(\s*?\<div\>\s*?(\<strong\>)*?\s*?\S\s*?(\<\/strong\>)*?\s*?\<\/div\>){3}
..\% 0ff
..\% Discount
..\% improvement
..\% off
<a\s+href\s*=\s*"http://(?![^/]+ebay)[^>]+>(\s*<(?!/a)[^>]+>){0,5}\s*<img\s+[^>]*src\s*=\s*"?http://pics.ebaystatic.com/
A possible virus
A virus was detected
A+\s.\sM+\s.\sB+\s.\sI+\s.\sE+\s.\sN+\s
ACHTUNG! Sie haben eine mit einem Virus infizierte Mail verschickt
Advarsel! Dit e\-brev indeholder virus
ALERT \- Virus
ALERTA DE VIRUS
Alerte de l'Anti\-virus
Alerte virus
ALERTE VIRUS !
ALERTE \\- Vous avez envoye un mail avec virus
ALERTE: un virus a 
anal.?sex
AntiVirus Alert!
Antivirus Notification
AntiVirus scan results
Antivirus stopped your message
antivirus system found
antivirus system report
Anti\-Virus Alert
Anti\-Virus Notification
ANw-bermittlung zu folgenden Empf.AOQ-ngern fehlgeschlagen
Atencin: Virus detectado en e\-mail
ATENTIE !!! Virusi detectati
attachments contain a virus
Attenzione Virus
Auto Notification : Virus Detected!!
AUTOMATED EMAIL BLOCK: VIRUS
AVISO: Email rejeitado: VIRUS Detectado
by our VIRUS Scanner
C+\s.\sI+\s.\sA+\s.\sL+\s.\sI+\s.\sS+\s
Centrale Anti\-Virus melding
Charity\/non-?profit
custservice_.{1,20}@.{1,20}bank.de
detected a Virus
Eclipse Internet VIRUSshield detected VIRUS
Email Quarantined Due to Virus
Email you sent may have contained a virus
eTrust Antivirus Lotus Notes Domino Option detected virus!
Failed to clean virus
File was infected with a virus
Filtering for Domino detected a virus
FOUND VIRUS IN YOUR MAIL TO:
gefhrlicher Virus
Geile .{1,30} im Netz
go2.{1,10}\.info
hat einen Virus
hotmail\.com\?subject
Hov, du har sendt Jubii en virus
IcoMailServer: Virus 
identdep.{1,20}@volksbank.de
identdep_.{1,20}@dresdner-bank.de
Iflex Mail Server detected an unrepairable virus in a message you sent
Information \- Antivirus
Internet Mail Failure \- Virus Alert
is removed from here because it contains a virus
kunden@citibank.com
L+E+V+I+T+R+A+\s
Last[ _](?:Trade|Price)[ :]
Lycos Security hat einen Virus entdeckt
M+\s.\sE+\s.\sR+\s.\sI+\s.\sD+\s.\sI+\s.\sA+\s
Mail delivery error : Virus found
Mail virus incident report
MAILER\-DAEMON@virus\-int\.netuse\.de
MailSure Virus Alert
Mass Mailing Virus Detected \- Message was deleted.
McAfee detected a virus in a document sent to you\.
MDaemon Notificacion \- Virus Encontrado!!!!
MDaemon Warning \- Virus Found
mensagem com virus
message from .{0,99}virus detect system
Message you sent blocked by our bulk email filter
NAV detected a virus
NAV ha rilevato un virus in un documento inviato
NAV hat einen Virus oder nicht erlaubten Inhalt
Net Integrator Virus Alert
non-?profit\/charity
Norton Anti ?Virus detected
Notification du serveur antivirus
Notification of VIRUS mail
P+.{1,5}?H+.{1,5}?A+.{1,5}?R+.{1,5}?M+.{1,5}?A+.{1,5}?C+.{1,5}?Y+\s
P+\s*?h+\s*?a+\s*?r+\s*?m+\s*?a+\s*?c+\s*?y+
P+\s?h+\s?a+\s?r+\s?m+\s?a+\s?c+\s?y+
Ph.{1,6}ceutic.{1,4}l
Possible virus found in message you sent
P\s?h\s?a\s?r\s?a\s?m\s?a\s?c\s?y
Quarantined Mail: virus from
RAV AntiVirus scan
RAV[0\-9]+ Antivirus notification
Received: from .{1,100}by (.{3,40}) with esmtp.{1,100} for .{1,20}@\1
Received:\s+from\s+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s+\(HELO\s+\S+\)\s+by\s+(\S+)\s+with\s+esmtp\s+\(\S+\s\S+\)\s+id\s+\S{6}-\S{6}-\S\S\s+for\s+\S+@\1;
Recipient Virus\-alert
removed from here because it contains a virus
Returned due to virus
Returned mail: Possible Virus Infection
S+\s.\sO+\s.\sM+\s.\sA+\s
Short Term Target(?::| Price:)
sombrasil\.ig\.com\.br/musicalcards/go\.php\?url=clube/apresentacao\.php&op=-1
SRC=['"]CID:.*?FONT (STYLE=['"]COLOR:|COLOR=['"]).[EF].[EF].[EF].['"]
Subject:  contact my secretary now
Subject:  Undeliverable Mail
Subject: . news .
Subject: /?SPAM/?
Subject: BUSINESS PROPOSAL
Subject: BUSINESS RELATIONSHIP
Subject: Cheapest
Subject: DELIVERY FAILURE
Subject: Delivery Status Notification \(Failure\)
Subject: Fw\[.?.?\]:
Subject: GOOD DAY
Subject: IMPORTANT MESSAGE FOR
Subject: look here
Subject: PARTNERSHIP
Subject: Please Call Me A.S.A.P
Subject: REQUEST AND CALL ME
Subject: Respond ASAP
Subject: Returned mail: see transcript for details
Subject: Rolex
Subject: Spam: Mail could not be delivered
Subject: Undeliverable: Mail_delivery_failed
Subject: URGENT!!
Subject: VERY IMPORTANT
Subject: VERY URGENT
Subject: Warning: E-mail viruses detected
Subject: WINNING NOTIFICATION
Subject: Yours Assistance is Needed
Subject: \*\*\*\*\*SPAM
Subject: \d:
Subject:.{0,20}it me
Subject:.{0,50}asshole
Subject:.{1,20} at \$.{1,20}\[Ref:\d\d\d\]
Subject:.{1,20}Much Bigger
Subject:.{1,20}\(Urgent\)
Subject:.{1,40}(st[o0]cks?|cribsheet|stox|small[ -]?cap) report
Subject:.{1,40}micr[qw]?o-?caa?pk?s?
Subject:.{1,60}agra
Subject:.{1,60}Bull Stock
Subject:.{1,60}Loan
Subject:.{1,60}MergerTrader Stock
Subject:.{1,60}Micro- Cap
Subject:.{1,60}MicroCap
Subject:.{1,60}Penny Stock
Subject:.{1,60}Samurai Stock
Subject:.{1,60}Small Stock
Subject:.{1,60}Smallcap
Subject\: Fwd\[..\]\:
Subject\: Re\[..\]\:
support_.{1,30}@.{1,30}bank.de
support_num_.{1,20}@volksbank.de
supprefnum.{1,20}@volksbank.de
supprefnum.{1,30}bank.de
supprefnum_id_.{1,20}@volksbank.de
Suppresion du Virus
Suppression de fichier due a un virusMail Delivery
Symantec AntiVirus detected a violation
to contain a Virus
Trovato virus nel messaggio
Undelivered mail: VIRUS FOUND
Unfortunately your message was blocked as a possible Virus was detected
rus figyelmeztet
V a l \/ u m
V \/ a g r a
V+\s.\sA+\s.\sL+\s.\sI+\s.\sU+\s.\sM+\s
V+\s.\sI+\s.\sA+\s.\sG+\s.\sR+\s.\sA+\s
VIRUS .{0,99}IN \(A \)?MAIL FROM YOUi
Virus Alert
Virus Alert 
VIRUS ALERT !
Virus Alert \-
Virus Alert \- ScanMail for Lotus Notes \-\->
VIRUS ALERT:
Virus attachment removed
Virus Check Alert
Virus detectado en el mensaje
VIRUS DETECTADO PARA 
Virus detected
VIRUS EN SU CORREO
Virus encontrado
Virus entfernt
Virus found
virus from
VIRUS Ihrer Nachricht
Virus in einer E\-Mail von Ihnen gefunden!
VIRUS IN IHRER
Virus in mail
virus in outgoing mail
Virus in una mail per lei
virus in verschickter
VIRUS IN YOUR MAIL
Virus incident
Virus infection
Virus infection detected!!!
Virus infection notice
Virus intercepted
VIRUS MESSAGE
Virus Notification:
Virus Quarantine Notification
VIRUS REJECT
Virus trovato in un messaggio inviato
Virus Warning
Virus Warning from MailScan to Mail\-Sender!
VIRUS WARNING\( :\)?
Virus [fF]ound in message
VIRUS \(.{1,50}\) IN MAIL
VIRUS \(Worm\.\)
Virus \(\\(.{1,50}\\) \)?in Ihrer Nachrichti
VIRUS.{0,99} EM SUA MENSAGEM
viruses detected
Virusinformation
Virusveszely! Virus warning!
VirusWall asp\-next.com has quarantined a message
Viruswarnung
Virus\.pif gefunden \- Message Rejected
Votre message contient un virus
Warning Possible Virus Alert !!!
WARNING VIRUS FOUND!!!
Warning \- Virus detected
Warning: antivirus system report
Warning: E\-mail virus detected
Warning: Possible Virus Infection
Warning: Virus found by AVAS Anti\-Virus module
WARNING: YOU MAY HAVE A VIRUS
WARNING: YOU WERE SENT A VIRUS
was blocked by our Spam Firewall
WatchDog: Virus gefunden
We were compensated.{1,10}dollars to distribute this report
www\.hpg\.ig\.com\.br/galeria/index\.php3\?int=1
X+a+n+a+x+
X+\s.\sA+\s.\sN+\s.\sA+\s.\sX+\s
X-Env-Sender:.{1,50}\.com\.cn
YOU MAY HAVE A VIRUS
Young.{1,50}schoolgirl
Your email requires verification
Your mail was deleted by Norton Antivirus
[0-9][ -]Day Target[(:?_| )Price]?:
[bB]uy [cC]heap
[dD]iscount [dD]rugs
[hH]erbal
[Ll][Ee3葃][Vv][Ii1!|l][Tt][Rr][Aa@]\s
[nN]asty [gG]irls
[O0o]EM Software
[oO]nline [dD]rugs
[pP]rescription [dD]rugs
[rR]egal.s
[rR]eplica\s
[sS]oft [tT]abs
[tT]he [vV]irus
[Vv].?[Ii1!|l].?[Aa@].?[Gg][Rr][Aa@]\s
[Vv].?[Ii1!|l].?[Aa@][Gg][Rr][Aa@]\s
[Vv].?[Ii1!|l][Aa@][Gg][Rr][Aa@]\s
[Vv].agra
[vV].cod.n
[Vv]irus found in sent message
[vV]irus infect
[Vv][Ii1!|l].?.?[Aa@][Gg][Rr][Aa@]\s 
[Vv][Ii1!|l].?[Aa@][Gg][Rr][Aa@]\s
[Vv][Ii1!|l][Aa@].?.?[Gg][Rr][Aa@]\s
[Vv][Ii1!|l][Aa@].?[Gg][Rr][Aa@]\s
[Vv][Ii1!|l][Aa@][Gg].?.?[Rr][Aa@]\s 
[Vv][Ii1!|l][Aa@][Gg].?[Rr][Aa@]\s 
[Vv][Ii1!|l][Aa@][Gg][Rr].?.?[Aa@]\s 
[Vv][Ii1!|l][Aa@][Gg][Rr].?[Aa@]\s
[Vv][Ii1!|l][Aa@][Gg][Rr][Aa@]\s 
[xX]anax
\"Ihre Telekom Rechnung\" \<info@t-com\.net\>
\$aving
\$\$\$
\$\$\$\$\$\$
\*\*\* You have sent a virus !
\<DIV\>.?.?.?\<\/DIV\>.?.?.?\<DIV\>.?.?.?\<\/DIV\>.?.?.?\<DIV\>.?.?.?\<\/DIV\>
\<DIV\>.\<\/DIV\> \<DIV\>.\<\/DIV\>
\<DIV\>\<FONT face=Arial> . \<FONT face=Arial
\<\/DIV\> \<DIV\> . \<\/DIV\> \<DIV\>
\> . \<\/span\>.\<span style\=
\>.\<\/span\>.\<span
\@canadian.{1,10}.com
\@tradingmarkets.com
\@yahoo.com.au
\b(?:\\\/|V)+\s?\S?\s?\W?[I1!|lt\xEC-\xEF]+\s?\S?\s?\W?[A4\xE0-\xE6@]+\s?\S?\s?\W?G+\s?\S?\s?\W?R+\s?\S?\s?\W?[A4\xE0-\xE6@]\b#                                         VIAGRA
\bbegin\b \d\d\d \b\S{0,72}.*(\S{61}).{0,61}\bend\b# UUENCODED
\bC+\s?\S?\s?\W?[I1!|lt\xEC-\xEF]+\s?\S?\s?\W?[A4\xE0-\xE6@]+\s?\S?\s?\W?[L!|1]+\s?\S?\s?\W?[I1!|lt\xEC-\xEF]+\s?\S?\s?\W?S\b#                                          CIALIS
\bH+\s?\S?\s?\W?[E3\xE8-\xEB]+\s?\S?\s?\W?R+\s?\S?\s?\W?B+\s?\S?\s?\W?[A4\xE0-\xE6@]+\s?\S?\s?\W?[L!|1]\b#                                                              HERBAL
\bP+\s?\S?\s?\W?H+\s?\S?\s?\W?[A4\xE0-\xE6@]+\s?\S?\s?\W?R+\s?\S?\s?\W?M+\s?\S?\s?\W?[A4\xE0-\xE6@]+\s?\S?\s?\W?C#                                                      PHARMAC... Y, EUTICAL, etc...
\bP+\s?\S?\s?\W?[E3\xE8-\xEB]+\s?\S?\s?\W?(?:\/\|\/|N)+\s?\S?\s?\W?[I1!|lt\xEC-\xEF]+\s?\S?\s?\W?[S$5]\b#                                                               PENIS
\bR+\s?\S?\s?\W?[E3\xE8-\xEB]+\s?\S?\s?\W?F+\s?\S?\s?\W?[I1!|lt\xEC-\xEF]+\s?\S?\s?\W?[L!|1]+\s?\S?\s?\W?[L!|1]\b#                                                      REFILL
\bR+\s?\S?\s?\W?[E3\xE8-\xEB]+\s?\S?\s?\W?P+\s?\S?\s?\W?[L!|1]+\s?\S?\s?\W?[I1!|lt\xEC-\xEF]+\s?\S?\s?\W?C+\s?\S?\s?\W?[A4\xE0-\xE6@]\b#                                REPLICA
\bR+\s?\S?\s?\W?[O0\xF2-\xF6]+\s?\S?\s?\W?[L!|1]+\s?\S?\s?\W?[E3\xE8-\xEB]+\s?\S?\s?\W?X\b#                                                                             ROLEX
\bX+\s?\S?\s?\W?[A4\xE0-\xE6@]+\s?\S?\s?\W?(?:\/\|\/|N)+\s?\S?\s?\W?[A4\xE0-\xE6@]+\s?\S?\s?\W?X\b#                                                                     XANAX
\b[E3\xE8-\xEB]+\s?\S?\s?\W?(?:\/\|\/|N)+\s?\S?\s?\W?[L!|1]+\s?\S?\s?\W?[A4\xE0-\xE6@]+\s?\S?\s?\W?R+\s?\S?\s?\W?G+\s?\S?\s?\W?[E3\xE8-\xEB]\b#                         ENLARGE
\b[E3\xE8-\xEB]+\s?\S?\s?\W?R+\s?\S?\s?\W?[E3\xE8-\xEB]+\s?\S?\s?\W?C+\s?\S?\s?\W?T+\s?\S?\s?\W?[I1!|lt\xEC-\xEF]+\s?\S?\s?\W?[O0\xF2-\xF6]+\s?\S?\s?\W?(?:\/\|\/|N)\b# ERECTION
\b[S$5]+\s?\S?\s?\W?P+\s?\S?\s?\W?[U\xB5\xF9-\xFC]+\s?\S?\s?\W?R+\s?\S?\s?\W?M#                                                                                         SPURM
\b[S$5][\s\W]{0,}[I|!][\s\W]{0,}[DO][\s\W]{0,}(?:[E3]{0,}[\s\W]{0,}){1,}F{1,}[\s\W]{0,}[E3][\s\W]{0,}C[\s\W]{0,}[T][\s\W]{0,}[\s\W]{0,}
\b[U\xB5\xF9-\xFC]+\s?\S?\s?\W?(?:\/\|\/|N)+\s?\S?\s?\W?[I1!|lt\xEC-\xEF]+\s?\S?\s?\W?(?:\\\/|V)+\s?\S?\s?\W?[E3\xE8-\xEB]+\s?\S?\s?\W?R+\s?\S?\s?\W?[S$5]+\s?\S?\s?\W?[I1!|lt\xEC-\xEF]+\s?\S?\s?\W?T+\s?\S?\s?\W?Y\b.*?\bD+\s?\S?\s?\W?[E3\xE8-\xEB]+\s?\S?\s?\W?G+\s?\S?\s?\W?R+\s?\S?\s?\W?[E3\xE8-\xEB]+\s?\S?\s?\W?[E3\xE8-\xEB]\b# UNIVERSITY followed anywhere by DEGREE
\d\d\d\d\d\d@tom.com
\d\s+(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+\d\d\d\d\s+\d\d:\d\d(:\d\d)?\s+[+\-]\d\d[6-9]\d
\sB\@nk
\sC+I+A+L+I+S+\s
\sCasino\s
\sche@p\s
\seridan\s
\sFick\s 
\sg.eil\s
\sOr.der\s
\sPorn\s 
\sporn\s 
\sReplica\s
\sS.e.x\s
\sst ock\s
\sst@ck\s
\sV+.I+.A+.G+.R+.A+\s
\s[cC][il1I][aA][lL][il1I][sS]\s
\s[Pp][Oo0][Rr][Nn]\s
\[.{1,50}: Virus detected\]
\\\/IAGRA
