On Wed, 5 Nov 2003 11:33:11 -0500
"Maxime Ducharme" <[EMAIL PROTECTED]> wrote:
> Hi all,
> I received a spam pinting on a link which contains suspicious
> javascript.
>
> ...
decoded:
<html><head><script>unsp='This page does not support your browser. A browser version
4.0 or higher is
required!';dl=document.layers;da=document.all;ge=document.getElementById;ws=(window.sidebar)?true:false;izN=navigator.userAgent.toLowerCase().indexOf('netscape')>=0?true:false;if(ws&&!izN){alert(unsp);this.location=''};var
msg='';function nem(){return true};window.onerror = nem;var p53;function
im(){if(da){document.ondragstart=function (){return false};for (i = 0;i<
document.images.length;i++){z = document.images(i);z.galleryImg =
'no'}}};if(da){function cIE(){(msg);return false;};function
cc(){document.oncontextmenu = cIE;setTimeout("cc()",200)};cc();};function cNS(e)
{if(dl||ws) {if (e.which==2||e.which==3) {(msg);return false}}};if
(dl){document.captureEvents(Event.MOUSEDOWN);document.onmousedown=cNS}else{document.onmouseup=cNS};document.oncontextmenu=new
Function("return false");</script></head><frameset rows='100%,*' name=mainf><frame
name='invisible' src="98653.htm" mar
ginwidth='0' marginheight='0' noresize></frame></frameset></html>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
