I think the spammers have programmed MS Office into being an automated spam generator. These messages seem to be created by converting text into a .gif file that is split into smaller .gif files and re-assembled in MS Word.

When you view the email html you don’t see the attached document or images only cid: references to the original document.

If Word is the default mail editor in Outlook, you can click reply and are then able to select the individual image elements. If you copy the entire document (ctrl-a, ctrl-c) you can paste it into MS FrontPage and see the original html produced by Word. The images are embedded in the original Word document and referenced by the Outlook as src=cid: So you never see the original message in Outlook. Surprisingly Outlook does not indicate that the message/images are actually an attachment. Also Outlooks filters do not seem look at the html so you can't filter the src=cid.

Unless someone knows of a MS solution, it appears that a third party program will have to be used by Outlook users.

MartinC wrote: Ken Bour wrote: Here is the regex that I am using to block these messages: src\=(\"c|c)id\: thats a bit vague to be honest, blocks all src=cid. I ended up putting in something a bit more specific. (img src=cid:[a-zA-Z0-9]{16,20}) you can vary the numbers to whatever you want, 32,32 or whatever.

Why does it even matter what comes after the cid:?  If the message contains the match from the first regex, then it should be canned.

I do see a flaw in the first regex, if there is a newline character before or after the "=" then it won't match.

Marco wrote: If only the bill gates' of this world would issue rewards on the heads of virus programmers, "wanted, dead or alive, $$$$$$ for the one that....." etc etc. Sounds funny eh? but you think about it... lets put a bounty on the head of the ones that created the latest wave of spamming viruses of, let's say, $200,000. I mean, thats peanuts for Bill, and seeing his OS is mostly responsible for all the crap out there it seems fair to me he should be the one to pick up the tab. With such an insentive i can allmost guarantee success in bringing the virus-geek(s) to justice. (i'd rather see them shot on the spot btw. ). The zombie networks are beeing used for all sorts of illegal practises, only one of the 'features' is sending spam, the virus programmers made this all happen, they should be dealt with radically and decisively. sorry, just need to vent sometimes

I agree whole heartidly, LOL.  I think we should enfoce a law that I saw on the old 80's show, Max Headroom.  If you crashed the net in the world of Max Headroom, it was a capital punishment offense!  Surely under that train of thought, severly slowing down parts of the net would deserve a good caining.

Another pet peeve of mine with newsletters and some shopping carts is when the use the recipients email address as the from address in the emails they are sending from their own mail servers.

We reject emails that fail SPF checking, including our own domains.