Fix errors found by @ydklijnsma

malicious_document.yar

@@ -179,7 +179,7 @@ rule macrocheck
         Date        = "2014/11/30" 
         Description = "Identify office documents with the MACROCHECK credential stealer in them.  It can be run against .doc files or VBA macros extraced from .docx files (vbaProject.bin files)."
         Reference   = "https://www.fireeye.com/blog/threat-research/2014/11/fin4_stealing_insid.html"
-+
+
     strings:
         $PARAMpword = "pword=" ascii wide
         $PARAMmsg = "msg=" ascii wide

malware/Miscelanea.yar

@@ -92,20 +92,6 @@ rule memory_shylock
 
 }
 
-rule RookieStrings : Rookie Family
-{
-    meta:
-        description = "Rookie Identifying Strings"
-        author = "Seth Hardy"
-        last_modified = "2014-06-25"
-        
-    strings:
-        $ = "RookIE/1.0"
-        
-    condition:
-       any of them
-}
-
 rule ScanBox_Malware_Generic {
 	meta:
 		description = "Scanbox Chinese Deep Panda APT Malware http://goo.gl/MUUfjv and http://goo.gl/WXUQcP"

malware/NetPass.yar

-/*
-    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
-
-*/
-
-import "pe"
-
-rule NetpassStrings : NetPass Variant {
-
-        meta:
-                description = "Identifiers for netpass variant"
-                author = "Katie Kleemola"
-                last_updated = "2014-05-29"
-
-        strings:
-		$exif1 = "Device Protect ApplicatioN" wide
-		$exif2 = "beep.sys" wide //embedded exe name
-		$exif3 = "BEEP Driver" wide //embedded exe description
-		
-		$string1 = "\x00NetPass Update\x00"
-		$string2 = "\x00%s:DOWNLOAD\x00"
-		$string3 = "\x00%s:UPDATE\x00"
-		$string4 = "\x00%s:uNINSTALL\x00"
-
-        condition:
-                all of ($exif*) or any of ($string*)
-
-}	
-
-rule NetPass : Variant {
-	meta:
-		description = "netpass variant"
-		author = "Katie Kleemola"
-		last_updated = "2014-07-08"
-	condition:
-		NetpassStrings
-}
-
-

malware/NetTraveler.yar

@@ -5,6 +5,37 @@
 
 import "pe"
 
+rule NetpassStrings : NetPass Variant {
+
+        meta:
+                description = "Identifiers for netpass variant"
+                author = "Katie Kleemola"
+                last_updated = "2014-05-29"
+
+        strings:
+                $exif1 = "Device Protect ApplicatioN" wide
+                $exif2 = "beep.sys" wide //embedded exe name
+                $exif3 = "BEEP Driver" wide //embedded exe description
+
+                $string1 = "\x00NetPass Update\x00"
+                $string2 = "\x00%s:DOWNLOAD\x00"
+                $string3 = "\x00%s:UPDATE\x00"
+                $string4 = "\x00%s:uNINSTALL\x00"
+
+        condition:
+                all of ($exif*) or any of ($string*)
+
+}
+
+rule NetPass : Variant {
+        meta:
+                description = "netpass variant"
+                author = "Katie Kleemola"
+                last_updated = "2014-07-08"
+        condition:
+                NetpassStrings
+}
+
 rule NetTravStrings : NetTraveler Family {
 
 

malware/Rooter.yar

@@ -50,6 +50,20 @@ rule Rooter : Family
         RooterCode or RooterStrings
 }
 
+rule RookieStrings : Rookie Family
+{
+    meta:
+        description = "Rookie Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "RookIE/1.0"
+        
+    condition:
+       any of them
+}
+
 rule RookieCode : Rookie Family 
 {
     meta: