I had a problem with these types of messages before, and I was able to remove a lot of them by detecting a pattern in the HTML (ie.. DIV contains Font style and IMG tag... ).

Here is an example of the regex I used

((?i)div[<>]+font\sface=3DArial\ssize=3D2[<>]+img\salt=3D""\shspace=3D0=20\s+src=3D"cid\:00)

The emails in paticular had a common pattern of tags, and the cid always started with 00. If you view the source of the email you may be able to pickup on this type of pattern.

I think the spammers have programmed MS Office into being an automated spam generator. These messages seem to be created by converting text into a .gif file that is split into smaller .gif files and re-assembled in MS Word.

When you view the email html you don’t see the attached document or images only cid: references to the original document.

If Word is the default mail editor in Outlook, you can click reply and are then able to select the individual image elements. If you copy the entire document (ctrl-a, ctrl-c) you can paste it into MS FrontPage and see the original html produced by Word. The images are embedded in the original Word document and referenced by the Outlook as src=cid: So you never see the original message in Outlook. Surprisingly Outlook does not indicate that the message/images are actually an attachment. Also Outlooks filters do not seem look at the html so you can't filter the src=cid.

Unless someone knows of a MS solution, it appears that a third party program will have to be used by Outlook users.