--On Wednesday, December 12, 2007 1:20 PM -0800 Kenneth Porter <[EMAIL PROTECTED]> wrote:
Anyone seen these? text/plain and HTML parts, seem to have same content, saying there's a virus, please delete, and some gibberish. I'm guessing it's some kind of probe.
Started today (based on reports to us) Varying senders. Comes from a botnet. Varying Subject but always one lower-case word or wordlike string (ogbomosho). Subject does repeat in different messages, but looks like too many to bother matching. Note the misspelling in the string: /Virus found in this message, please delete it without futher reading/ The link *follows* </p></body></html>, and additionally there is nothing between the <a ...> and </a> tags. How can this ever be clicked on? The URL has a dot in the path. We have a local rule watching for this. Example (this is a dead link at this time): <a href="http://www.crop.co.uk/.hidden/nikpfpdk/aaaaganf.html"> Joseph Brennan Lead Email Systems Engineer Columbia University Information Technology