I filter on this "+ String.fromCharCode("
This is common in all of them. Combined with other tests it catches most.
Mike
----- Original Message -----
From: "Glenn Brooks" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, March 29, 2004 20:02
Subject: RE: [Declude.JunkMail] weird random .htm attachments
> Has anyone set up a filter to catch these....we get a lot of them...
>
> gb
>
>
> At 04:41 PM 3/29/2004 -0800, you wrote:
> >Yes, I have been seeing them too. They are java scripts that run.
Definitly
> >spam.
> >
> >John Tolmachoff
> >Engineer/Consultant/Owner
> >eServices For You
> >
> > > -----Original Message-----
> > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> > > [EMAIL PROTECTED] On Behalf Of Kevin
> > > Sent: Monday, March 29, 2004 4:37 PM
> > > To: [EMAIL PROTECTED]
> > > Subject: [Declude.JunkMail] weird random .htm attachments
> > >
> > > Hi,
> > >
> > > Tried searching mail-archive.com for these but didn't turn up
anything.
> > >
> > > Subject: pass on the fun [random subjects]
> > > Body: This message has attach [random too]
> > > [random attachments but always ends in .htm]
> > >
> > > I didn't open it with IE but with a text editor.
> > >
> > > Starts with <script language="JavaScript">contractions = new
Array(162,
> > > [whole bunch of numbers]
> > >
> > > ends with
> > >
> > > charters = 907;
> > > beetle = 243;
> > > var equal = "";
> > > for(bowl = 0; bowl < charters; bowl++)
> > > equal = equal + String.fromCharCode(contractions[bowl] ^
> > > preferential[bowl % beetle]);
> > > document.write(equal);
> > > </script>
> > >
> > > Sniffer catches these under rule 62 (Experimental) but it's not enough
to
> > > hold these.
> > >
> > > Any ideas? What does one see when they view this under IE?
> > >
> > >
> > > ---
> > > [This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list. To
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > type "unsubscribe Declude.JunkMail". The archives can be found
> > > at http://www.mail-archive.com.
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list. To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >type "unsubscribe Declude.JunkMail". The archives can be found
> >at http://www.mail-archive.com.
>
> Glenn Brooks
> WebWize, Inc.
> 713-688-4382
> http://www.webwize.com
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
>
>
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
