http://www.spamassassin.org
... plus two simple rules:
Code:
header VIRUS_DETECT_01 Subject =~ /detected.*virus/
describe VIRUS_DETECT_01 Claims to have detected a Virus
header VIRUS_DETECT_02 Subject =~ /virus.*detected/
describe VIRUS_DETECT_02 Claims to have detected a Virus
score VIRUS_DETECT_01 10.00
score VIRUS_DETECT_02 10.00