[tlug] Filtering on HTML, is this useful for anything but implementing Klez?

["Stephen J. Turnbull" <stephen@example.com>]

Web gurus and wannabes:

Klez-style viruses often contain the following kind of element:

<iframe src=cid:RI2259xb53jB26 height=0 width=0>

Is this generated in _email_ HTML for _any_ reason other than
implementing a Klez-style virus (note the dimensions)?

Yes, we already bitbucket HTML-only messages, but lots of otherwise
nice people work in environments where multipart/alternative including
a text/html part is (allegedly) desirable.  I'm unwilling to chance
bitbucketing real mail just because it looks like Klez to my naive
filter, but if this only occurs in viruses, I can save a lot of
spam-scanning time.  (Unfortunately we don't control the MTA so we
can't conveniently install SpamAssassin or TMDA, working on that, but
not quite there yet. :-( )

-- 
Institute of Policy and Planning Sciences     http://turnbull.sk.tsukuba.ac.jp
University of Tsukuba                    Tennodai 1-1-1 Tsukuba 305-8573 JAPAN
 My nostalgia for Icon makes me forget about any of the bad things.  I don't
have much nostalgia for Perl, so its faults I remember.  Scott Gilbert c.l.py