yes
Mike
----- Original Message -----
From: "Glenn Brooks" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, March 30, 2004 09:20
Subject: Re: [Declude.JunkMail] weird random .htm attachments
> so you do a body filter?
>
> At 09:00 AM 3/30/2004 -0500, you wrote:
> >I filter on this "+ String.fromCharCode("
> >
> >This is common in all of them. Combined with other tests it catches most.
> >
> >Mike
> >
> >
> >
> >----- Original Message -----
> >From: "Glenn Brooks" <[EMAIL PROTECTED]>
> >To: <[EMAIL PROTECTED]>
> >Sent: Monday, March 29, 2004 20:02
> >Subject: RE: [Declude.JunkMail] weird random .htm attachments
> >
> >
> > > Has anyone set up a filter to catch these....we get a lot of them...
> > >
> > > gb
> > >
> > >
> > > At 04:41 PM 3/29/2004 -0800, you wrote:
> > > >Yes, I have been seeing them too. They are java scripts that run.
> >Definitly
> > > >spam.
> > > >
> > > >John Tolmachoff
> > > >Engineer/Consultant/Owner
> > > >eServices For You
> > > >
> > > > > -----Original Message-----
> > > > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> > > > > [EMAIL PROTECTED] On Behalf Of Kevin
> > > > > Sent: Monday, March 29, 2004 4:37 PM
> > > > > To: [EMAIL PROTECTED]
> > > > > Subject: [Declude.JunkMail] weird random .htm attachments
> > > > >
> > > > > Hi,
> > > > >
> > > > > Tried searching mail-archive.com for these but didn't turn up
> >anything.
> > > > >
> > > > > Subject: pass on the fun [random subjects]
> > > > > Body: This message has attach [random too]
> > > > > [random attachments but always ends in .htm]
> > > > >
> > > > > I didn't open it with IE but with a text editor.
> > > > >
> > > > > Starts with <script language="JavaScript">contractions = new
> >Array(162,
> > > > > [whole bunch of numbers]
> > > > >
> > > > > ends with
> > > > >
> > > > > charters = 907;
> > > > > beetle = 243;
> > > > > var equal = "";
> > > > > for(bowl = 0; bowl < charters; bowl++)
> > > > > equal = equal + String.fromCharCode(contractions[bowl] ^
> > > > > preferential[bowl % beetle]);
> > > > > document.write(equal);
> > > > > </script>
> > > > >
> > > > > Sniffer catches these under rule 62 (Experimental) but it's not
enough
> >to
> > > > > hold these.
> > > > >
> > > > > Any ideas? What does one see when they view this under IE?
> > > > >
> > > > >
> > > > > ---
> > > > > [This E-mail was scanned for viruses by Declude Virus
> > > >(http://www.declude.com)]
> > > > >
> > > > > ---
> > > > > This E-mail came from the Declude.JunkMail mailing list. To
> > > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > > > type "unsubscribe Declude.JunkMail". The archives can be found
> > > > > at http://www.mail-archive.com.
> > > >
> > > >---
> > > >[This E-mail was scanned for viruses by Declude Virus
> > > >(http://www.declude.com)]
> > > >
> > > >---
> > > >This E-mail came from the Declude.JunkMail mailing list. To
> > > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > >type "unsubscribe Declude.JunkMail". The archives can be found
> > > >at http://www.mail-archive.com.
> > >
> > > Glenn Brooks
> > > WebWize, Inc.
> > > 713-688-4382
> > > http://www.webwize.com
> > >
> > >
> > > ---
> > > [This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list. To
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > type "unsubscribe Declude.JunkMail". The archives can be found
> > > at http://www.mail-archive.com.
> > >
> > >
> >
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list. To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >type "unsubscribe Declude.JunkMail". The archives can be found
> >at http://www.mail-archive.com.
>
> Glenn Brooks
> WebWize, Inc.
> 713-688-4382
> http://www.webwize.com
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
>
>
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
