NO SHADE CLASS

Fri Aug 16 16:28:32 IST 2002

Hi,

I'm using mailscanner-3.22-12, sendmail-8.11.6-3 and Sophos on a Redhat
7.2 system. Recently my users have been getting these "NOSHADE CLASS"
messages with the following content:

From: "letters" <letters at thestreet.com>
To: <a9a12321 at telus.net>
Subject: NOSHADE CLASS
Date: Thu, 15 Aug 2002 19:58:08 -0700
Message-ID: <200208160258.g7G2w8w210759 at logs-mtc-tf.proxy.aol.com>
MIME-Version: 1.0
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
X-Apparently-From: Dudek49 at aol.com
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4807.1700
X-OlkEid: A2045720B52AB357E4B0D611BB7E00606E3175A2

<HTML><HEAD></HEAD><BODY>
<iframe src=xxxx   height=3D0 width=3D0>
</iframe>
<FONT></FONT></BODY></HTML>

where xxx is some 3Dcid:blahblah number. I tried to send this message
intact to the Mailscanner list but it was rejected because it contained
the 'Exploit.IFrame.FileDownload' virus so this time I removed the value
of the "src=" portion.

Do I need to add additional rules to filter out this virus?

Thanks,
Stephen