# What the heck is this? Virus? Weird encoded spam?  DNA sequences?

**URL:** <https://boards.straightdope.com/t/what-the-heck-is-this-virus-weird-encoded-spam-dna-sequences/136425>\
**Category:** Factual Questions\
**Created:** [November 12, 2002, 2:26pm UTC](https://boards.straightdope.com/t/what-the-heck-is-this-virus-weird-encoded-spam-dna-sequences/136425 "2002-11-12T14:26:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![AHunter3](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ahunter3/32/368_2.png) [@AHunter3](https://boards.straightdope.com/u/AHunter3)\
**Post date:** [November 12, 2002, 2:26pm UTC](https://boards.straightdope.com/t/what-the-heck-is-this-virus-weird-encoded-spam-dna-sequences/136425/1 "2002-11-12T14:26:03Z")

</div>

So I’ve been getting an unusually high number of spam messages sneaking below my spam filters and landing in my in boxes. The subject lines are typically spammish:

_ahunter3, Got House? Let our lenders save you thousands  
ahunter, don’t wait to refiance! 2700 lenders are at your service  
Hey ahunter3, \_cheapest Life-\_Insurance Ever!  
Attn: McAfee can SAVE THE DAY!  
ahunter -This program WILL improve your computer. Guaranteed_

The contents, meanwhile, are nonsense strings with no spaces, lines of equal length. Like BinHex or UUEncode or something. Not particularly long. Here’s a sample:

> [@](#):
>
> LS0tLS0tICBNQ0FGRUUgKlZJUlVTIFVQREFURSBBTEVSVCogW05PVkVNQkVSIDIwMDJdICAt  
> LS0tLS0tLS0tDQoNCiAgICAgICAgfn4gTmV3IS0+IE1jQWZlZSBWaXJ1c1NjYW4gNy4wIFJl  
> bGVhc2VkISB+fg0KDQpUaGUgQWxsIE5FVywgIzEgUmF0ZWQgUEMgUHJvdGVjdGlvbiBTb2Z0  
> d2FyZSBIYXMgQXJyaXZlZCEhISAoMjAwMyBFZGl0aW9uKQ0KICANCiAgICAgIC0gU3VwZXJp  
> b3IgYW5kIGNvbXByZWhlbnNpdmUgYW50aS12aXJ1cyBwcm90ZWN0aW9uDQoNCiAgICAgIC0g  
> S2VlcCBIYWNrZXJzIE91dCAtIENvbWVzIHcvUGVyc29uYWwgRmlyZXdhbGwgKE92ZXIgJDQw  
> IFZhbHVlISkNCg0KICAgICAgLSBOZXchLVNjcmlwdCBTdG9wcGVyICYgSEFXSyhUTSkgVGVj  
> aG5vbG9neSBJbnRlZ3JhdGlvbg0KICAgICAgDQogICAgICANCiAgICAgICJTY2FucyBmb3Ig  
> dmlydXNlcyBmYXN0ZXIgdGhhbiBOb3J0b24gQW50aVZpcnVzIDIwMDMgZG9lczsgKGhhcyBh  
> bikgDQogICAgICBpbnR1aXRpdmUgaW50ZXJmYWNlOyBzY2FucyBhbmQgY2xlYW5zIGluc3Rh  
> bnQtbWVzc2VuZ2VyIGF0dGFjaG1lbnRzICgmKSANCiAgICAgIGluY2x1ZGVzIE1jQWZlZSBG  
> aXJld2FsbCBhdCBubyBhZGRpdGlvbmFsIGNoYXJnZSEiDQogICAgICANCiAgICAgICAgICAg  
> ICAgICAgICAgICAgICAgICAgICAgICAtIENORVQgKFdpbm5lciEgKkVESVRPUidTIENIT0lD  
> RSBBV0FSRCopDQoNCg0KICAgICAgQ2xpY2sgSEVSRSAtPiBodHRwOi8vd3d3LnVwZ3JhZGVz  
> cnVzLm5ldC9tY2FmZWUwMTUuaHRtIDwtIHRvIGdldCB5b3VyIENvcHkgTk9XIQ0KDQogICAg  
> ICAgICAgICAoT1IgY3V0ICYgcGFzdGUgdGhlIGFib3ZlIF5eXl5eXl5eXl4gbGluayBpbiB5  
> b3VyIGJyb3dzZXIncyBVUkwgYmFyKQ0KIA0KIA0KIA0KDQoNCg0KICAgICAgWW91ciBwZXJz  
> b25hbCBlbWFpbCBhZGRyZXNzIHdhcyBvYnRhaW5lZCBmcm9tIGFuIG9wdC1pbiBsaXN0LiBP  
> cHQtaW4gVUVDIA0KICAgICAgKFVuaXRlZCBFY29tbWVyY2UgQ29hbGl0aW9uKSBBcHByb3Zl  
> ZCBMaXN0IC0gVHlwZSBOTlMgU3VmZml4ID0gDQogICAgICB6VCUyMmQlSCZFVVNBLiBUbyB1  
> bnN1YnNjcmliZSBmcm9tIHRoaXMgbGlzdCwgcGxlYXNlIENsaWNrIEJlbG93DQogICAgICAN  
> CiAgICAgICAgICAgICAgICAgIGh0dHA6Ly93d3cudXBncmFkZXNydXMubmV0L3JlbW92ZS5h  
> c3ANCg0KICAgICAgWW91IG5lZWQgdG8gYWxsb3cgNSBCdXNpbmVzcyBkYXlzIGZvciByZW1v  
> dmFsLiBXZSBkbyBub3QgY29uZG9uZSBzcGFtIGluIGFueSBzaGFwZSANCiAgICAgIG9yIGZv  
> cm0uIFRoYW5rIFlvdSBraW5kbHkgZm9yIHlvdXIgY29vcGVyYXRpb24uDQoNCg==

There’s no other body text to them. There are no attachments. Oh, and the encoded textblobs are not identical, although I’ve seen some of the same ones in various messages. (I set up spam filters on the first few based on the initial characters in the string, but there are too many variants).

OK, what the heck IS this stuff?

---

<div class="post-metadata">

**Author:** ![Squink](https://avatars.discourse-cdn.com/v4/letter/s/b5e925/32.png) [@Squink](https://boards.straightdope.com/u/Squink)\
**Post date:** [November 12, 2002, 3:24pm UTC](https://boards.straightdope.com/t/what-the-heck-is-this-virus-weird-encoded-spam-dna-sequences/136425/2 "2002-11-12T15:24:12Z")

</div>

> [@](#):
>
> FucyBmb

A poorly spelled description of a terrorist’s favorite porn site ? 🙂  
Seriously though, it might be a picture of some sort. There are lots of small clusters of similar looking subsequences. There are too few odd characters for it to look like the output of a compression algorithm.

---

<div class="post-metadata">

**Author:** ![micco](https://avatars.discourse-cdn.com/v4/letter/m/5f8ce5/32.png) [@micco](https://boards.straightdope.com/u/micco)\
**Post date:** [November 12, 2002, 3:34pm UTC](https://boards.straightdope.com/t/what-the-heck-is-this-virus-weird-encoded-spam-dna-sequences/136425/3 "2002-11-12T15:34:08Z")

</div>

This is likely an image or script which was embedded in the body of the email, and you’re using a client which doesn’t process embedded content. I’ve also seen this happen when attachments are sent by a mail client that doesn’t properly handle certain file types and doesn’t identify them as attachments correctly. In either case, I believe you’re seeing the MIME-encoded binary content of an external file.

If you look at the raw content of the email including headers, there is probably some identification of the MIME type this content is supposed to represent, which would at least tell you what kind of file it was supposed to be.