These rules works, but if you have better idea, let me know.
{+block{MaybeVirus}}
/.*\.(zip|pdf|doc|docx|xls|xlsx|exe|msu)$
/.*\.(zip|pdf|doc|docx|xls|xlsx|exe|msu)\?(.*)$
(I'm trying this to prevent downloading; because https://addons.mozilla.org/en-us/firefox/addon/public-fox/ doesn't work.)