Word Doc spam

[Patrick Sneyers-2]

Received in my .mac (basically a spam bin) account.

http://www.triksys.be/docspam.jpg = screenshot of word doc attached.

Neer seen this before....

Is this new, or old news?

211.16.219.135 is in all kinds of blacklists though.

Patrick Sneyers

Belgium

Van: Robert Nicholson <robert@...>

Datum: 8 augustus 2006 05:34:32 GMT+02:00

Aan: users@...

Onderwerp: Latest Network Upgrade not spam.

Return-path: <mistimes@...>

Received: from mac.com (smtpin18-en2 [10.13.11.246])

 by ms24.mac.com (iPlanet Messaging Server 5.2 HotFix 2.08 (built Sep 22 2005))

 with ESMTP id <0J3M00ASEMGCU2@...> for triksys@...; Mon,

 07 Aug 2006 04:55:24 -0700 (PDT)

Received: from localhost (b135.nasicnet.com [211.16.219.135])

by mac.com (Xserve/smtpin18/MantshX 4.0) with SMTP id k77Bt0h3027089 for

 <triksys@...>; Mon, 07 Aug 2006 04:55:20 -0700 (PDT)

Date: Mon, 07 Aug 2006 20:53:23 +0900

From: Lizzie Matthews <mistimes@...>

Subject: August Payment Summary, Invoice #52782

To: triksys@...

Message-id: <000001c6ba17$2a1a0400$0100007f@localhost>

MIME-version: 1.0

X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1506

X-Mailer: Microsoft Outlook, Build 10.0.3416

Content-type: multipart/mixed;

 boundary="----=_NextPart_000_0001_01C6BA17.2A1A0400"

Importance: Normal

X-Priority: 3 (Normal)

X-MSMail-priority: Normal

Original-recipient: rfc822;triksys@...

------=_NextPart_000_0001_01C6BA17.2A1A0400

Content-Type: multipart/mixed;

boundary="----=_NextPart_001_000E_01C6BA17.2A1A0400"

------=_NextPart_001_000E_01C6BA17.2A1A0400

Content-Transfer-Encoding: 7bit

Content-Type: text/plain;

charset=ISO-8859-1;

format=flowed

Past Due Invoice Attached

------=_NextPart_001_000E_01C6BA17.2A1A0400

Content-Transfer-Encoding: base64

Content-Type: application/msword;

name=invoice.doc

Content-Disposition: inline;

filename=invoice.doc

[Kenneth Porter]

--On Tuesday, August 08, 2006 10:27 AM +0200 Patrick Sneyers
<cgpro@...> wrote:

> Received in my .mac (basically a spam bin) account.
> http://www.triksys.be/docspam.jpg = screenshot of word doc attached.
>
> Neer seen this before....
> Is this new, or old news?
> 211.16.219.135 is in all kinds of blacklists though.

I was surprised to see one of these as well.

I'd always thought that it would be nice for the Open Office people to
create a simple command-line utility to convert Word files to plain text
for spam checking. Or it could strip any macros for virus protection.

[Ralf Hildebrandt]

* Kenneth Porter <shiva@...>:

> I was surprised to see one of these as well.
>
> I'd always thought that it would be nice for the Open Office people to
> create a simple command-line utility to convert Word files to plain text
> for spam checking.

man antiword

--
Ralf Hildebrandt (i.A. des IT-Zentrums)         Ralf.Hildebrandt@...
Charite - Universitätsmedizin Berlin            Tel.  [phone]
Gemeinsame Einrichtung von FU- und HU-Berlin    Fax.  [phone]
IT-Zentrum Standort CBF                 send no mail to spamtrap@...

[jdow]

From: "Ralf Hildebrandt" <Ralf.Hildebrandt@...>

>* Kenneth Porter <shiva@...>:
>
>> I was surprised to see one of these as well.
>>
>> I'd always thought that it would be nice for the Open Office people to
>> create a simple command-line utility to convert Word files to plain text
>> for spam checking.
>
> man antiword

No manual entry for antiword

{^_-}

[Bret Miller]

> From: "Ralf Hildebrandt" <Ralf.Hildebrandt@...>
>
> >* Kenneth Porter <shiva@...>:
> >
> >> I was surprised to see one of these as well.
> >>
> >> I'd always thought that it would be nice for the Open
> Office people to
> >> create a simple command-line utility to convert Word files
> to plain text
> >> for spam checking.
> >
> > man antiword
>
> No manual entry for antiword
>
> {^_-}
>

FWIW, we're starting to see these .doc attachments come through as well.
I guess the figure if we're gonna block images, .doc files are the next
best thing?

Bret

[Mark Martinec]

> From: "Ralf Hildebrandt" <Ralf.Hildebrandt@...>
> > man antiword
>
> No manual entry for antiword

Looks really useful and straightforward, thanks Ralf!

In the FreeBSD ports collection it comes under: textproc/antiword
or fetch it from its home site: http://www.winfield.demon.nl/

  Mark

[Kenneth Porter]

--On Wednesday, August 09, 2006 1:01 AM +0200 Mark Martinec
<Mark.Martinec+sa@...> wrote:

> In the FreeBSD ports collection it comes under: textproc/antiword
> or fetch it from its home site: http://www.winfield.demon.nl/

Cool. What's involved in integrating this into SA? Can the image plugin
machinery be easily adapted to invoke this?

[Rob Poe]

I got one of these too...

>>> Kenneth Porter <shiva@...> 8/8/2006 8:07 AM >>>
--On Tuesday, August 08, 2006 10:27 AM +0200 Patrick Sneyers
<cgpro@...> wrote:

> Received in my .mac (basically a spam bin) account.
> http://www.triksys.be/docspam.jpg = screenshot of word doc attached.
>
> Neer seen this before....
> Is this new, or old news?
> 211.16.219.135 is in all kinds of blacklists though.

I was surprised to see one of these as well.

I'd always thought that it would be nice for the Open Office people to
create a simple command-line utility to convert Word files to plain text
for spam checking. Or it could strip any macros for virus protection.

[Chris Santerre]

> -----Original Message-----
> From: Rob Poe [rpoe@...]
> Sent: Thursday, August 10, 2006 5:40 PM
> To: Kenneth Porter; users@...
> Subject: Re: Word Doc spam
>
>
> I got one of these too...
>
> >>> Kenneth Porter <shiva@...> 8/8/2006 8:07 AM >>>
> --On Tuesday, August 08, 2006 10:27 AM +0200 Patrick Sneyers
> <cgpro@...> wrote:
>
> > Received in my .mac (basically a spam bin) account.
> > http://www.triksys.be/docspam.jpg = screenshot of word doc attached.
> >
> > Neer seen this before....
> > Is this new, or old news?
> > 211.16.219.135 is in all kinds of blacklists though.
>
> I was surprised to see one of these as well.
>
> I'd always thought that it would be nice for the Open Office
> people to
> create a simple command-line utility to convert Word files to
> plain text
> for spam checking. Or it could strip any macros for virus protection.
>

These seem on the rise this morning. Caught a bunch more. This one might be a big PITA.

I love "Right click -> Open in TextPad"

--Chris

[Jose Celestino]

Words by Chris Santerre [Fri, Aug 11, 2006 at 12:12:41PM -0400]:
>
>
...
> >
> > I'd always thought that it would be nice for the Open Office
> > people to
> > create a simple command-line utility to convert Word files to
> > plain text
> > for spam checking. Or it could strip any macros for virus protection.
> >

Antiword.

>
> These seem on the rise this morning. Caught a bunch more. This one might be
> a big PITA.

--
Jose Celestino | http://xpto.org/~japc/files/japc-pgpkey.asc
----------------------------------------------------------------
"I can picture in my mind a world without war, a world without hate. And I
can picture us attacking that world, because they’d never expect it.”
  — Jack Handy

[Ken A]

Chris Santerre wrote:

>
>> -----Original Message-----
>> From: Rob Poe [mailto:rpoe@...]
>> Sent: Thursday, August 10, 2006 5:40 PM
>> To: Kenneth Porter; users@...
>> Subject: Re: Word Doc spam
>>
>>
>> I got one of these too...
>>
>>>>> Kenneth Porter <shiva@...> 8/8/2006 8:07 AM >>>
>> --On Tuesday, August 08, 2006 10:27 AM +0200 Patrick Sneyers
>> <cgpro@...> wrote:
>>
>>> Received in my .mac (basically a spam bin) account.
>>> http://www.triksys.be/docspam.jpg = screenshot of word doc attached.
>>>
>>> Neer seen this before....
>>> Is this new, or old news?
>>> 211.16.219.135 is in all kinds of blacklists though.
>> I was surprised to see one of these as well.
>>
>> I'd always thought that it would be nice for the Open Office
>> people to
>> create a simple command-line utility to convert Word files to
>> plain text
>> for spam checking. Or it could strip any macros for virus protection.
>>
>
> These seem on the rise this morning. Caught a bunch more. This one might be
> a big PITA.

Are there other subjects, or just these two:
Bill Summary - Invoice #.....
August Payment Summary, Invoice #.....
?
Ken
Pacific.Net

> I love "Right click -> Open in TextPad"
>
> --Chris
>

[Chris Santerre]

>
> Are there other subjects, or just these two:
> Bill Summary - Invoice #.....
> August Payment Summary, Invoice #.....

I'm only seeing those 2. But you can't really right a rue for just that without major FPs. Going to have to meta with another sign.

--Chris