[SC-Help] Re: Text replaced when copying spam for reporting purposes

[Mike Easter]

Posted to .spam & .help, f/ups to .help

Jeff wrote:
> I just received a spam message advertising Viagra, Cialis and Valium
> from PharmzOnline Shop; however, when I tried copying and pasting the
> message text it was changed and does not reflect the real message.

Summary:
 - original unrendered spambody + complete headers are reported
 - opening or previewing spam rendered insecurely is a bad idea
 - housekeeping:  use discussion groups for discussing

What you see when you open a spam with something like OE^1 configured
however itsecurely it may be and using IE's^1 rendering engine is
entirely different from what you see if you correctly access^2 its
message source^3 in preparation for pasting into SC's^1 webparser.

^1 OE Outlook Express, IE Internet Explorer, SC SpamCop
^2 OE/ File/ Properties/ Detail tab/ Message source button - select all,
copy, paste
^3 Message source can contain base64 encoded graphics or html,
unrendered raw html, or encoded graphics which when displayed can show
text

> I
> tried forwarding the message and got the same result.

What you see when you 'view entire message' in the parser's webpage
display of the message source which is what you see when you forward a
message as an attachment is entirely different from what you see when
your OE/IE engine renders the spam as above.

> I suppose I
> could take a screen shot of the actual message, but is there another
> way to report spam where the message is changed during the copy/paste
>  to spamcop?

The concept of the spam submission process is not to send a picture of
what you are seeing on the screen when you choose to render your spam,
but to send a copy of the original complete spam, which consists of
complete headers and raw message source, which is what is done if you
copy the message source or forward as attachment.

As a housekeeping issue:  the newsgroups spamcop and spamcop.help are
for discussing spamcop issues, but the group spamcop.spam has just been
used in the past for posting examples of raw spam and/or complete
headers -- that function has now been replaced by use of a tracking URL.


-- 
Mike Easter
kibitzer, not SC admin