The code below matches several recent worms and viruses. It can be used to quarantine or simply drop them.
# The following will catch Mimail.Q, MiMail.R, Mydoom, Novarg, Shimg # and automatically drop them into a central 'mydoom' folder. :0 B * ^Content-Transfer-Encoding: base64 * b2br8E5jDS9ta3Boz9e9b7p4LmIPZ29sZC1QeGO8JMOYYWZlJUNiNafjMNhDo3DzdoW7aK mydoom :0 B * ^Content-Transfer-Encoding: base64 * Y3liZXJlYnpReXQzt/gt2DJcGUNqcm9GdmtGerq//fZna0YwU2duZnh6Fy5ya3IARwtaKz mydoom :0 B * ^Content-Transfer-Encoding: base64 * MNhDo3DzdoW7aK3QWmeLBluvgjl3WCtkDycfaxBbttaliR90aUqMksHRN3S2K58b2OG1bm mydoom :0 B * ^Content-Transfer-Encoding: base64 * L2DHhtACuvdg5mwKCwJSjUYIVrKzx05c9wF1FBJYOcIbFl4tP1tAjWwkjEILL5nkiABgfX mydoom :0 B * ^Content-Transfer-Encoding: base64 * IGYQqy4g1qORYNsPYRttqCAoagNXaCDvG89sWatHcBBPJB6o0UYq/2lFZpRr3dasC2QQaE mydoom :0 B * ^Content-Transfer-Encoding: base64 * KO35/8b/9nwKf0fDana5mf5drmxazU4b64lxjvwb/f//8fYGfHlcE7FPIfVU9StifaRjcL mydoom :0 B * ^Content-Transfer-Encoding: base64 * 1rrAeM0gDQdlmmtNtWVfG3QRFA672grQLlgIdDhobVVL2XMWVlc87bWFzho6IHtwAj2d9r mydoom :0 B * ^Content-Transfer-Encoding: base64 * Ga9SG/3//7dSpCoQS7DvKZAv72JQKWmvdKWWbadVD/D//9vSfeg2mRbgbKcMvEZXguXrNq mydoom :0 B * ^Content-Transfer-Encoding: base64 * TBuvVXOm//9/idxR1/7/Y6uPvh3LTd755dO39hzsPp/6sfv///8xZXpCOlu2J40AUMvgDP mydoom :0 B * ^Content-Transfer-Encoding: base64 * Q2VDAuk6pQf8sthCvHkbFDMACWK8hd0C2mSZPSKSIjutcMMWTmfwLUdsuyF4o1Tjemh5hk mydoom :0 B * ^Content-Transfer-Encoding: base64 * Z3h2Z0tDwwdp3y78fy10dmV5LTIuMG9xcIxfY05wdXJmmaHdCjNcdmkLRDvZ1r5tSGRWLV mydoom :0 B * ^Content-Transfer-Encoding: base64 * V0jTDPIH0MgIsEjTDDKYiAqARYEDNnhPUmWtFnAb4JuraGYHK2nGAwbeAiBFcj2UWskGOE mydoom