Re: [Declude.JunkMail] weird random .htm attachments

2004-03-30 Thread Frederick Samarelli
So you use something like like.

BODY   10CONTAINS+ String.fromCharCode(


- Original Message - 
From: "Glenn Brooks" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, March 30, 2004 9:20 AM
Subject: Re: [Declude.JunkMail] weird random .htm attachments


> so you do a body filter?
>
> At 09:00 AM 3/30/2004 -0500, you wrote:
> >I filter on this "+ String.fromCharCode("
> >
> >This is common in all of them. Combined with other tests it catches most.
> >
> >Mike
> >
> >
> >
> >- Original Message -
> >From: "Glenn Brooks" <[EMAIL PROTECTED]>
> >To: <[EMAIL PROTECTED]>
> >Sent: Monday, March 29, 2004 20:02
> >Subject: RE: [Declude.JunkMail] weird random .htm attachments
> >
> >
> > > Has anyone set up a filter to catch thesewe get a lot of them...
> > >
> > > gb
> > >
> > >
> > > At 04:41 PM 3/29/2004 -0800, you wrote:
> > > >Yes, I have been seeing them too. They are java scripts that run.
> >Definitly
> > > >spam.
> > > >
> > > >John Tolmachoff
> > > >Engineer/Consultant/Owner
> > > >eServices For You
> > > >
> > > > > -Original Message-
> > > > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> > > > > [EMAIL PROTECTED] On Behalf Of Kevin
> > > > > Sent: Monday, March 29, 2004 4:37 PM
> > > > > To: [EMAIL PROTECTED]
> > > > > Subject: [Declude.JunkMail] weird random .htm attachments
> > > > >
> > > > > Hi,
> > > > >
> > > > > Tried searching mail-archive.com for these but didn't turn up
> >anything.
> > > > >
> > > > > Subject: pass on the fun [random subjects]
> > > > > Body: This message has attach [random too]
> > > > > [random attachments but always ends in .htm]
> > > > >
> > > > > I didn't open it with IE but with a text editor.
> > > > >
> > > > > Starts with contractions = new
> >Array(162,
> > > > > [whole bunch of numbers]
> > > > >
> > > > > ends with
> > > > >
> > > > > charters = 907;
> > > > > beetle = 243;
> > > > > var equal = "";
> > > > > for(bowl = 0; bowl < charters; bowl++)
> > > > >equal = equal + String.fromCharCode(contractions[bowl] ^
> > > > > preferential[bowl % beetle]);
> > > > > document.write(equal);
> > > > > 
> > > > >
> > > > > Sniffer catches these under rule 62 (Experimental) but it's not
enough
> >to
> > > > > hold these.
> > > > >
> > > > > Any ideas? What does one see when they view this under IE?
> > > > >
> > > > >
> > > > > ---
> > > > > [This E-mail was scanned for viruses by Declude Virus
> > > >(http://www.declude.com)]
> > > > >
> > > > > ---
> > > > > This E-mail came from the Declude.JunkMail mailing list.  To
> > > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > > > type "unsubscribe Declude.JunkMail".  The archives can be found
> > > > > at http://www.mail-archive.com.
> > > >
> > > >---
> > > >[This E-mail was scanned for viruses by Declude Virus
> > > >(http://www.declude.com)]
> > > >
> > > >---
> > > >This E-mail came from the Declude.JunkMail mailing list.  To
> > > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > >type "unsubscribe Declude.JunkMail".  The archives can be found
> > > >at http://www.mail-archive.com.
> > >
> > > Glenn Brooks
> > > WebWize, Inc.
> > > 713-688-4382
> > > http://www.webwize.com
> > >
> > >
> > > ---
> > > [This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list.  To
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > type "unsubscribe Declude.JunkMail".  The archives can be found
> > > at http://www.mail-archive.com.
> > >
> > >
> >
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list.  To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >type "unsubscribe Declude.JunkMail".  The archives can be found
> >at http://www.mail-archive.com.
>
> Glenn Brooks
> WebWize, Inc.
> 713-688-4382
> http://www.webwize.com
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] weird random .htm attachments

2004-03-30 Thread Mike K
yes

Mike

- Original Message - 
From: "Glenn Brooks" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, March 30, 2004 09:20
Subject: Re: [Declude.JunkMail] weird random .htm attachments


> so you do a body filter?
>
> At 09:00 AM 3/30/2004 -0500, you wrote:
> >I filter on this "+ String.fromCharCode("
> >
> >This is common in all of them. Combined with other tests it catches most.
> >
> >Mike
> >
> >
> >
> >- Original Message -
> >From: "Glenn Brooks" <[EMAIL PROTECTED]>
> >To: <[EMAIL PROTECTED]>
> >Sent: Monday, March 29, 2004 20:02
> >Subject: RE: [Declude.JunkMail] weird random .htm attachments
> >
> >
> > > Has anyone set up a filter to catch thesewe get a lot of them...
> > >
> > > gb
> > >
> > >
> > > At 04:41 PM 3/29/2004 -0800, you wrote:
> > > >Yes, I have been seeing them too. They are java scripts that run.
> >Definitly
> > > >spam.
> > > >
> > > >John Tolmachoff
> > > >Engineer/Consultant/Owner
> > > >eServices For You
> > > >
> > > > > -Original Message-
> > > > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> > > > > [EMAIL PROTECTED] On Behalf Of Kevin
> > > > > Sent: Monday, March 29, 2004 4:37 PM
> > > > > To: [EMAIL PROTECTED]
> > > > > Subject: [Declude.JunkMail] weird random .htm attachments
> > > > >
> > > > > Hi,
> > > > >
> > > > > Tried searching mail-archive.com for these but didn't turn up
> >anything.
> > > > >
> > > > > Subject: pass on the fun [random subjects]
> > > > > Body: This message has attach [random too]
> > > > > [random attachments but always ends in .htm]
> > > > >
> > > > > I didn't open it with IE but with a text editor.
> > > > >
> > > > > Starts with contractions = new
> >Array(162,
> > > > > [whole bunch of numbers]
> > > > >
> > > > > ends with
> > > > >
> > > > > charters = 907;
> > > > > beetle = 243;
> > > > > var equal = "";
> > > > > for(bowl = 0; bowl < charters; bowl++)
> > > > >equal = equal + String.fromCharCode(contractions[bowl] ^
> > > > > preferential[bowl % beetle]);
> > > > > document.write(equal);
> > > > > 
> > > > >
> > > > > Sniffer catches these under rule 62 (Experimental) but it's not
enough
> >to
> > > > > hold these.
> > > > >
> > > > > Any ideas? What does one see when they view this under IE?
> > > > >
> > > > >
> > > > > ---
> > > > > [This E-mail was scanned for viruses by Declude Virus
> > > >(http://www.declude.com)]
> > > > >
> > > > > ---
> > > > > This E-mail came from the Declude.JunkMail mailing list.  To
> > > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > > > type "unsubscribe Declude.JunkMail".  The archives can be found
> > > > > at http://www.mail-archive.com.
> > > >
> > > >---
> > > >[This E-mail was scanned for viruses by Declude Virus
> > > >(http://www.declude.com)]
> > > >
> > > >---
> > > >This E-mail came from the Declude.JunkMail mailing list.  To
> > > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > >type "unsubscribe Declude.JunkMail".  The archives can be found
> > > >at http://www.mail-archive.com.
> > >
> > > Glenn Brooks
> > > WebWize, Inc.
> > > 713-688-4382
> > > http://www.webwize.com
> > >
> > >
> > > ---
> > > [This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list.  To
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > type "unsubscribe Declude.JunkMail".  The archives can be found
> > > at http://www.mail-archive.com.
> > >
> > >
> >
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list.  To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >type "unsubscribe Declude.JunkMail".  The archives can be found
> >at http://www.mail-archive.com.
>
> Glenn Brooks
> WebWize, Inc.
> 713-688-4382
> http://www.webwize.com
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>
>


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] weird random .htm attachments

2004-03-30 Thread Glenn Brooks
so you do a body filter?

At 09:00 AM 3/30/2004 -0500, you wrote:
I filter on this "+ String.fromCharCode("

This is common in all of them. Combined with other tests it catches most.

Mike



- Original Message -
From: "Glenn Brooks" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, March 29, 2004 20:02
Subject: RE: [Declude.JunkMail] weird random .htm attachments
> Has anyone set up a filter to catch thesewe get a lot of them...
>
> gb
>
>
> At 04:41 PM 3/29/2004 -0800, you wrote:
> >Yes, I have been seeing them too. They are java scripts that run.
Definitly
> >spam.
> >
> >John Tolmachoff
> >Engineer/Consultant/Owner
> >eServices For You
> >
> > > -Original Message-
> > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> > > [EMAIL PROTECTED] On Behalf Of Kevin
> > > Sent: Monday, March 29, 2004 4:37 PM
> > > To: [EMAIL PROTECTED]
> > > Subject: [Declude.JunkMail] weird random .htm attachments
> > >
> > > Hi,
> > >
> > > Tried searching mail-archive.com for these but didn't turn up
anything.
> > >
> > > Subject: pass on the fun [random subjects]
> > > Body: This message has attach [random too]
> > > [random attachments but always ends in .htm]
> > >
> > > I didn't open it with IE but with a text editor.
> > >
> > > Starts with contractions = new
Array(162,
> > > [whole bunch of numbers]
> > >
> > > ends with
> > >
> > > charters = 907;
> > > beetle = 243;
> > > var equal = "";
> > > for(bowl = 0; bowl < charters; bowl++)
> > >equal = equal + String.fromCharCode(contractions[bowl] ^
> > > preferential[bowl % beetle]);
> > > document.write(equal);
> > > 
> > >
> > > Sniffer catches these under rule 62 (Experimental) but it's not enough
to
> > > hold these.
> > >
> > > Any ideas? What does one see when they view this under IE?
> > >
> > >
> > > ---
> > > [This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list.  To
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > type "unsubscribe Declude.JunkMail".  The archives can be found
> > > at http://www.mail-archive.com.
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list.  To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >type "unsubscribe Declude.JunkMail".  The archives can be found
> >at http://www.mail-archive.com.
>
> Glenn Brooks
> WebWize, Inc.
> 713-688-4382
> http://www.webwize.com
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>
>
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] weird random .htm attachments

2004-03-30 Thread Mike K
I filter on this "+ String.fromCharCode("

This is common in all of them. Combined with other tests it catches most.

Mike



- Original Message - 
From: "Glenn Brooks" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, March 29, 2004 20:02
Subject: RE: [Declude.JunkMail] weird random .htm attachments


> Has anyone set up a filter to catch thesewe get a lot of them...
>
> gb
>
>
> At 04:41 PM 3/29/2004 -0800, you wrote:
> >Yes, I have been seeing them too. They are java scripts that run.
Definitly
> >spam.
> >
> >John Tolmachoff
> >Engineer/Consultant/Owner
> >eServices For You
> >
> > > -Original Message-
> > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> > > [EMAIL PROTECTED] On Behalf Of Kevin
> > > Sent: Monday, March 29, 2004 4:37 PM
> > > To: [EMAIL PROTECTED]
> > > Subject: [Declude.JunkMail] weird random .htm attachments
> > >
> > > Hi,
> > >
> > > Tried searching mail-archive.com for these but didn't turn up
anything.
> > >
> > > Subject: pass on the fun [random subjects]
> > > Body: This message has attach [random too]
> > > [random attachments but always ends in .htm]
> > >
> > > I didn't open it with IE but with a text editor.
> > >
> > > Starts with contractions = new
Array(162,
> > > [whole bunch of numbers]
> > >
> > > ends with
> > >
> > > charters = 907;
> > > beetle = 243;
> > > var equal = "";
> > > for(bowl = 0; bowl < charters; bowl++)
> > >equal = equal + String.fromCharCode(contractions[bowl] ^
> > > preferential[bowl % beetle]);
> > > document.write(equal);
> > > 
> > >
> > > Sniffer catches these under rule 62 (Experimental) but it's not enough
to
> > > hold these.
> > >
> > > Any ideas? What does one see when they view this under IE?
> > >
> > >
> > > ---
> > > [This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list.  To
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > type "unsubscribe Declude.JunkMail".  The archives can be found
> > > at http://www.mail-archive.com.
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list.  To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >type "unsubscribe Declude.JunkMail".  The archives can be found
> >at http://www.mail-archive.com.
>
> Glenn Brooks
> WebWize, Inc.
> 713-688-4382
> http://www.webwize.com
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>
>


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] weird random .htm attachments

2004-03-30 Thread Marc Hilliker
No, unfortunately I haven't found a good test here and yes they are on the
increase. Gr

-Marc

- Original Message -
From: Glenn Brooks
To: [EMAIL PROTECTED]
Sent: Monday, March 29, 2004 8:02 PM
Subject: RE: [Declude.JunkMail] weird random .htm attachments


Has anyone set up a filter to catch thesewe get a lot of them...

gb


At 04:41 PM 3/29/2004 -0800, you wrote:
>Yes, I have been seeing them too. They are java scripts that run. Definitly
>spam.
>
>John Tolmachoff
>Engineer/Consultant/Owner
>eServices For You
>
> > -Original Message-
> > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> > [EMAIL PROTECTED] On Behalf Of Kevin
> > Sent: Monday, March 29, 2004 4:37 PM
> > To: [EMAIL PROTECTED]
> > Subject: [Declude.JunkMail] weird random .htm attachments
> >
> > Hi,
> >
> > Tried searching mail-archive.com for these but didn't turn up anything.
> >
> > Subject: pass on the fun [random subjects]
> > Body: This message has attach [random too]
> > [random attachments but always ends in .htm]
> >
> > I didn't open it with IE but with a text editor.
> >
> > Starts with contractions = new Array(162,
> > [whole bunch of numbers]
> >
> > ends with
> >
> > charters = 907;
> > beetle = 243;
> > var equal = "";
> > for(bowl = 0; bowl < charters; bowl++)
> >equal = equal + String.fromCharCode(contractions[bowl] ^
> > preferential[bowl % beetle]);
> > document.write(equal);
> > 
> >
> > Sniffer catches these under rule 62 (Experimental) but it's not enough
to
> > hold these.
> >
> > Any ideas? What does one see when they view this under IE?
> >
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
>(http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
>
>---
>[This E-mail was scanned for viruses by Declude Virus
>(http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.

Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] weird random .htm attachments

2004-03-29 Thread Glenn Brooks
Has anyone set up a filter to catch thesewe get a lot of them...

gb

At 04:41 PM 3/29/2004 -0800, you wrote:
Yes, I have been seeing them too. They are java scripts that run. Definitly
spam.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Kevin
> Sent: Monday, March 29, 2004 4:37 PM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] weird random .htm attachments
>
> Hi,
>
> Tried searching mail-archive.com for these but didn't turn up anything.
>
> Subject: pass on the fun [random subjects]
> Body: This message has attach [random too]
> [random attachments but always ends in .htm]
>
> I didn't open it with IE but with a text editor.
>
> Starts with contractions = new Array(162,
> [whole bunch of numbers]
>
> ends with
>
> charters = 907;
> beetle = 243;
> var equal = "";
> for(bowl = 0; bowl < charters; bowl++)
>equal = equal + String.fromCharCode(contractions[bowl] ^
> preferential[bowl % beetle]);
> document.write(equal);
> 
>
> Sniffer catches these under rule 62 (Experimental) but it's not enough to
> hold these.
>
> Any ideas? What does one see when they view this under IE?
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] weird random .htm attachments

2004-03-29 Thread John Tolmachoff \(Lists\)
Yes, I have been seeing them too. They are java scripts that run. Definitly
spam.

John Tolmachoff
Engineer/Consultant/Owner
eServices For You

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Kevin
> Sent: Monday, March 29, 2004 4:37 PM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] weird random .htm attachments
> 
> Hi,
> 
> Tried searching mail-archive.com for these but didn't turn up anything.
> 
> Subject: pass on the fun [random subjects]
> Body: This message has attach [random too]
> [random attachments but always ends in .htm]
> 
> I didn't open it with IE but with a text editor.
> 
> Starts with contractions = new Array(162,
> [whole bunch of numbers]
> 
> ends with
> 
> charters = 907;
> beetle = 243;
> var equal = "";
> for(bowl = 0; bowl < charters; bowl++)
>equal = equal + String.fromCharCode(contractions[bowl] ^
> preferential[bowl % beetle]);
> document.write(equal);
> 
> 
> Sniffer catches these under rule 62 (Experimental) but it's not enough to
> hold these.
> 
> Any ideas? What does one see when they view this under IE?
> 
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.