Text shows something different than what is there.

[Scott Silva]

on 11/28/2007 10:23 AM Steve Campbell spake the following:
> 
> 
> Scott Silva wrote:
>> on 11/28/2007 6:02 AM Steve Campbell spake the following:
>>>
>>>
>>> Scott Silva wrote:
>>>> on 11/27/2007 2:11 PM Steve Campbell spake the following:
>>>>> Sorry if this has been discussed before. I may have not realized 
>>>>> what was being discussed until I saw it in front of me.
>>>>>
>>>>> We are getting tons of email with different sexual content. When 
>>>>> viewing the source of the email through Thunderbird, a few of the 
>>>>> lines show up like the following:
>>>>>
>>>>> IF YOU WANT TO F wol UC sty K SOMEBODY,
>>>>> F oy U zb CK YOURSELF & SAVE YOUR MONEY!
>>>>>
>>>>> The email when viewed normally through Thunderbird (and probably 
>>>>> most other clients) is different. If you remove all of the lower 
>>>>> case letters and the spaces around them, you'll see what the viewed 
>>>>> text is displaying.
>>>>>
>>>>> Can anyone explain what is going on there and a pretty good way to 
>>>>> block this. The F-word is pretty blatant in these.
>>>>>
>>>>> Thanks,
>>>>>
>>>>> Steve Campbell
>>>>>
>>>>>
>>>> If you can post a raw sample somewhere, we could try it and see what 
>>>> existing stuff might hit it.
>>>>
>>> Scott,
>>>
>>> Thanks for the reply.
>>>
>>> Upon further review of the messages on other machines using other 
>>> browsers, I find some HTML or something using bracketed "span" tags 
>>> in between the letters.
>>>
>>> I'm not sure the best way to stop it for now, but at least I have a 
>>> clue as to what's going on.
>>>
>>> Steve
>>>
>> Are you running any of the sare rules? Especially the obfu and 
>> chickenpox ones?
> 
> I run just a very few, but I will look into the ones you mentioned.
> 
> Thanks, Scott
> 
> Steve
>>
>>
> 
That is why I suggested putting up a raw copy to test. You could get some 
ideas on what works.
I actually get a lot of hits with sare_obfu and chickenpox. YMMV

-- 
MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!