Malicious emails getting to users. Adobe PDF

Hi,

Users are receiving Malicious emails, here is an example:

"SMTP and POP3 servers for user@domain.com.au mailbox are changed. Please carefully read the attached instructions before updating settings.

http://f1.grp.yahoofs.com/v1/wAjrSwtpvg6L6efPNZBiYDP__uzORA7CvCfs583JeF5

kU1cW01CupKTBEyymaZZeXC3n4Mvczz4J4m6bIFXFmA/open.exe"

The sophos puremessage console reports it has quarantined at least 40 or more emails this morning containing that email above. I have installed the latest updates and definitions.

I'm just wondering if there is a way in Sophos to put a rule in place so that it does not reach the users mailbox?

Thanks,