suspected pattern has phases, expressions or words that implied in
malicious action. The results of this search MAY SUSPEND the message
delivery, if it has:
- HTML contents or attachments within
message or URLs pointers. HTML codes may be converted to pure-text.
- The system is loaded with the
vírus/worms signing (site da Symantec).
- Message body contents are checked by 2
antivirus products (McaFee and Clamav), checking existence and the
payload of the URLs.