At 09:00 AM 3/30/2004 -0500, you wrote:
I filter on this "+ String.fromCharCode("
This is common in all of them. Combined with other tests it catches most.
Mike
----- Original Message ----- From: "Glenn Brooks" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, March 29, 2004 20:02 Subject: RE: [Declude.JunkMail] weird random .htm attachments
> Has anyone set up a filter to catch these....we get a lot of them... > > gb > > > At 04:41 PM 3/29/2004 -0800, you wrote: > >Yes, I have been seeing them too. They are java scripts that run. Definitly > >spam. > > > >John Tolmachoff > >Engineer/Consultant/Owner > >eServices For You > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > > [EMAIL PROTECTED] On Behalf Of Kevin > > > Sent: Monday, March 29, 2004 4:37 PM > > > To: [EMAIL PROTECTED] > > > Subject: [Declude.JunkMail] weird random .htm attachments > > > > > > Hi, > > > > > > Tried searching mail-archive.com for these but didn't turn up anything. > > > > > > Subject: pass on the fun [random subjects] > > > Body: This message has attach [random too] > > > [random attachments but always ends in .htm] > > > > > > I didn't open it with IE but with a text editor. > > > > > > Starts with <script language="JavaScript">contractions = new Array(162, > > > [whole bunch of numbers] > > > > > > ends with > > > > > > charters = 907; > > > beetle = 243; > > > var equal = ""; > > > for(bowl = 0; bowl < charters; bowl++) > > > equal = equal + String.fromCharCode(contractions[bowl] ^ > > > preferential[bowl % beetle]); > > > document.write(equal); > > > </script> > > > > > > Sniffer catches these under rule 62 (Experimental) but it's not enough to > > > hold these. > > > > > > Any ideas? What does one see when they view this under IE? > > > > > > > > > --- > > > [This E-mail was scanned for viruses by Declude Virus > >(http://www.declude.com)] > > > > > > --- > > > This E-mail came from the Declude.JunkMail mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > at http://www.mail-archive.com. > > > >--- > >[This E-mail was scanned for viruses by Declude Virus > >(http://www.declude.com)] > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >type "unsubscribe Declude.JunkMail". The archives can be found > >at http://www.mail-archive.com. > > Glenn Brooks > WebWize, Inc. > 713-688-4382 > http://www.webwize.com > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > >
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
