Re: HTMLZip 'compressed' HTML mail - virus or spam ?!?!

From: Ejay Hire (Ejay.hire@broadslate.net)
Date: 09/14/01


Message-ID: <001501c13d4b$4a31be20$4801fe0a@Broadslate.net>
From: "Ejay Hire" <Ejay.hire@broadslate.net>
To: <pdoru@kappa.ro>, <vuln-dev@securityfocus.com>
Subject: Re: HTMLZip 'compressed' HTML mail - virus or spam ?!?!
Date: Fri, 14 Sep 2001 13:30:10 -0500


It opens Cnn.com and in a hidden window it goes to a top-100 voting site and
votes for somebody... here is the page it opens...

----- Original Message -----
From: "Doru Petrescu" <pdoru@kappa.ro>
To: <vuln-dev@securityfocus.com>
Sent: Friday, September 14, 2001 5:11 AM
Subject: HTMLZip 'compressed' HTML mail - virus or spam ?!?!

>
> Hi everybody,
>
> This morning I received a message with subject 'AMERICA UNDER ATTACK' that
> contains a HTML part that contains some obfuscated JavaScript.
>
> This could be a virus or a SPAM (but I never seen such an obfuscated spam
> msg till now)
>
> if someone take the time to decript and analize please post result to the
> list.
>
>
> Best regards,
> Doru Petrescu
>
>
>
>