Yet another trojan?

I've seen a number of messages looking like this, they just get
deleted, but what exactly are they ? Is this another attempt
to execute code on MS Outluck?

--------------------

- Home directory: The location of the home directory varies by
platform.
Windows 98 (single-user): C:\Windows
Windows 98 (multi-user): C:\Windows\Profiles
Windows 2000/XP: C:\Documents and Settings




-----BEGIN BLOCK-----
F%D5%CDU%C2%058%E5%9A%D5%7D%85
JJ%E3%DF%D7o%C1%1F%60%EA%F0%B2

etc ...
--
Jim Watt
http://www.gibnet.com

Jim Watt

"Jim Watt" wrote...
> I've seen a number of messages looking like this,

So have I - since about the end of August.

> they just get deleted, but what exactly are they ?

Just spammer nonsense, I think.

> Is this another attempt to execute code on MS Outluck?

The block displays as plain text. I can't make sense of it as
executable code after escaping.

I've seen examples of spam containing these blocks, which also contain
an encoded javascript. This is the real exploit. It contains an iframe
with a URL to a site hosting a trojan. The idea is that this gets
silently downloaded and installed if you're unlucky enough to preview
or open it with OE.

Easy enough to avoid with the proper security settings. OE should be
in the restricted zone, which should of course have scripting disabled.

> - Home directory: The location of the home directory varies by
> platform.
> Windows 98 (single-user): C:\Windows
> Windows 98 (multi-user): C:\Windows\Profiles
> Windows 2000/XP: C:\Documents and Settings
>
> -----BEGIN BLOCK-----
> F%D5%CDU%C2%058%E5%9A%D5%7D%85
> JJ%E3%DF%D7o%C1%1F%60%EA%F0%B2
>
> etc ...

Ant

Googling the first line or first two lines gets quite a few hits. For
example: http://www.dslreports.com/forum/rema...t=-1~mode=flat


On Sun, 3 Oct 2004 12:48:48 -0400, Jim Watt wrote
(in article <>):

> I've seen a number of messages looking like this, they just get
> deleted, but what exactly are they ? Is this another attempt
> to execute code on MS Outluck?
>[snipped]

Mark3324

"Mark3324" wrote...
> Googling the first line or first two lines gets quite a few hits. For
> example: http://www.dslreports.com/forum/rema...t=-1~mode=flat

There's an example on that page of the "JScript.Encode" obfuscated
scripting I mentioned.

Ant