Re: [Declude.JunkMail] weird random .htm attachments
No, unfortunately I haven't found a good test here and yes they are on the increase. Gr -Marc - Original Message - From: Glenn Brooks To: [EMAIL PROTECTED] Sent: Monday, March 29, 2004 8:02 PM Subject: RE: [Declude.JunkMail] weird random .htm attachments Has anyone set up a filter to catch thesewe get a lot of them... gb At 04:41 PM 3/29/2004 -0800, you wrote: Yes, I have been seeing them too. They are java scripts that run. Definitly spam. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Kevin Sent: Monday, March 29, 2004 4:37 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] weird random .htm attachments Hi, Tried searching mail-archive.com for these but didn't turn up anything. Subject: pass on the fun [random subjects] Body: This message has attach [random too] [random attachments but always ends in .htm] I didn't open it with IE but with a text editor. Starts with script language=JavaScriptcontractions = new Array(162, [whole bunch of numbers] ends with charters = 907; beetle = 243; var equal = ; for(bowl = 0; bowl charters; bowl++) equal = equal + String.fromCharCode(contractions[bowl] ^ preferential[bowl % beetle]); document.write(equal); /script Sniffer catches these under rule 62 (Experimental) but it's not enough to hold these. Any ideas? What does one see when they view this under IE? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] weird random .htm attachments
I filter on this + String.fromCharCode( This is common in all of them. Combined with other tests it catches most. Mike - Original Message - From: Glenn Brooks [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, March 29, 2004 20:02 Subject: RE: [Declude.JunkMail] weird random .htm attachments Has anyone set up a filter to catch thesewe get a lot of them... gb At 04:41 PM 3/29/2004 -0800, you wrote: Yes, I have been seeing them too. They are java scripts that run. Definitly spam. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Kevin Sent: Monday, March 29, 2004 4:37 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] weird random .htm attachments Hi, Tried searching mail-archive.com for these but didn't turn up anything. Subject: pass on the fun [random subjects] Body: This message has attach [random too] [random attachments but always ends in .htm] I didn't open it with IE but with a text editor. Starts with script language=JavaScriptcontractions = new Array(162, [whole bunch of numbers] ends with charters = 907; beetle = 243; var equal = ; for(bowl = 0; bowl charters; bowl++) equal = equal + String.fromCharCode(contractions[bowl] ^ preferential[bowl % beetle]); document.write(equal); /script Sniffer catches these under rule 62 (Experimental) but it's not enough to hold these. Any ideas? What does one see when they view this under IE? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] weird random .htm attachments
so you do a body filter? At 09:00 AM 3/30/2004 -0500, you wrote: I filter on this + String.fromCharCode( This is common in all of them. Combined with other tests it catches most. Mike - Original Message - From: Glenn Brooks [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, March 29, 2004 20:02 Subject: RE: [Declude.JunkMail] weird random .htm attachments Has anyone set up a filter to catch thesewe get a lot of them... gb At 04:41 PM 3/29/2004 -0800, you wrote: Yes, I have been seeing them too. They are java scripts that run. Definitly spam. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Kevin Sent: Monday, March 29, 2004 4:37 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] weird random .htm attachments Hi, Tried searching mail-archive.com for these but didn't turn up anything. Subject: pass on the fun [random subjects] Body: This message has attach [random too] [random attachments but always ends in .htm] I didn't open it with IE but with a text editor. Starts with script language=JavaScriptcontractions = new Array(162, [whole bunch of numbers] ends with charters = 907; beetle = 243; var equal = ; for(bowl = 0; bowl charters; bowl++) equal = equal + String.fromCharCode(contractions[bowl] ^ preferential[bowl % beetle]); document.write(equal); /script Sniffer catches these under rule 62 (Experimental) but it's not enough to hold these. Any ideas? What does one see when they view this under IE? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] weird random .htm attachments
yes Mike - Original Message - From: Glenn Brooks [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, March 30, 2004 09:20 Subject: Re: [Declude.JunkMail] weird random .htm attachments so you do a body filter? At 09:00 AM 3/30/2004 -0500, you wrote: I filter on this + String.fromCharCode( This is common in all of them. Combined with other tests it catches most. Mike - Original Message - From: Glenn Brooks [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, March 29, 2004 20:02 Subject: RE: [Declude.JunkMail] weird random .htm attachments Has anyone set up a filter to catch thesewe get a lot of them... gb At 04:41 PM 3/29/2004 -0800, you wrote: Yes, I have been seeing them too. They are java scripts that run. Definitly spam. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Kevin Sent: Monday, March 29, 2004 4:37 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] weird random .htm attachments Hi, Tried searching mail-archive.com for these but didn't turn up anything. Subject: pass on the fun [random subjects] Body: This message has attach [random too] [random attachments but always ends in .htm] I didn't open it with IE but with a text editor. Starts with script language=JavaScriptcontractions = new Array(162, [whole bunch of numbers] ends with charters = 907; beetle = 243; var equal = ; for(bowl = 0; bowl charters; bowl++) equal = equal + String.fromCharCode(contractions[bowl] ^ preferential[bowl % beetle]); document.write(equal); /script Sniffer catches these under rule 62 (Experimental) but it's not enough to hold these. Any ideas? What does one see when they view this under IE? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] weird random .htm attachments
So you use something like like. BODY 10CONTAINS+ String.fromCharCode( - Original Message - From: Glenn Brooks [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, March 30, 2004 9:20 AM Subject: Re: [Declude.JunkMail] weird random .htm attachments so you do a body filter? At 09:00 AM 3/30/2004 -0500, you wrote: I filter on this + String.fromCharCode( This is common in all of them. Combined with other tests it catches most. Mike - Original Message - From: Glenn Brooks [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, March 29, 2004 20:02 Subject: RE: [Declude.JunkMail] weird random .htm attachments Has anyone set up a filter to catch thesewe get a lot of them... gb At 04:41 PM 3/29/2004 -0800, you wrote: Yes, I have been seeing them too. They are java scripts that run. Definitly spam. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Kevin Sent: Monday, March 29, 2004 4:37 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] weird random .htm attachments Hi, Tried searching mail-archive.com for these but didn't turn up anything. Subject: pass on the fun [random subjects] Body: This message has attach [random too] [random attachments but always ends in .htm] I didn't open it with IE but with a text editor. Starts with script language=JavaScriptcontractions = new Array(162, [whole bunch of numbers] ends with charters = 907; beetle = 243; var equal = ; for(bowl = 0; bowl charters; bowl++) equal = equal + String.fromCharCode(contractions[bowl] ^ preferential[bowl % beetle]); document.write(equal); /script Sniffer catches these under rule 62 (Experimental) but it's not enough to hold these. Any ideas? What does one see when they view this under IE? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] weird random .htm attachments
Yes, I have been seeing them too. They are java scripts that run. Definitly spam. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Kevin Sent: Monday, March 29, 2004 4:37 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] weird random .htm attachments Hi, Tried searching mail-archive.com for these but didn't turn up anything. Subject: pass on the fun [random subjects] Body: This message has attach [random too] [random attachments but always ends in .htm] I didn't open it with IE but with a text editor. Starts with script language=JavaScriptcontractions = new Array(162, [whole bunch of numbers] ends with charters = 907; beetle = 243; var equal = ; for(bowl = 0; bowl charters; bowl++) equal = equal + String.fromCharCode(contractions[bowl] ^ preferential[bowl % beetle]); document.write(equal); /script Sniffer catches these under rule 62 (Experimental) but it's not enough to hold these. Any ideas? What does one see when they view this under IE? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] weird random .htm attachments
Has anyone set up a filter to catch thesewe get a lot of them... gb At 04:41 PM 3/29/2004 -0800, you wrote: Yes, I have been seeing them too. They are java scripts that run. Definitly spam. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Kevin Sent: Monday, March 29, 2004 4:37 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] weird random .htm attachments Hi, Tried searching mail-archive.com for these but didn't turn up anything. Subject: pass on the fun [random subjects] Body: This message has attach [random too] [random attachments but always ends in .htm] I didn't open it with IE but with a text editor. Starts with script language=JavaScriptcontractions = new Array(162, [whole bunch of numbers] ends with charters = 907; beetle = 243; var equal = ; for(bowl = 0; bowl charters; bowl++) equal = equal + String.fromCharCode(contractions[bowl] ^ preferential[bowl % beetle]); document.write(equal); /script Sniffer catches these under rule 62 (Experimental) but it's not enough to hold these. Any ideas? What does one see when they view this under IE? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
