its to hard to deal with here , but the best soulution would be to initially text match to write $decode, and then actually decode the string, then compare if the text precedding the //write appears in the decoded text. That wasy u could be sure that the PM was just the virus propergating.
There are too many different ones out there to match them against actual decode string...
Nak CAri Awek, Guna Command NIe //write blabla
Want To Be An IRCOp? Try This New Bug Type //write blabla
gus2 m b maging OPERATOR sa #channel ? copy/paste mo i2-> //write blabla
Do You Want to be an OPERATOR in #channel ? copy/paste this-> //write blabla
Wanna be an OPERATOR in #channel ? copy/paste this-> //write blabla
STOP SPAM, USE THIS COMMAND //write blabla
Want to be an OPERATOR in #channel ? copy/paste this-> //write blabla thats just small list... and this list grows every day...
And someone can send you something like:
Hello, the user Lame send me this message: Do You Want to be an OPERATOR in #channel ? copy/paste this-> //write $decode(blabla) etc.. your script detects //write and $decode... and kicks...
Though yea that would be better then kicking for character '$' (I have seen couple kickers like this too

)... but then you need to update your script every time when you see something new
and add it maybe like this:
on *:text:*:?: {
if ($1 == Nak) && ($17 == +R) {
goto kick
}
if ($1 == Wanna) && ($20 == +R) {
goto kick
}
else {
return
}
:kick
etc...
And even then can happen that someone reports you spammes by pasting first the spam message and then something like "The user Lame sent me this."
Maybe the best solution would be to kick them manually

Just add it to popups and do it manually when you see it...
I do it this way, by kicking them manually with message
(You are sending $decodes! Message me with word HELP (And wait for answer) or join #NoHack and ask help there!)If user is really intrested about cleaning his/her PC he/she will message... and then the ignore doesnt matter either (since PM window is open)