Re: real virus, or FP from mcafee?

[Bob Apthorpe]

Hi,

On Thu, 20 May 2004, Ron Snyder wrote:

> I'm getting a bunch of virus alerts from mcafee for "Exploit-objectdata",
> and I'm pretty sure the stuff below is what's triggering it.  The text in
> the sendmail data file (pulled straight from the df*) is exactly as you see
> it below (including the '=' in the right column), with the exception that
> I've changed "object data" to "xxxx" in order to hopefully avoid any other
> alerts that folks might have.
>
>
>  </font></CENTER><xxxx=3D"&#104;&#116;&#116;&#112;&#58;&#47;&#47;&#=
> 119;&#119;&#119;&#46;&#102;&#97;&#116;&#98;&#111;&#110;&#117;&#115;&#99;&#=
> 97;&#115;&#105;&#110;&#111;&#46;&#99;&#111;&#109;&#47;&#112;&#97;&#103;&#1=
> 01;&#46;&#112;&#104;&#112;">
>
>
> Are there programs that can be used to decode this, so I can see exactly
> what this converts to w/o doing it by hand?
> Is this actually an attack?

Try this one-liner:

  cat sample_spam.txt | spamassassin -d | \
  perl -MHTML::Entities -pe 'decode_entities($_);' | less

The above translates to

  </font></CENTER><xxxx=3D"http://www.fatbonuscasino.com/page.php";>

The -n and -p flags to perl are very helpful when doing crazy one-liners
like this. Also see man pages for xargs and cut.

hth,

-- Bob