Also, Is there a special rule to detect messages like the one below?Yeah, it's called a virus scanner. That's a mytob variant virus message.
My virus scanner cleans the attachment, but still get people emailing and calling about their accounts when they receive these messages.