> Almost certainly a virus. "src=cid:whatever" references an > attachment in the > same message. Since an <iframe> creates a single frame, if this wasn't a > virus, it would just be like putting the attachment into the main > part of the > message; in other words, identical to doing things the normal way.
Ah, that makes sense. I'm going to add a separate personal rule to filter out the messages with <iframe src=cid> tags specifically - more of a virus checker's job than SA's I suppose. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "Talk sense to a fool and he calls you foolish." -- Euripides _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk