Mouse over activated video email

Wed Jul 5 11:15:09 IST 2006

We have received a spam email that contains a video message which is
activated by moving the mouse over a black box. Could someone with more
knowledge of this kind of thing let me know if this action could be used
maliciously and if so could this disarmed by MailScanner? The message is
being viewed in MS outlook.

Email source below

<HTML>
<HEAD></HEAD>
<BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#000000" VLINK="#000000"
ALINK="#000000" LEFTMARGIN="0" TOPMARGIN="0" MARGINWIDTH="0"
MARGINHEIGHT="0">
<div align="center"><p><strong><font size="2" face="Arial, Helvetica,
sans-serif">If you see the black box below, brush your mouse over
it....</font></strong></p></div><table width="600" height="448"
border="0" cellpadding="0" cellspacing="0"
background="cid:B6FA7D6A88C8473F98F6986AF46CBEBB" align="center"
usemap="#Map">
	<tr>
		<td width="99" height="128"
background="cid:F72AA01CB6424F38886CE30A8D210582" id="TopLeftTD"><img
src="cid:F72AA01CB6424F38886CE30A8D210582" width="99" height="128"
name="TopLeftImage" border=0 usemap="#TLMap"></td>
		<td width="99" height="128"
background="cid:F72AA01CB6424F38886CE30A8D210582" id="TopRightTD"><img
src="cid:F72AA01CB6424F38886CE30A8D210582" width="501" height="128"
name="TopRightImage" border=0 usemap="#TRMap"></td>
	</tr>
	<tr>
		<td width="0" height="320"
background="cid:F72AA01CB6424F38886CE30A8D210582" id="BottomLeftTD"><img
src="cid:F72AA01CB6424F38886CE30A8D210582" width="99" height="320"
name="BottomLeftImage" border=0 usemap="#BLMap"></td>
       <td align="left" valign="top">
			<table border="0" cellspacing="0"
cellpadding="0">
				<tr>
					<td><a
href="http://www.vismail.com/direct/VmailVIew.asp?fdVmailGUI={0C871974-3
5D0-4A34-821D-AB57B39AC72E}&fdEmailForwardEmailForward2Id=1314763"><img
dynsrc="cid:AD794F0637284678B93EBBB22F5E94A2" width="260" height="151"
border="0" start="mouseover" src="cid:DDED207641684B9F8FC0F29C9EB3C975"
id="ClickThrough"></a></td>
					<td width="241" height="151"
background="cid:F72AA01CB6424F38886CE30A8D210582" id="BRTopRightTD"><img
src="cid:F72AA01CB6424F38886CE30A8D210582" width="241" height="151"
name="BRTopRightImage" border=0 usemap="#BRTRMap"></td>
				</tr>
				<tr>
					<td colspan=2 width="501"
height="169" background="cid:F72AA01CB6424F38886CE30A8D210582"
id="BRBottomTD"><img src="cid:F72AA01CB6424F38886CE30A8D210582"
width="501" height="169" name="BRBottomImage" border=0
usemap="#BRBottomMap"></td>
				</tr>
			</table>
	</tr>
</table>
<div align="center"><p><font size="1" face="Verdana, Arial, Helvetica,
sans-serif">If you do not know the sender and believe you have been sent
this in error, please click <a
href="http://www.vismail.com/home/spam.asp" target="_blank">here</a> to
let us know.</font></p><p><font size="1" face="Verdana, Arial,
Helvetica, sans-serif">Alternatively, if you wish to be taken off the
mailing list please click <a
href="http://www.vismail.com/home/unsubscribe.asp?fromEmail=(chris@deliv
erydotcom.com)&toEmail=jeremy.gane at roke.co.uk "
target="_blank">here</a>, fill out the form and submit. Thank
you.</font></p></div><map name="TRMap">
<area shape="rect" coords="100,42,313,71"
href="http://www.vismail.com/CustomTemplateLinkRedirect.asp?fdCustomTemp
lateLinkVisitCustomTemplateLinkId=9537&fdVmailId=13863&fdCustomTemplateL
inkVisitRecipientId=3260436">
</map>
<map name="BRTRMap">
<area shape="rect" coords="16,115,154,140"
href="http://www.vismail.com/Direct/VmailForward.asp?fdVmailGUI={0C87197
4-35D0-4A34-821D-AB57B39AC72E}&fdEmailForwardEmailForward2Id=1314763">
<area shape="rect" coords="16,65,153,89"
href="http://www.vismail.com/CustomTemplateLinkRedirect.asp?fdCustomTemp
lateLinkVisitCustomTemplateLinkId=9539&fdVmailId=13863&fdCustomTemplateL
inkVisitRecipientId=3260436">
<area shape="rect" coords="15,13,155,40"
href="http://www.vismail.com/CustomTemplateLinkRedirect.asp?fdCustomTemp
lateLinkVisitCustomTemplateLinkId=9540&fdVmailId=13863&fdCustomTemplateL
inkVisitRecipientId=3260436">
</map>
<img src="MailScannerWebBug" width="1" height="1" alt="Web Bug from
http://www.vismail.com/ViewCountIncrease.asp?fdVmailGUI={0C871974-35D0-4
A34-821D-AB57B39AC72E}" /></BODY>
</HTML>

Thanks

Dean Plant