Ive posted these and probably more before so you could search this site
but these ones are good for viruses

alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"Novarg(1)"; content: "JmpvZT9u";reference: url, http://www.cert.org/incident_notes/I...html;priority: 1; classtype: A suspicious filename has been detected; ruleset: Novag Rules; )

alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"Novarg(2)"; content: "am9lP25l";reference: url, http://www.cert.org/incident_notes/I...html;priority: 1; classtype: A suspicious filename has been detected; ruleset: Novag Rules; )

alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"Novarg(3)"; content: "b2U";content: "bmVv";reference: url, http://www.cert.org/incident_notes/I...html;priority: 1; classtype: A suspicious filename has been detected; ruleset: Novag Rules; )

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"Novarg(non-MIME)"; content: "|26 6a 6f 65 3f 6e 65 6f 2f|";content: "|6f 6c 64|";reference: url, http://www.cert.org/incident_notes/I...tml;classtype: A Network Trojan has been detected; ruleset: Novag Rules; )

alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"UPX File in Email(1)"; content: "VVBY";priority: 1; classtype: Executable code has been detected; ruleset: Novag Rules; )

alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"UPX File in Email(2)"; content: "WDAA";priority: 1; classtype: Executable code has been detected; ruleset: Novag Rules; )

alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"UPX File in Email(3)"; content: "UFgw";classtype: A Network Trojan has been detected; ruleset: Novag Rules; )