[Declude.JunkMail] Interesting new spam

2002-06-18 Thread Scott MacLean 

I just saw an interesting new method of getting spam through
without being rejected.
The body of the message (HTML code only) was not separated from the
header by a CR/LF CR/LF - only a single one, so the advertising body was
actually part of the header. My Eudora read and rendered the message OK,
showing the HTML spam body underneath headers. However, Declude added its
warnings to the bottom of what it thought was the message header, which
my Eudora filters did not pick up as being in the header,
hence it did not get filtered. The result looked like this:

Date: Wed, 19 Jun 2002 12:30:50 -0700 
From:  NERO, Get Perfect 'Bank Rated' Credit Status!
[EMAIL PROTECTED]

To: [EMAIL PROTECTED] 
Subject: NERO, Get Perfect 'Bank Rated' Credit Status! 
Quickly and Easily
Improve
YOUR Credit to
PERFECT 'Bank' Rated

Credit Status!Click here now for FULL FREE details!

© 2002 All rights reserved.
Unsubscribe

X-RBL-Warning: OSSRC: [1] netpalace, see http://spews.org/ask.cgi?S919 X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?65.172.10.207 X-RBL-Warning: WEIGHT10: Weight of 20 reaches or exceeds the limit of 10. 


___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com

RE: [Declude.JunkMail] Interesting new spam

2002-06-18 Thread Henry H. Isgett 
Title: Message



We are 
getting this too. Declude Virus has blocked them due to the Outlook 
'CR' Vulnerability.

Henry 
Isgett

  
  -Original Message-From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] 
  On Behalf Of Scott MacLeanSent: Tuesday, June 18, 2002 3:53 
  PMTo: [EMAIL PROTECTED]Subject: 
  [Declude.JunkMail] Interesting new spamI 
  just saw an interesting new method of getting spam through without being 
  rejected.The body of the message (HTML code only) was not separated 
  from the header by a CR/LF CR/LF - only a single one, so the advertising body 
  was actually part of the header. My Eudora read and rendered the message OK, 
  showing the HTML spam body underneath headers. However, Declude added its 
  warnings to the bottom of what it thought was the message header, which my 
  Eudora filters did not pick up as being in the "header", hence it did not get 
  filtered. The result looked like this:Date: Wed, 19 Jun 2002 
  12:30:50 -0700 From: " NERO, Get Perfect 'Bank Rated' Credit Status!" 
  [EMAIL PROTECTED] To: 
  [EMAIL PROTECTED] Subject: NERO, Get Perfect 'Bank Rated' Credit 
  Status! Quickly and EasilyImprove 
  YOUR Credit 
  toPERFECT 'Bank' Rated
  


  Credit Status!Click here now for FULL FREE 
details! 2002 All rights 
  reserved.
  UnsubscribeX-RBL-Warning: OSSRC: 
  [1] netpalace, see http://spews.org/ask.cgi?S919 X-RBL-Warning: SPAMCOP: 
  Blocked - see http://spamcop.net/bl.shtml?65.172.10.207 X-RBL-Warning: 
  WEIGHT10: Weight of 20 reaches or exceeds the limit of 10. 
  ___Scott 
  MacLean[EMAIL PROTECTED]ICQ: 
  9184011http://www.nerosoft.com