Overture referers -- indecipherable

[tedster]

I'm having some trouble with Overture clickthroughs that actually originate from Overture itself. I can't pull the actual keyword out of the server log, just a long string of garble.

Can anyone help?

[grnidone]

Is it a virus? Can you post part of the string?

[tedster]

Here's a typical one, line breaks added to prevent side scrolling:

[www3.overture.com...]
?xargs=00u3hs9yoakE0OuzCDRQwGvyrGXhA6GdeEodyyOwrAIJFOQeIQC%2B%
2BpFDy1Svjvtj3RIxexFk8866JpNEbjCabSL46kkyX79563yfFqrr
TKBCxFSxl5jEY9fScItK3hNQN6XAZxBjR7egz5gElhQh3HgfYNMmO5uL0JOkenhI%
2FVCN2iyzoNEdfUwjsplJxvAfUdrwH1lXw2eQH0g2HcdrRIdQS%
2FXUR5NVWREbxmUgi1MHv81l2h5JEH4cGdDlA%3D

[amoore]

I've been trying to figure this out for a while. It could be that you can't decode it because it's just a key into some table, but I doubt that, so I'd like to be able to decode them.

Some things I notice: they only contain characters (lower and upper case) numerals and "%" characters. They (almost?) always start with "00u3hs9yoa".
if you take the two charactes that follow a "%" character and decode it like a URL ( s/%(..)/pack("c",hex($1))/ge ), you get "+", "=" and "/" characters (almost?) exclusively.
They're not the only ones that use "xargs=00u3hs9yoa" as is illustrated by this link I found: [search.yahoo.com...] (I hope that use of a URL is acceptable.)
They often end wiith "%3D" (which is a "=" if you decode it)

I've been searching for a while for someone who has decoded it or any more information on it. Anyone have the secret?