo) remover|mesadejogos|ranchodovinho|iGospel|aluni\.com\.br|netfirms|Caminho de Santiago|karenmmfernandes|Trabalhe +em +casa|bucetinhavirgem|subject +.?excluir.?|dezweb|vipmidia\.com|Seu +e-?mail +foi +indicado|www\.bagatelasite\.com|Million email addresses|encontramos +seu +e-mail|redebiz\.com\.br|lucro\.rg3|maisrenda|MUNDOBRASIL\.COM|quica\.com\.br|chat\.ru|.more-opportunity\.com|manualrep|3741\.1481|Liver-joice|vendasbrasil|logosemarcas|brotherbrasil\.tripod\.com|br_americanas_registro\.exe|3425-8003|href.*\.kit\.net\/|150\.185\.222\.53|130\.207\.140\.90|window\.status=.http:\/\/www\.itau\.com\.br|http:\/\/.*orcamento\.(scr|pif|zip)|xman\.html|http:\/\/www\.yourloanz\.com|Steve Morris|I sent you an email a few days ago|No thanks: http|extrato.scr|(fotos|cart(a|ã)o|album)\.exe"?>|Menssenge|utesovsong)/ REJECT

/command.pif/ REJECT

# Links para arquivos duvidosos
/(https?|ftp):\/\/.*\/.*\.(bat|pif|scr)(\s|\")/
	REJECT Link para arquivo duvidoso

/(https?|ftp):\/\/.*=\.htm/ REJECT spammer

/^(Content-(Disposition: attachment;|Type:).*|\s+)(file)?name\s*=\s*"?.*\.(lnk|bat|c[ho]m|cmd|com|exe|dll|vxd|pif|scr|hta|jse?|sh[mbs]|vb[esx]|ws[fh])"?\s*$/
	REJECT anexo com extensao duvidosa

/^begin [0-9]{1,4} .*\.(lnk|bat|c[ho]m|cmd|com|exe|dll|vxd|pif|scr|hta|jse?|sh[mbs]|vb[esx]|ws[fh])$/	REJECT

# Rejeitar _TODOS_ anexos que são passiveis de virus
#/(name|filename)=.*\.(386|ad[ept]|app|as[dpx]|ba[st]|bin|btm|cab|cbt|cgi|chm|cil|cla(ss)?|cmd|cp[el]|crt|cs[chs]|cvp|dll|dot|drv|em(ai)?l|ex[_e]|fon|fxp|hlp|ht[ar]|in[fips]|isp|jar|jse?|keyreg|ksh|lib|lnk|md[abetw]|mht(m|ml)?|mp3|ms[ciopt]|nte|nws|obj|ocx|ops|ov.|pcd|pgm|pif|p[lm]|pot|pps|prg|reg|sc[rt]|sh[bs]?|slb|smm|sw[ft]|sys|url|vb[esx]?|vir|vmx|vxd|wm[dsz]|ws[cfh]|xl.|xms)\b/
#   REJECT anexo com extensao duvidosa

# Bug do outlook Iframe:
/iframe src=(3D)?cid:.* height=(3D)?0 width=(3D)?0/   DISCARD

# Viagra etc...
/(ummrx\.com|have-a-life\.info|pills\.biz|v i a g r a|CIALAPREN| pi11s? |\.V1@gRa\.|C-L-I-C-K H-E-R-E)/ DISCARD

/^\<BR\>\<A=20$/   REJECT propaganda nao solicitada