Re: [Declude.JunkMail] weird random .htm attachments
So you use something like like. BODY 10CONTAINS+ String.fromCharCode( - Original Message - From: "Glenn Brooks" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, March 30, 2004 9:20 AM Subject: Re: [Declude.JunkMail] weird random .htm attachments > so you do a body filter? > > At 09:00 AM 3/30/2004 -0500, you wrote: > >I filter on this "+ String.fromCharCode(" > > > >This is common in all of them. Combined with other tests it catches most. > > > >Mike > > > > > > > >- Original Message - > >From: "Glenn Brooks" <[EMAIL PROTECTED]> > >To: <[EMAIL PROTECTED]> > >Sent: Monday, March 29, 2004 20:02 > >Subject: RE: [Declude.JunkMail] weird random .htm attachments > > > > > > > Has anyone set up a filter to catch thesewe get a lot of them... > > > > > > gb > > > > > > > > > At 04:41 PM 3/29/2004 -0800, you wrote: > > > >Yes, I have been seeing them too. They are java scripts that run. > >Definitly > > > >spam. > > > > > > > >John Tolmachoff > > > >Engineer/Consultant/Owner > > > >eServices For You > > > > > > > > > -Original Message- > > > > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > > > > [EMAIL PROTECTED] On Behalf Of Kevin > > > > > Sent: Monday, March 29, 2004 4:37 PM > > > > > To: [EMAIL PROTECTED] > > > > > Subject: [Declude.JunkMail] weird random .htm attachments > > > > > > > > > > Hi, > > > > > > > > > > Tried searching mail-archive.com for these but didn't turn up > >anything. > > > > > > > > > > Subject: pass on the fun [random subjects] > > > > > Body: This message has attach [random too] > > > > > [random attachments but always ends in .htm] > > > > > > > > > > I didn't open it with IE but with a text editor. > > > > > > > > > > Starts with contractions = new > >Array(162, > > > > > [whole bunch of numbers] > > > > > > > > > > ends with > > > > > > > > > > charters = 907; > > > > > beetle = 243; > > > > > var equal = ""; > > > > > for(bowl = 0; bowl < charters; bowl++) > > > > >equal = equal + String.fromCharCode(contractions[bowl] ^ > > > > > preferential[bowl % beetle]); > > > > > document.write(equal); > > > > > > > > > > > > > > > Sniffer catches these under rule 62 (Experimental) but it's not enough > >to > > > > > hold these. > > > > > > > > > > Any ideas? What does one see when they view this under IE? > > > > > > > > > > > > > > > --- > > > > > [This E-mail was scanned for viruses by Declude Virus > > > >(http://www.declude.com)] > > > > > > > > > > --- > > > > > This E-mail came from the Declude.JunkMail mailing list. To > > > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > > > at http://www.mail-archive.com. > > > > > > > >--- > > > >[This E-mail was scanned for viruses by Declude Virus > > > >(http://www.declude.com)] > > > > > > > >--- > > > >This E-mail came from the Declude.JunkMail mailing list. To > > > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > >type "unsubscribe Declude.JunkMail". The archives can be found > > > >at http://www.mail-archive.com. > > > > > > Glenn Brooks > > > WebWize, Inc. > > > 713-688-4382 > > > http://www.webwize.com > > > > > > > > > --- > > > [This E-mail was scanned for viruses by Declude Virus > >(http://www.declude.com)] > > > > > > --- > > > This E-mail came from the Declude.JunkMail mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > at http://www.mail-archive.com. > > > > > > > > > > > >--- > >[This E-mail was scanned for viruses by Declude Virus > >(http://www.declude.com)] > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >type "unsubscribe Declude.JunkMail". The archives can be found > >at http://www.mail-archive.com. > > Glenn Brooks > WebWize, Inc. > 713-688-4382 > http://www.webwize.com > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] weird random .htm attachments
yes Mike - Original Message - From: "Glenn Brooks" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, March 30, 2004 09:20 Subject: Re: [Declude.JunkMail] weird random .htm attachments > so you do a body filter? > > At 09:00 AM 3/30/2004 -0500, you wrote: > >I filter on this "+ String.fromCharCode(" > > > >This is common in all of them. Combined with other tests it catches most. > > > >Mike > > > > > > > >- Original Message - > >From: "Glenn Brooks" <[EMAIL PROTECTED]> > >To: <[EMAIL PROTECTED]> > >Sent: Monday, March 29, 2004 20:02 > >Subject: RE: [Declude.JunkMail] weird random .htm attachments > > > > > > > Has anyone set up a filter to catch thesewe get a lot of them... > > > > > > gb > > > > > > > > > At 04:41 PM 3/29/2004 -0800, you wrote: > > > >Yes, I have been seeing them too. They are java scripts that run. > >Definitly > > > >spam. > > > > > > > >John Tolmachoff > > > >Engineer/Consultant/Owner > > > >eServices For You > > > > > > > > > -Original Message- > > > > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > > > > [EMAIL PROTECTED] On Behalf Of Kevin > > > > > Sent: Monday, March 29, 2004 4:37 PM > > > > > To: [EMAIL PROTECTED] > > > > > Subject: [Declude.JunkMail] weird random .htm attachments > > > > > > > > > > Hi, > > > > > > > > > > Tried searching mail-archive.com for these but didn't turn up > >anything. > > > > > > > > > > Subject: pass on the fun [random subjects] > > > > > Body: This message has attach [random too] > > > > > [random attachments but always ends in .htm] > > > > > > > > > > I didn't open it with IE but with a text editor. > > > > > > > > > > Starts with contractions = new > >Array(162, > > > > > [whole bunch of numbers] > > > > > > > > > > ends with > > > > > > > > > > charters = 907; > > > > > beetle = 243; > > > > > var equal = ""; > > > > > for(bowl = 0; bowl < charters; bowl++) > > > > >equal = equal + String.fromCharCode(contractions[bowl] ^ > > > > > preferential[bowl % beetle]); > > > > > document.write(equal); > > > > > > > > > > > > > > > Sniffer catches these under rule 62 (Experimental) but it's not enough > >to > > > > > hold these. > > > > > > > > > > Any ideas? What does one see when they view this under IE? > > > > > > > > > > > > > > > --- > > > > > [This E-mail was scanned for viruses by Declude Virus > > > >(http://www.declude.com)] > > > > > > > > > > --- > > > > > This E-mail came from the Declude.JunkMail mailing list. To > > > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > > > at http://www.mail-archive.com. > > > > > > > >--- > > > >[This E-mail was scanned for viruses by Declude Virus > > > >(http://www.declude.com)] > > > > > > > >--- > > > >This E-mail came from the Declude.JunkMail mailing list. To > > > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > >type "unsubscribe Declude.JunkMail". The archives can be found > > > >at http://www.mail-archive.com. > > > > > > Glenn Brooks > > > WebWize, Inc. > > > 713-688-4382 > > > http://www.webwize.com > > > > > > > > > --- > > > [This E-mail was scanned for viruses by Declude Virus > >(http://www.declude.com)] > > > > > > --- > > > This E-mail came from the Declude.JunkMail mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > at http://www.mail-archive.com. > > > > > > > > > > > >--- > >[This E-mail was scanned for viruses by Declude Virus > >(http://www.declude.com)] > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >type "unsubscribe Declude.JunkMail". The archives can be found > >at http://www.mail-archive.com. > > Glenn Brooks > WebWize, Inc. > 713-688-4382 > http://www.webwize.com > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] weird random .htm attachments
so you do a body filter? At 09:00 AM 3/30/2004 -0500, you wrote: I filter on this "+ String.fromCharCode(" This is common in all of them. Combined with other tests it catches most. Mike - Original Message - From: "Glenn Brooks" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, March 29, 2004 20:02 Subject: RE: [Declude.JunkMail] weird random .htm attachments > Has anyone set up a filter to catch thesewe get a lot of them... > > gb > > > At 04:41 PM 3/29/2004 -0800, you wrote: > >Yes, I have been seeing them too. They are java scripts that run. Definitly > >spam. > > > >John Tolmachoff > >Engineer/Consultant/Owner > >eServices For You > > > > > -Original Message- > > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > > [EMAIL PROTECTED] On Behalf Of Kevin > > > Sent: Monday, March 29, 2004 4:37 PM > > > To: [EMAIL PROTECTED] > > > Subject: [Declude.JunkMail] weird random .htm attachments > > > > > > Hi, > > > > > > Tried searching mail-archive.com for these but didn't turn up anything. > > > > > > Subject: pass on the fun [random subjects] > > > Body: This message has attach [random too] > > > [random attachments but always ends in .htm] > > > > > > I didn't open it with IE but with a text editor. > > > > > > Starts with contractions = new Array(162, > > > [whole bunch of numbers] > > > > > > ends with > > > > > > charters = 907; > > > beetle = 243; > > > var equal = ""; > > > for(bowl = 0; bowl < charters; bowl++) > > >equal = equal + String.fromCharCode(contractions[bowl] ^ > > > preferential[bowl % beetle]); > > > document.write(equal); > > > > > > > > > Sniffer catches these under rule 62 (Experimental) but it's not enough to > > > hold these. > > > > > > Any ideas? What does one see when they view this under IE? > > > > > > > > > --- > > > [This E-mail was scanned for viruses by Declude Virus > >(http://www.declude.com)] > > > > > > --- > > > This E-mail came from the Declude.JunkMail mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > at http://www.mail-archive.com. > > > >--- > >[This E-mail was scanned for viruses by Declude Virus > >(http://www.declude.com)] > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >type "unsubscribe Declude.JunkMail". The archives can be found > >at http://www.mail-archive.com. > > Glenn Brooks > WebWize, Inc. > 713-688-4382 > http://www.webwize.com > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] weird random .htm attachments
I filter on this "+ String.fromCharCode(" This is common in all of them. Combined with other tests it catches most. Mike - Original Message - From: "Glenn Brooks" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, March 29, 2004 20:02 Subject: RE: [Declude.JunkMail] weird random .htm attachments > Has anyone set up a filter to catch thesewe get a lot of them... > > gb > > > At 04:41 PM 3/29/2004 -0800, you wrote: > >Yes, I have been seeing them too. They are java scripts that run. Definitly > >spam. > > > >John Tolmachoff > >Engineer/Consultant/Owner > >eServices For You > > > > > -Original Message- > > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > > [EMAIL PROTECTED] On Behalf Of Kevin > > > Sent: Monday, March 29, 2004 4:37 PM > > > To: [EMAIL PROTECTED] > > > Subject: [Declude.JunkMail] weird random .htm attachments > > > > > > Hi, > > > > > > Tried searching mail-archive.com for these but didn't turn up anything. > > > > > > Subject: pass on the fun [random subjects] > > > Body: This message has attach [random too] > > > [random attachments but always ends in .htm] > > > > > > I didn't open it with IE but with a text editor. > > > > > > Starts with contractions = new Array(162, > > > [whole bunch of numbers] > > > > > > ends with > > > > > > charters = 907; > > > beetle = 243; > > > var equal = ""; > > > for(bowl = 0; bowl < charters; bowl++) > > >equal = equal + String.fromCharCode(contractions[bowl] ^ > > > preferential[bowl % beetle]); > > > document.write(equal); > > > > > > > > > Sniffer catches these under rule 62 (Experimental) but it's not enough to > > > hold these. > > > > > > Any ideas? What does one see when they view this under IE? > > > > > > > > > --- > > > [This E-mail was scanned for viruses by Declude Virus > >(http://www.declude.com)] > > > > > > --- > > > This E-mail came from the Declude.JunkMail mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > at http://www.mail-archive.com. > > > >--- > >[This E-mail was scanned for viruses by Declude Virus > >(http://www.declude.com)] > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >type "unsubscribe Declude.JunkMail". The archives can be found > >at http://www.mail-archive.com. > > Glenn Brooks > WebWize, Inc. > 713-688-4382 > http://www.webwize.com > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] weird random .htm attachments
No, unfortunately I haven't found a good test here and yes they are on the increase. Gr -Marc - Original Message - From: Glenn Brooks To: [EMAIL PROTECTED] Sent: Monday, March 29, 2004 8:02 PM Subject: RE: [Declude.JunkMail] weird random .htm attachments Has anyone set up a filter to catch thesewe get a lot of them... gb At 04:41 PM 3/29/2004 -0800, you wrote: >Yes, I have been seeing them too. They are java scripts that run. Definitly >spam. > >John Tolmachoff >Engineer/Consultant/Owner >eServices For You > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of Kevin > > Sent: Monday, March 29, 2004 4:37 PM > > To: [EMAIL PROTECTED] > > Subject: [Declude.JunkMail] weird random .htm attachments > > > > Hi, > > > > Tried searching mail-archive.com for these but didn't turn up anything. > > > > Subject: pass on the fun [random subjects] > > Body: This message has attach [random too] > > [random attachments but always ends in .htm] > > > > I didn't open it with IE but with a text editor. > > > > Starts with contractions = new Array(162, > > [whole bunch of numbers] > > > > ends with > > > > charters = 907; > > beetle = 243; > > var equal = ""; > > for(bowl = 0; bowl < charters; bowl++) > >equal = equal + String.fromCharCode(contractions[bowl] ^ > > preferential[bowl % beetle]); > > document.write(equal); > > > > > > Sniffer catches these under rule 62 (Experimental) but it's not enough to > > hold these. > > > > Any ideas? What does one see when they view this under IE? > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > >--- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] weird random .htm attachments
Has anyone set up a filter to catch thesewe get a lot of them... gb At 04:41 PM 3/29/2004 -0800, you wrote: Yes, I have been seeing them too. They are java scripts that run. Definitly spam. John Tolmachoff Engineer/Consultant/Owner eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Kevin > Sent: Monday, March 29, 2004 4:37 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] weird random .htm attachments > > Hi, > > Tried searching mail-archive.com for these but didn't turn up anything. > > Subject: pass on the fun [random subjects] > Body: This message has attach [random too] > [random attachments but always ends in .htm] > > I didn't open it with IE but with a text editor. > > Starts with contractions = new Array(162, > [whole bunch of numbers] > > ends with > > charters = 907; > beetle = 243; > var equal = ""; > for(bowl = 0; bowl < charters; bowl++) >equal = equal + String.fromCharCode(contractions[bowl] ^ > preferential[bowl % beetle]); > document.write(equal); > > > Sniffer catches these under rule 62 (Experimental) but it's not enough to > hold these. > > Any ideas? What does one see when they view this under IE? > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] weird random .htm attachments
Yes, I have been seeing them too. They are java scripts that run. Definitly spam. John Tolmachoff Engineer/Consultant/Owner eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Kevin > Sent: Monday, March 29, 2004 4:37 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] weird random .htm attachments > > Hi, > > Tried searching mail-archive.com for these but didn't turn up anything. > > Subject: pass on the fun [random subjects] > Body: This message has attach [random too] > [random attachments but always ends in .htm] > > I didn't open it with IE but with a text editor. > > Starts with contractions = new Array(162, > [whole bunch of numbers] > > ends with > > charters = 907; > beetle = 243; > var equal = ""; > for(bowl = 0; bowl < charters; bowl++) >equal = equal + String.fromCharCode(contractions[bowl] ^ > preferential[bowl % beetle]); > document.write(equal); > > > Sniffer catches these under rule 62 (Experimental) but it's not enough to > hold these. > > Any ideas? What does one see when they view this under IE? > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.