KnujOn

KnujOn (nûj-ôn)


Categorizing Junk eMail

Usually our eyes glaze over when we look at the enormous pile of spam in our inbox. It all seems like such nonsense, an electronic Tower of Babel that loses any specific meaning in an ocean of noise. However, there a many different kinds of kinds of Junk eMail and understanding the difference and details of each kind helps fight the problem. KnujOn recognizes these various types and has a different process for each one. As a victim of Junk eMail it is important to understand the different threat each one represents and why it is necessary to address these threats head-on. The format of these reports are designed to give you the most useful and actionable information by addressing these questions: What is it? Why is it a problem? How would it affect me? and What can be done? We provide samples, resources and specific cases for each.

Delivery Medium

Financial

Product-Driven

Remainders Phishing

Phishing

Send to phishing@coldrain.net
What is it?

What is phishing? As opposed to regular junk mail or spam, phishing emails are specifically designed coerce or fool consumers into revealing sensitive information. Names, userIDs, account numbers, passwords, PIN numbers, social security numbers, and other information that would be useful to those wanting to break into on-line bank accounts, commit credit card fraud, or perpetrate identity theft.

Why is it a problem?

Phishers will often lift content and graphics from real websites for purpose of fooling users into thinking they are viewing the real site. Ebay.com, PayPal.com and Amazon.com are frequent targets of these attacks. Someone who fraudulently accesses one of these online accounts could make hundreds of bogus transactions before being discovered. Phishers will also often register similar domain names: "amason.com", "PaiPal.com", "ebayy.com". This generally undermines consumer confidence and erodes faith in Internet commmerce.

How would it effect me?

If you fall for one of these tricks your bank account could be emptied, your credit cards used illegally, your identity stolen and your credit rating ruined.

Samples and Cases

Recent
Typical
PayPal/Ebay
Amazon
Chase
visa
Credit Unions

What can be done?

  • Send the phishing email to phishing@coldrain.net
  • Whenever conducting transactions or updating information over the Internet go directly to site by manually typing in the URL, never click links in emails.
  • Always keep paper trails of your transactions. Review your bank statements and credit card bills every month!
  • Check your credit rating frequently
  • "Fry" your Phish at CastleCops (castlecops.com)
  • Forward the email to the security department at the sepcific institution
  • Forward the email to Anti Phishing Working Group (antiphishing.org)
  • Check Websense alerts for attempts directed at your bank. (websense.com)





Cases and Samples

Websense Security Labs has received reports of a phishing attack that targets customers of Hang Seng Bank. Users who visit the site will be asked for personal as well as account information, such as ATM pin number, account number, and details. (websense.com)

Alerts at Websense (websense.com)

Fake fax, bypassed filters
View full size









Report any fraud emails like this to phishing@coldrain.net and phishing@visa.com. More information at Visa's security pages.
 

"Warning Notification Dear" valued PayPal® member

It has come to our attention that your PayPal® account information needs to be 
updated as part of our continuing commitment to protect your account and to 
reduce the instance of fraud on our website. 
If you could please take 5-10 minutes 
out of your
online experience and update your personal records you will not run into 
any future
problems with the online service. 
                                   

However, failure to update your records will result in account suspension. 
Please update your records on or before January 26, 2006. 

Once you have updated your account records, your PayPal® session will not be 
interrupted and will continue as normal.

To update your PayPal® records click on the following link: 
http://www.paypal.com/cgi-bin/webscr?cmd=p/gen/restrictedaccounts.asp

 

Thank You.  
PayPal® UPDATE TEAM                                     

Accounts Management As outlined in our User Agreement, PayPal® will 
periodically send you information about site changes and enhancements.

Visit our Privacy Policy and User Agreement if you have any questions. 
http://www.paypal.com/cgi-bin/webscr?cmd=p/gen/ua/policy_privacy-outside

 

Everything about the message appears legitimate on casual review. The graphics all but 2 links are really PayPal. The "click on the following link:" links to ilabs.pl not paypal.com. ilabs.pl has a completely mocked-up PayPal.com page running at: http://www.paypal.com.ilabs.pl/.cgi-bin/webscr/index.php, note that the ".paypal" and the ".com" portions of this URL are subnets and the actual site name is "ilabs.pl"

Common among these attempts is the insistence that the customer's account has been compromised and they must login immediately to remedy the situation. "Logging in" to one of these sites basically means that you have handed your username and password over to someone who will use it to impersonate you and steal your money.

What you can do
Every instance should be reported. PayPal, Ebay, and Amazon all have email addresses for reporting phishing attempts.

Amazon.com: stop-spoofing@amazon.com
PayPal.com: spoof@paypal.com
Ebay.com: spoof@ebay.com

In the case of online banks, you may have to go to the bank's real website and find out their policy and reporting method. Some banks tell their customers to "just delete it." We believe that this is a very bad policy.


More Cases     Common Examples


Knujon has received thousands of phishing attempts against Fifth Third Bank in recent months and we are aggressively reporting all of them. Below is an example:

You can forward these attempts to us and 53investigation@security.53.com


Phishers are using a new tactic on their site to fool people who mistakenly click on the linked email. Using JavaScript a subnet at chinanet.cn.net projects a fake address over the real address contained in the browser window, as shown below:



While deceptive it is flawed. The image is off-center and will overlay all windows not just the immediate browser. This is clearly an effort to lure ebay customers into having their identities stolen.


Links to update-user5463.info which is registered to a "David Abrahams." Forward emails like this to abuse@bankofamerica.com.
These emails all use hijacked Amazon.com images but link to "cyberdyneoem.com".



Send any suspicious Amazon.com emails to: stop-spoofing@amazon.com. Read more about spoofing at Amazon.com.
Lloyds TSB and the UK Financial Services Authority fake email. If you have an email similar to the one below, forward it to emailscams@lloydstsb.co.uk



Read more about email scams: here.
Forged Bank of the West email


Attempt to obtain customer information form LaSalle Bank customers



LaSalle is located in the United States, but the email would actaully dump the customer data to a subnet at a Japanese site. There is no evidence that the Japanese site was operating the subnet or knew about it. The subnet has been deleted.

Report any suspect LaSalle emails to emailhoax@abnamro.com. Read more about LaSalle's security policies here.
We received a carefully constructed email warning PayPal users of a possible security breach and asking them to log into their PayPal account. The log-in link did not go to PayPal but a subdomain on heyjule.com in Korea. To be fair to heyjule.com, the subdomain has been deleted, it is possible they were not even aware of the problem.


The following email requesting ebay customer information was revealed by KnujOn as actually linking to a subnet on an educational site in China:


The subnet has been reported by KnujOn and shutdown. If you have email similar to this, read ebay's security information: http://pages.ebay.com/securitycenter/stop_spoof_websites.html.
This is an attempt by "amen-pro.com" in Paris, France to obtain personal customer information from U.S. customers of the Marshall & Ilsley Corporation in Wisconsin.

This email was forwarded to M & I's security personnel. If you are customer of M & I Bank, read their fraud/identity theft information before replying to any email or entering personal information via the Internet.


Knujon has uncovered dozens of attempts to trick PayPal customers into revealing passwords and other personal information. The emails are designed to mimic PayPal customer alerts but hijacking the content. However, the links within the email that request personal information redirect to this address: 61.166.6.60. This is a site in China which is not affiliated with PayPal. PayPal is an online payment system run by ebay.com.


Filling out the information on this page will transmit passwords & usernames to people at lijian-guanfang-gainshop and ghotel-lijiang.com out of "Beijin", China. They also claim to be located in Pompano Beach, FL. The information will probably be used for some kind of identity theft. The irony is that the email claims to be a security alert itself, confusing the ordinary user and further eroding trust in e-commerce.



We have seen obfuscated urls in the past, phishers and spammers that replace characters in a domain address with their hexadecimal equivalents. Example: %2E%63%6F%6D is ".com". However, today KnujOn received a PayPal scam with this link:

http://0xd8daf761/modules/PNphpBB2/cache/PNTheme/saving.php

0xd8daf761 is a hexadecimal conversion of the ip address: 216.218.247.97 which is nfb.hippo.ws a free member bulletin board in French(Oddly enough .ws is the TLD for Western Samoa). hippo.ws is a jumble of postings and one of the first is "the internet is shit" which is poignant given the situation here.

At any rate, be on the look out 0xd8daf761 style urls, KnujOn is set to catch them!





Common Examples




Dear valued PayPal® member : 





It has come to our attention that your PayPal® account information needs to be 

updated as part of our continuing commitment to protect your account and to 

reduce the instance of fraud on our website.  If you could please take 5-10 minutes 

out of your online experience and update your personal records you will not run into 

any future problems with the online service. 



However, failure to update your records will result in account suspension. 

Please update your records on or before January 25, 2006. 



Once you have updated your account records, your PayPal® session will not be 

interrupted and will continue as normal. 



To update your PayPal® records click on the following link: 



http://www.paypal.com/cgi-bin/webscr?cmd=login-run 



 



Thank You.  

PayPal® UPDATE TEAM      



Accounts Management As outlined in our User Agreement, PayPal® will 

periodically send you information about site changes and enhancements. 



Visit our Privacy Policy and User Agreement if you have any questions. 

http://www.paypal.com/cgi-bin/webscr?cmd=p/gen/ua/policy_privacy -outside







At the last reviewing at your amazon account we discovered that your information 

is inaccurate. We apologize for this but because most frauds are possible because 

we don't have enough information about our clients, we require this verification. 

Please login and reenter your personal information. 





Please follow this link to update your personal information: 











http://www.amazon.com/exec/obidos/sign-in.html 



(To complete the verification process you must fill in all the required fields) 









Please note: If you don't update your information within next 48 hours , we will be 

forced to suspend your account untill you have the time to contact us by phone. 





We apreciate your support and understanding, as we work togeder to keep amazon 

market a safe place to trade. Thank you for your attention on this serious matter 

and we apologize. 





Regards,  

 

 

Jeff Bezos  

Founder & CEO  











Greetings from Amazon Payments.



Your bank has contacted us regarding some attempts of charges from your credit card 

via the Amazon system. We have reasons to believe that you changed your registration 

information or that someone else has unauthorized access to your Amazon account Due 

to recent activity, including possible unauthorized listings placed on your account, 

we will require a second confirmation of your identity with us in order to allow us 

to investigate this matter further. Your account is not suspended, but if in 48 

hours after you receive this message your account is not confirmed we reserve the 

right to suspend your Amazon registration. If you received this notice and you are 

not the authorized account holder, please be aware that it is in violation of Amazon 

policy to represent oneself as another Amazon user. Such action may also be in 

violation of local, national, and/or international law. Amazon is committed to 

assist law enforcement with any inquires related to attempts to misappropriate 

personal information with the intent to commit fraud or theft. Information will be 

provided at the request of law enforcement agencies to ensure that perpetrators are 

prosecuted to the full extent of the law.







To confirm your identity with us click here:

https://www.amazon.com/exec/obidos/flex-sign-in/ref=pd_irl_gw_r/

103-3177084-7567864?opt=oa&page=recs/sign-in-secure.html



After responding to the message, we ask that you allow at least 72 hours for the 

case to be investigated. Emailing us before that time will result in delays. We 

apologize in advance for any inconvenience this may cause you and we would like 

to thank you for your cooperation as we review this matter. 





Thank you for your interest in selling at Amazon.com.



Amazon.com Customer Service

http://www.amazon.com



This message and any files or documents attached may contain classified information. 

It is intended only for the individual or entity named and others authorized to 

receive it. If you are not the intended recipient or authorized to receive it, 

you are hereby notified that any disclosure, copying, distribution or taking any 

action in reliance on the contents of this information is strictly prohibited and 

may be unlawful. If you have received this communication in error, please notify 

us immediately then delete it from your system. Please also note that transmission 

cannot be guaranteed to be secure or error-free.



 







Dear PayPal,



We recently noticed one or more attempts to log in to your PayPal account from a 

foreign IP address (209.145.1.34).



If you recently accessed your account while traveling, the unusual log in attempts 

may have been initiated by you.

However, if you did not initiate the sessions, please visit PayPal as soon as 

possible to verify your identity:



https://www.paypal.com/us/cgi-bin/webscr? cmd=_login-run



Verify your identity is a securi! ty measure that will ensure that you are the only 

person with access to the account.



Thanks for your patience as we work together to protect your account.



Sincerely,







PayPal Helps Keep You Safe



Our comprehensive fraud-prevention program is one of the key reasons PayPal is a 

safe way to pay online. 



  We monitor transactions 24/7.



We believe that innovation and careful analysis is the way to beat fraud. That’s 

why PayPal has developed industry-leading models to review every transaction—and 

help detect suspicious activity. 

 

  Experts work behind the scenes to help protect you.



We have a team of agents worldwide who work to help shield you from fraud and 

identity theft. 

If we suspect fraud in your account, we’ll contact you immediately





We work with authorities to shut down fraudulent websites 

 

  PayPal's Fraud Investigation Team stops criminals.



Our Fraud Investigation Team is dedicated to creating a safe PayPal community. 

Our team includes former law enforcement officials who: 

Identify and help prevent fraud before it occurs





Work with law enforcement around the world to help stop online criminals 







We recently noticed one or more attempts to log in to your Amazon account from a 

foreign IP address and we have reasons to belive that your account was hijacked by 

a third party without your authorization.



If you recently accessed your account while traveling,the unusual log in attempts 

may have been initiated by you. However,if you are the rightfull holder of the 

account, click on the link below, fill the form and then submit as we try to 

verify your identity. 





Click Here!



The log in attempt was made from: 

IP address: 205.88.09.66

ISP host: cache-dq04.proxy.cox.net





If you choose to ignore our request,you leave us no choise but to temporaly 

suspend your account.



We ask that you allow at least 72 hours for the case to be investigated and we 

strongly recommend not to make any changes to your account in that time.



If you received this notice and you are not the authorized account holder, 

please be aware that it is in violation of Amazon policy to represent oneself 

as another Amazon user. Such action may also be in violation of local, national, 

and/or international law. Amazon is committed to assist law enforcement with any 

inquires related to attempts to misappropriate personal information with the 

intent to commit fraud or theft. Information will be provided at the request of 

law enforcement agencies to ensure that perpetrators are prosecuted to the 

fullest extent of the law.



*Please do not respond to this e-mail as your reply will not be received.



Thanks for your patience as we work together to protect your account. 





Regards,



Security Department

Amazon Inc. 







PayPal Security Measures! 

 

 

We are contacting you to remind you that: on 02 Nov 2005 our Account Review Team 

identified some unusual activity in your account, one or more attempts to log in 

to your PayPal account from a foreign IP address.  IP Address  Time  Country 

80.53.1.130 Aug 10, 2005 15:05:08 PDT Poland 

80.53.255.174 Aug 10, 2005 15:07:58 PDT Poland 

80.80.125.1 Aug 10, 2005 15:13:09 PDT Rusia 

85.55.2.65 Aug 10, 2005 21:28:08 PDT Spania 

81.82.87.172 Aug 10, 2005 21:33:43 PDT Belgium 

In accordance with PayPal's User Agreement and to ensure that your account has not 

been compromised, access to your account was limited. Your account access will 

remain limited until this issue has been resolved. To secure your account and 

quickly restore full access, we may require some additional information from you. 





To securely confirm your PayPal information please go directly to 

https://www.paypal.com/ log in to your PayPal account and perform the steps 

necessary to restore your account access as soon as possible or click on the 

link bellow:









 To continue your verification procedure click here  

 















Thank you for using PayPal!

The PayPal Team

 



--------------------------------------------------------------------------------

 

Please do not reply to this e-mail. Mail sent to this address cannot be answered. 

For assistance, log in to your PayPal account and choose the "Help" link in the 

footer of any page.



To receive email notifications in plain text instead of HTML, update your 

preferences here.  

 

 



PayPal Email ID PP785445 






Chase Fraud

Links to 194.86.65.51


Links to fantasticflyers.com


Links to jdfamilies.com


Links to rrcs-24-213-165-171.nyc.biz.rr.com






Credit Union Fraud

You may have received an email like the ones below. While the message text only refer to a generic credit union, the headers are forged with ncua.gov or cuna.org.

The messages are virtually the same text except for the fake case ID, we have recorded 4:

CU1-818-214-242146
CU1-833-557-9888
FCU1-GX833-234-P4TYUN1
FCU1-813-214-242146


Why four fake codes? They are related to the sources of the messages. Each one seems to be coming from one of three IP addresses:

CU1-833-557-9888 or CU1-818-214-242146 = 66.165..
FCU1-GX133-234-P4TYUN1 = 209.190..
FCU1-813-214-242146 = 207.36..

The first string of messages linked to 210.72.224.26, a subnet in China. Later, the link changed to: http://www.tamin.org/.CREDIT-UNION/update.php. There is no content at this location but the site is still up. Tamin.org is registered to a company in Iran.

cuna.org recommends that you delete these messages, but KnujOn thinks that this is the wrong approach. You may send any of these messages to phishing@coldrain.net.


Senders
Credit Union
Credit Union 1
Credit Union Security Department
Credit Union Security Service
C.U.N.A. Security Service
C.U.N.A. Security Department
FCU Security Service
FCU Security Department
Federal Credit Union

Subjects
WARNING: ACCOUNT UPDATE
Update Your Billing Information
CRITICAL UPDATE
FCU: Account update
System maintenance: update your Federal Credit Union
FCU NOTICE: Important security update

http://211.97.60.218/usage/.CREDIT-UNION/update.php

In attention of all Credit Union  customers,



As the Internet and information technology enables us to expand our services, 

we are committed to maintaining the trust customers have placed in us for 

protecting the privacy and security of information we have about you. 

In order to protect your information against unauthorized access, identity 

theft and account fraud we earnestly ask you to update your profile. 



To get started, please click the link below:



http://www.co-opnetwork.org/public/update_profile/index.htm 



If you received this notice and you are not the authorized account holder, 

please be aware that it is in violation of our policy to represent oneself 

as another Credit Union user. Such action may also be in violation of local, 

national, and/or international law. CUNA is committed to assist law enforcement 

with any inquiries related to attempts to misappropriate personal information 

with the intent to commit fraud or theft. Information will be provided at the 

request of law enforcement agencies to ensure that perpetrators are prosecuted 

to the fullest extent of the law.





 

Thanks for your patience as we work together to protect your account.



Regards,



CUNA Customer Support Center.







This site is directed at or made available to persons in the United States and 

Credit Union customers only. Persons outside the United States may visit Credit 

Unions on line. Products and services described, as well as associated fees, 

charges, interest rates, and balance requirements may differ among geographic 

locations. Not all products and services are offered at all locations.








http://211.97.60.218/usage/.CREDIT-UNION-1/authenticate.php

Credit Union 1 is constantly working to ensure security by regularly 

screening the accounts in our system. We recently reviewed your account, 

and we need more information to help us provide you with secure service. 

Until we can collect this information, your access to sensitive account 

features will be limited. We would like to restore your access as soon 

as possible, and we apologize for the inconvenience. 



--------------------------------------------------------------------------------



Why is my account access limited? 



Your account access has been limited for the following reason(s): 

* We would like to ensure that your account was not accessed by an 

unauthorized third party. Because protecting the security of your 

account is our primary concern, we have limited access to sensitive 

Credit Union 1 account features. We understand that this may be an 

inconvenience but please understand that this temporary limitation is 

for your protection. 



(Your case ID for this reason is CREDIT UNION 1 XG868-214-242146.) 





At Credit Union 1, one of our most important responsibilities to you, our 

customer, is the safekeeping of the nonpublic personal ("confidential") 

information you have entrusted to us and using this information in a 

responsible manner. Appropriate use of the confidential information you 

provide us is also at the heart of our ability to provide you with 

exceptional personal service whenever you contact us. 



--------------------------------------------------------------------------------



How can I restore my account access? 





Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations." 



Completing all of the checklist items will automatically restore your 

account access. 




http://211.97.60.218/usage/.CREDIT-UNION-1/authenticate.php

Credit Union 1 is constantly working to ensure security by regularly 

screening the accounts in our system. We recently reviewed your account, 

and we need more information to help us provide you with secure service. 

Until we can collect this information, your access to sensitive account 

features will be limited. We would like to restore your access as soon 

as possible, and we apologize for the inconvenience. 



--------------------------------------------------------------------------------



Why is my account access limited? 



Your account access has been limited for the following reason(s): 

* We would like to ensure that your account was not accessed by an 

unauthorized third party. Because protecting the security of your 

account is our primary concern, we have limited access to sensitive 

Credit Union 1 account features. We understand that this may be an 

inconvenience but please understand that this temporary limitation is 

for your protection. 



(Your case ID for this reason is CREDIT UNION 1 XG868-214-242146.) 





At Credit Union 1, one of our most important responsibilities to you, our 

customer, is the safekeeping of the nonpublic personal ("confidential") 

information you have entrusted to us and using this information in a 

responsible manner. Appropriate use of the confidential information you 

provide us is also at the heart of our ability to provide you with 

exceptional personal service whenever you contact us. 



--------------------------------------------------------------------------------



How can I restore my account access? 





Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations." 



Completing all of the checklist items will automatically restore your 

account access. 












http://211.97.60.218/usage/.CREDIT-UNION/update.php

Credit Union is constantly working to ensure security by regularly 

screening the accounts in our system. We recently reviewed your account, 

and we need more information to help us provide you with secure service. 

Until we can collect this information, your access to sensitive account 

features will be limited. We would like to restore your access as soon 

as possible, and we apologize for the inconvenience. 



--------------------------------------------------------------------------------



Why is my account access limited? 



Your account access has been limited for the following reason(s): 

* We would like to ensure that your account was not accessed by an 

unauthorized third party. Because protecting the security of your 

account is our primary concern, we have limited access to sensitive 

Credit Union account features. We understand that this may be an 

inconvenience but please understand that this temporary limitation is 

for your protection. 



(Your case ID for this reason is PCU1-818-214-242146.) 





At Credit Union, one of our most important responsibilities to you, our 

customer, is the safekeeping of the nonpublic personal ("confidential") 

information you have entrusted to us and using this information in a 

responsible manner. Appropriate use of the confidential information you 

provide us is also at the heart of our ability to provide you with 

exceptional personal service whenever you contact us. 



--------------------------------------------------------------------------------



How can I restore my account access? 





Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations." 



Completing all of the checklist items will automatically restore your 

account access. 












http://211.97.60.218/usage/.CREDIT-UNION/update.php

Credit Union is constantly working to ensure security by regularly 

screening the accounts in our system. We recently reviewed your account, 

and we need more information to help us provide you with secure service. 

Until we can collect this information, your access to sensitive account 

features will be limited. We would like to restore your access as soon 

as possible, and we apologize for the inconvenience. 



--------------------------------------------------------------------------------



Why is my account access limited? 



Your account access has been limited for the following reason(s): 

* We would like to ensure that your account was not accessed by an 

unauthorized third party. Because protecting the security of your 

account is our primary concern, we have limited access to sensitive 

Credit Union account features. We understand that this may be an 

inconvenience but please understand that this temporary limitation is 

for your protection. 



(Your case ID for this reason is PCU1-818-214-242146.) 





At Credit Union, one of our most important responsibilities to you, our 

customer, is the safekeeping of the nonpublic personal ("confidential") 

information you have entrusted to us and using this information in a 

responsible manner. Appropriate use of the confidential information you 

provide us is also at the heart of our ability to provide you with 

exceptional personal service whenever you contact us. 



--------------------------------------------------------------------------------



How can I restore my account access? 





Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations." 



Completing all of the checklist items will automatically restore your 

account access. 












http://211.97.60.218/usage/.CREDIT-UNION/update.php

Credit Union is constantly working to ensure security by regularly 

screening the accounts in our system. We recently reviewed your account, 

and we need more information to help us provide you with secure service. 

Until we can collect this information, your access to sensitive account 

features will be limited. We would like to restore your access as soon 

as possible, and we apologize for the inconvenience. 



--------------------------------------------------------------------------------



Why is my account access limited? 



Your account access has been limited for the following reason(s): 

* We would like to ensure that your account was not accessed by an 

unauthorized third party. Because protecting the security of your 

account is our primary concern, we have limited access to sensitive 

Credit Union account features. We understand that this may be an 

inconvenience but please understand that this temporary limitation is 

for your protection. 



(Your case ID for this reason is PCU1-818-214-242146.) 





At Credit Union, one of our most important responsibilities to you, our 

customer, is the safekeeping of the nonpublic personal ("confidential") 

information you have entrusted to us and using this information in a 

responsible manner. Appropriate use of the confidential information you 

provide us is also at the heart of our ability to provide you with 

exceptional personal service whenever you contact us. 



--------------------------------------------------------------------------------



How can I restore my account access? 





Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations." 



Completing all of the checklist items will automatically restore your 

account access. 












http://www.tamin.org/.CREDIT-UNION/update.php

Credit Union is constantly working to ensure security by regularly 

screening the accounts in our system. We recently reviewed your account, 

and we need more information to help us provide you with secure service. 

Until we can collect this information, your access to sensitive account 

features will be limited. We would like to restore your access as soon 

as possible, and we apologize for the inconvenience. 



--------------------------------------------------------------------------------



Why is my account access limited? 



Your account access has been limited for the following reason(s): 

* We would like to ensure that your account was not accessed by an 

unauthorized third party. Because protecting the security of your 

account is our primary concern, we have limited access to sensitive 

Credit Union account features. We understand that this may be an 

inconvenience but please understand that this temporary limitation is 

for your protection. 



(Your case ID for this reason is CU1-833-557-9888.) 





At Credit Union, one of our most important responsibilities to you, our 

customer, is the safekeeping of the nonpublic personal ("confidential") 

information you have entrusted to us and using this information in a 

responsible manner. Appropriate use of the confidential information you 

provide us is also at the heart of our ability to provide you with 

exceptional personal service whenever you contact us. 



--------------------------------------------------------------------------------



How can I restore my account access? 





Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations." 



Completing all of the checklist items will automatically restore your 

account access. 












http://www.tamin.org/.CREDIT-UNION/update.php

Credit Union is constantly working to ensure security by regularly 

screening the accounts in our system. We recently reviewed your account, 

and we need more information to help us provide you with secure service. 

Until we can collect this information, your access to sensitive account 

features will be limited. We would like to restore your access as soon 

as possible, and we apologize for the inconvenience. 



--------------------------------------------------------------------------------



Why is my account access limited? 



Your account access has been limited for the following reason(s): 

* We would like to ensure that your account was not accessed by an 

unauthorized third party. Because protecting the security of your 

account is our primary concern, we have limited access to sensitive 

Credit Union account features. We understand that this may be an 

inconvenience but please understand that this temporary limitation is 

for your protection. 



(Your case ID for this reason is CU1-833-557-9888.) 





At Credit Union, one of our most important responsibilities to you, our 

customer, is the safekeeping of the nonpublic personal ("confidential") 

information you have entrusted to us and using this information in a 

responsible manner. Appropriate use of the confidential information you 

provide us is also at the heart of our ability to provide you with 

exceptional personal service whenever you contact us. 



--------------------------------------------------------------------------------



How can I restore my account access? 





Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations." 



Completing all of the checklist items will automatically restore your 

account access. 












http://www.tamin.org/.CREDIT-UNION/update.php



Credit Union is constantly working to ensure security by regularly 

screening the accounts in our system. We recently reviewed your account, 

and we need more information to help us provide you with secure service. 

Until we can collect this information, your access to sensitive account 

features will be limited. We would like to restore your access as soon 

as possible, and we apologize for the inconvenience. 



--------------------------------------------------------------------------------



Why is my account access limited? 



Your account access has been limited for the following reason(s): 

* We would like to ensure that your account was not accessed by an 

unauthorized third party. Because protecting the security of your 

account is our primary concern, we have limited access to sensitive 

Credit Union account features. We understand that this may be an 

inconvenience but please understand that this temporary limitation is 

for your protection. 



(Your case ID for this reason is CU1-833-557-9888.) 





At Credit Union, one of our most important responsibilities to you, our 

customer, is the safekeeping of the nonpublic personal ("confidential") 

information you have entrusted to us and using this information in a 

responsible manner. Appropriate use of the confidential information you 

provide us is also at the heart of our ability to provide you with 

exceptional personal service whenever you contact us. 



--------------------------------------------------------------------------------



How can I restore my account access? 





Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations." 



Completing all of the checklist items will automatically restore your 

account access. 










http://www.tamin.org/.CREDIT-UNION/update.php

Credit Union is constantly working to ensure security by regularly 

screening the accounts in our system. We recently reviewed your account, 

and we need more information to help us provide you with secure service. 

Until we can collect this information, your access to sensitive account 

features will be limited. We would like to restore your access as soon 

as possible, and we apologize for the inconvenience. 



--------------------------------------------------------------------------------



Why is my account access limited? 



Your account access has been limited for the following reason(s): 

* We would like to ensure that your account was not accessed by an 

unauthorized third party. Because protecting the security of your 

account is our primary concern, we have limited access to sensitive 

Credit Union account features. We understand that this may be an 

inconvenience but please understand that this temporary limitation is 

for your protection. 



(Your case ID for this reason is CU1-818-214-242146.) 





At Credit Union, one of our most important responsibilities to you, our 

customer, is the safekeeping of the nonpublic personal ("confidential") 

information you have entrusted to us and using this information in a 

responsible manner. Appropriate use of the confidential information you 

provide us is also at the heart of our ability to provide you with 

exceptional personal service whenever you contact us. 



--------------------------------------------------------------------------------



How can I restore my account access? 





Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations." 



Completing all of the checklist items will automatically restore your 

account access. 



       












http://www.tamin.org/.CREDIT-UNION/update.php

Credit Union is constantly working to ensure security by regularly 

screening the accounts in our system. We recently reviewed your account, 

and we need more information to help us provide you with secure service. 

Until we can collect this information, your access to sensitive account 

features will be limited. We would like to restore your access as soon 

as possible, and we apologize for the inconvenience. 



--------------------------------------------------------------------------------



Why is my account access limited? 



Your account access has been limited for the following reason(s): 

* We would like to ensure that your account was not accessed by an 

unauthorized third party. Because protecting the security of your 

account is our primary concern, we have limited access to sensitive 

Credit Union account features. We understand that this may be an 

inconvenience but please understand that this temporary limitation is 

for your protection. 



(Your case ID for this reason is CU1-818-214-242146.) 





At Credit Union, one of our most important responsibilities to you, our 

customer, is the safekeeping of the nonpublic personal ("confidential") 

information you have entrusted to us and using this information in a 

responsible manner. Appropriate use of the confidential information you 

provide us is also at the heart of our ability to provide you with 

exceptional personal service whenever you contact us. 



--------------------------------------------------------------------------------



How can I restore my account access? 





Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations." 



Completing all of the checklist items will automatically restore your 

account access. 












http://www.tamin.org/.CREDIT-UNION/update.php

Credit Union is constantly working to ensure security by regularly 

screening the accounts in our system. We recently reviewed your account, 

and we need more information to help us provide you with secure service. 

Until we can collect this information, your access to sensitive account 

features will be limited. We would like to restore your access as soon 

as possible, and we apologize for the inconvenience. 



--------------------------------------------------------------------------------



Why is my account access limited? 



Your account access has been limited for the following reason(s): 

* We would like to ensure that your account was not accessed by an 

unauthorized third party. Because protecting the security of your 

account is our primary concern, we have limited access to sensitive 

Credit Union account features. We understand that this may be an 

inconvenience but please understand that this temporary limitation is 

for your protection. 



(Your case ID for this reason is CU1-818-214-242146.) 





At Credit Union, one of our most important responsibilities to you, our 

customer, is the safekeeping of the nonpublic personal ("confidential") 

information you have entrusted to us and using this information in a 

responsible manner. Appropriate use of the confidential information you 

provide us is also at the heart of our ability to provide you with 

exceptional personal service whenever you contact us. 



--------------------------------------------------------------------------------



How can I restore my account access? 





Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations." 



Completing all of the checklist items will automatically restore your 

account access. 














http://www.tamin.org/.CREDIT-UNION/update.php

Credit Union is constantly working to ensure security by regularly 

screening the accounts in our system. We recently reviewed your account, 

and we need more information to help us provide you with secure service. 

Until we can collect this information, your access to sensitive account 

features will be limited. We would like to restore your access as soon 

as possible, and we apologize for the inconvenience. 



--------------------------------------------------------------------------------



Why is my account access limited? 



Your account access has been limited for the following reason(s): 

* We would like to ensure that your account was not accessed by an 

unauthorized third party. Because protecting the security of your 

account is our primary concern, we have limited access to sensitive 

Credit Union account features. We understand that this may be an 

inconvenience but please understand that this temporary limitation is 

for your protection. 



(Your case ID for this reason is CU1-818-214-242146.) 





At Credit Union, one of our most important responsibilities to you, our 

customer, is the safekeeping of the nonpublic personal ("confidential") 

information you have entrusted to us and using this information in a 

responsible manner. Appropriate use of the confidential information you 

provide us is also at the heart of our ability to provide you with 

exceptional personal service whenever you contact us. 



--------------------------------------------------------------------------------



How can I restore my account access? 





Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations." 



Completing all of the checklist items will automatically restore your 

account access. 










http://210.72.224.26/usage/webalizer.png/.CREDIT-UNION/update.php

Credit Union is constantly working to ensure security by regularly 

screening the accounts in our system. We recently reviewed your account, 

and we need more information to help us provide you with secure service. 

Until we can collect this information, your access to sensitive account 

features will be limited. We would like to restore your access as soon 

as possible, and we apologize for the inconvenience. 



--------------------------------------------------------------------------------



Why is my account access limited? 



Your account access has been limited for the following reason(s): 

* We would like to ensure that your account was not accessed by an 

unauthorized third party. Because protecting the security of your 

account is our primary concern, we have limited access to sensitive 

Credit Union account features. We understand that this may be an 

inconvenience but please understand that this temporary limitation is 

for your protection. 



(Your case ID for this reason is FCU1-GX833-234-P4TYUN1.) 





At Credit Union, one of our most important responsibilities to you, our 

customer, is the safekeeping of the nonpublic personal ("confidential") 

information you have entrusted to us and using this information in a 

responsible manner. Appropriate use of the confidential information you 

provide us is also at the heart of our ability to provide you with 

exceptional personal service whenever you contact us. 



--------------------------------------------------------------------------------



How can I restore my account access? 





Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations." 



Completing all of the checklist items will automatically restore your 

account access. 










Virus/Malware

MalWare

Viruses, trojans, spyware, worms. They go by lots of different names but they are all "MalWare", code indented to damage, break into, or control computer equipment. MalWare is used to create Botnets or networks of infected computers, which are in turn used to launch Denial of Service Attacks. A recent virus has been specifically used to target anti-abuse sites like CastleCops and SpamCop. The Storm Worm also contains code that will insert messages onto blogs and forums from infected machines.

Recent Events
Viruses
Spyware/AdWare/Scumware
Fake System Alerts
Worms

Recent Events

How the Malware Marketplace Works
Vista attacked by 13-year-old virus
Apple Macintoshes Targeted by Porn-Based Computer Virus
Feds: Fake Harassment Complaint E-Mail Contains Virus Decade old virus infects Vista
Online Videos Could Infect Computers With Viruses, Study Finds


Viruses

This page provides an overview of some specific virus cases, what they are and how to stop them.

Sober    Blaster     MyDoom    Gone     Lovsan    

If you are just looking for virus removal instructions or general information, try these links:
What are viruses, how do they work?(howstuffworks.com)
Protection and Detection
Research Viruses(ca.com)
Commentary on Windows and Viruses
Viruses Hoaxes(HoaxBustersHome.com)

Dissecting a Virus Attack

We have collected over 3100 virus emails since a large outbreak of the Sober Virus started on November 21th to study the messages, see where they are coming from and how different Internet Service Providers respond to the problem. To start with here is a breakdown of the sources of the virus emails. The exact IP address is not presented here since owner is probably an unwitting victim of a virus or hacker:


Source IPCountISPStartedStoppedFirst Complaint
24.167..1044Road Runner11/21/2005?11/22/2005
64.35..95TDS11/25/200512/01/200511/27/2005
67.151..28PaeTec11/22/200511/24/200511/22/2005
68.69..63adelphia.net11/25/2005?11/27/2005
68.187..1446charter.net11/21/2005?11/22/2005
69.40..311alltel.net11/21/2005?11/22/2005
69.239..171pacbell.net11/22/2005?11/28/2005
82.43..6blueyonder.co.uk12/02/200512/05/200512/02/2005
86.131..24btbroadband.com11/22/2005?11/29/2005
221.135..58sifycorp.com11/26/200512/03/200511/26/2005

This is not so much about the virus itself, but a discussion of how service providers or hosting companies address the issue. The quality of handling a virus attack and company policy varies greatly. For information about the virus and how to get rid of it, click here



adelphia.net
No direct link for abuse on the home page. Information about reporting abuse is found on the FAQ link. When you forward headers to abuse@adelphia.net they auto-reply quickly but there are no assurances in the reply that they will address the problem and recommend that you buy antispam software. However, they do provide an incident number. There have been no follow-ups to complaints other than the original auto-reply. There is no way on their site to lodge a formal complaint or report unless you are a customer with an ID and password.

alltel.net
Policy and contact email(abuse@alltel.net) is clearly marked on the Acceptable Use Policy page linked from the home page. However, they do not reply to reports sent to this address so I tried to file a complaint via a form an their website. These forms can be found under customer support and are designed for troubleshooting customer issues and not reporting abuse.

blueyonder.co.uk
Stopped soon after being reported. The complaint was handled in a clear and professional manner.

btbroadband.com
There is a complaint contact form at their Contact Us link. Send headers to abuse@btbroadband.com and they will reply with an auto-message that directs you to obtain anti-spam software or use mailbox filtering rules. The message contains this paragraph:

"I have carried out an investigation into this and have taken action against our user to stop this happening again."

But I have trouble believing this since the virus email keeps coming.

charter.net
With nearly 1500 virus emails from a charter client spanning several weeks, I have very little faith in their ability to address issues like this. Charter's website only has a complaint interface for customers. Sending your headers to abuse@charter.net results in an auto-reply that has no ticket number. There has been no follow-up. Awful.

pacbell.net
Very confusing. Complaints sent to abuse@pacbell.net result in replies from sbcglobal.net. The auto-reply email directs you to file you complaint at a specific link, but the link is complaint form for customers only who need help with DSL or Dial-up service. You have to provide an excessive amount of personal information to file the complaint. I have not received any follow-up from these reports and the virus emails keep coming.

PaeTec
Email stopped immediately after being reported.

rr.com
Headers forwarded to abuse@rr.com result in an instant auto-reply. They have a number of contact methods here: http://security.rr.com/contact.htm but they are geared towards customers. When you submit a complaint on their website, you get an email instructing you to forward the headers to abuse@rr.com. The vicious circle!

sifycorp.com
Handled quickly and professionally. Emails have stopped.

tds.net
Handled quickly and professionally. Emails have stopped.


About Sober
Typical Virus Email Subjects
  • Registration Confirmation Protected message is attached!
  • hi, ive a new mail address hey its me, my old address dont work at time...
  • Paris Hilton & Nicole Richie The Simple Life: View Paris Hilton...
  • Your Password Account and Password Information are attached!
  • smtp mail failed
  • Mail delivery failed

You may have received many emails like the following:


These are junk messages but they are not exactly spam emails because they are not selling anything. The sender addresses are spoofed just like other junk mail. Downloading the attached file will infect you PC with a virus. One mailbox we use for this project has received over 2500 messages like this in 24 hours. 2500 messages seems like an overwhelming pile of junk that should just be deleted, but that is exactly what the spammers want. By deleting the messages you are allowing someone else the opportunity to be infected. Infected computers send more virus emails. You have the power to stop the buck at your mailbox. System administrators will only shutdown virus sources if they are reported. But how do you research and report 2500 messages? What if I told you that these 2500 messages were only coming from 10 locations. Even if you just report one, you are helping stop the spread. Here is what you can do, you need to look at the headers of the email. The headers will tell where the email really originated from. Each email program has a different way to access the headers you may have to do a little research view the headers. When you do, find the field value "Originating-IP." The value will be series of four numbers separated by periods: 24.167.6.223. This is an IP Address. Next, open a command-line DOS window(Start, Run, CMD). At the prompt enter tracert -h 1 and the IP address and hit enter. Example:



Look at the line starting with "Tracing route..." and find the end of the string, the "rr.com" is what we are interested in, this is host of the IP address. In this case it is Road Runner ISP. Important: just because this is where the viruses are originating it does not mean they are doing it on purpose. It more than likely that the ISP is a victim of hacking and viruses. Go to the ISP's homepage and find the contact email for abuse. Copy the entire header from your virus email and forward it to the administrators. Just forward a small sample, a little reporting goes a long way.

Removal Instructions/More information
ca.com
symantec.com
mcafee.com


NewDot Saga

Not only is NewDot difficult to remove, but they will sue you if you talk about it. NewDot installs very easily by simply opening an email or web page. NewDot's registry entry will try to launch this DLL on start-up: C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL. If you delete the DLL and registry entry it will reinstall. It may only be removed completely in safe mode. Hijack this can help. But NewDot is not done with you yet! They insist that their hidden-install-forced-download-impossible-to-remove-browser-hijack is not "spyware" but simply a new type of marketing and they will sue you if you say that it is "spyware"(some call it "Foistware"). They have even filed a lawsuit against the Internet Corporation For Assigned Names and Numbers for discussing NewDot's business practices.

Letter to ICANN from NewDot
ICANN Response to NewDot


NewDot Sues Lavasoft (LavaSoft is a recommended PC security tool)


Here is a case of someone from NewDot going into a spyware discussion blog a telling users that NewDot is not spyware(see post #3): pcreview.co.uk

NewDot has a large amount of information on the subject at their site, but since we cannot guarantee that the site is safe we will not link to it directly.

Removal and Information
Removal Discussion Thread
spywaredata.com
cexx.org
cnet.com
Analyze your PC for threats
Lavasoft suit(pdf)


Blaster and SVCHOST.EXE

If you are running Windows 2000 and get an SVCHOST.EXE Application Error when you use a dial-up connection you probably have the Blaster virus. When you get this error, open Task Manager and you should see msblast .exe in the program list. Download the McAfee/Network Associates Stinger program which will clean out Blaster and other virues and run it.
You will note that after you clean the virus, SVCHOST.EXE is still broken. You need to load a patch to fix it here. This link may not be current. Click here to search for additional links.


W32/Mydoom@mm

Avoid openning unscanned attachments. Delete emails with attachments from persons you don't know. If you've got it, then get stinger.exe to remove it.

Stinger 1.9.7 and the 4319 DATs will both require that infected Systems be rebooted to achieve complete removal of W32/Mydoom@mm.

The shimgapi.dll file is injected into the EXPLORER.EXE process if the system has been rebooted after the infection has occurred. In this situation, a reboot and rescan is required to remove this DLL from the system. McAfee information.


Gone.scr Virus: Case example of removing a virus manually

This virus hit Outlook email in 2001. "gone.scr" infects the Outlook address book through an email attachment masked as a screen saver program.

Double-clicking the attachment infects the PC.
The virus then uses email addresses in the outlook address book to forward the virus and message to more people in your name.

The program sits in C:\WINDOWS\SYSTEM and is hidden. The program is constantly running and accessing Outlook. Under these conditions it cannot be deleted.

Also, the virus creates a registry key which launches the program on boot. The program also recreates the registry key if it's deleted or renamed.

In order to disinfect, the program and registry key must be deleted and this cannot be done while Windows is running.

Follow these steps:

  • Restart in DOS mode or to a boot disk
  • On the command line type:
    ATTRIB -R -A -S -H C:\WINDOWS\SYSTEM\gone.scr
  • Hit ENTER
  • On the command line type:
    DEL C:\WINDOWS\SYSTEM\gone.scr
  • Hit ENTER
  • Restart the PC
  • Go to Start, Run and type REGEDIT, click OK
  • Find the key(by expanding the folders):
    HKEY_CURRENT_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{C:\windows\system\gone.scr}
  • Select this key and delete it
  • Also go to Start, Find and do a search for "gone.scr", There may be copies in temp folders.
  • Emtpy the Recycle Bin
  • Delete any emails with the attachment
  • Empty the Outlook Deleted Items folder




Lovsan

An infected machine (running msblast.exe or teekids.exe) will send out malformed packets across the local subnet to the RPC service running on port 135. When these packets are received by any unpatched system, it will create a buffer overflow and crash the RPC service on that system. All this can occur without the worm actually being on the machine. This means that the remote shell will still get created on TCP port 4444, and the system may unexpectedly crash upon receiving malformed exploit code. Other symptoms may include:
- inability to cut/paste
- inability to move icons
- Add/Remove Programs list empty
- dll errors in most Microsoft Office programs
- generally slow, or unresponsive system performance

By applying the MS03-026 patch to the machine, it will prevent the RPC service from failing, in-turn solving these symptoms. **It is very important that the machine is rebooted after the patch has been installed.** The machine can then be updated to the latest dats/engine/config and an on-demand scan run to pickup msblast.exe or teekids.exe, IF it exists. I must reiterate, all these symptoms are related to the RPC vulnerability and not necessarily due to W32/Lovsan running locally. Msblast.exe/teekids.exe may not be present at all.

Please visit the VIL links below for more information:
W32/Lovsan
(W32/Lovsan.b variant)
(W32/Lovsan.c variant)
(W32/Spybot.worm.lz which exploits the same RPC vulnerability)


Protection and Detection

Both Norton(Symantec) and McAfee have free/trial downloads of anti-virus packages that will eliminate most viruses.

Norton Virus Removal Tools
McAfee Free Scan

Spyware

Spyware "infects" your PC but does not have the same intent as a traditional virus. Spyware usually collects information from your cookies for advertising purposes, launches pop-ups and changes your default homepage. If your startup web page changes and you reset it but it changes back on reboot, you may have spyware.

Some spyware is legitimate, meaning it is part of something you intentionally downloaded. For example, you may have installed RealPlayer. RealPlayer checks your version for updates and upgrades and prompts you when new versions are available. They also launch popups for advertising. However, you are getting their product for free and if you uninstall it, the spayware goes away too.

It is important to note that these attacks are conducted by random hackers looking to damage personal PCs, but rather a targeted attempt by entities to control how you use the Internet and force advertising on you. They are doing this for money and it is not a prank.

The not-so-nice ones are very hard to get rid of sometimes. There are many free programs that can help:
SpyBot - Search and destroy
Spyware Blaster
Hijackthis
CWShredder

U.S. House approves less stringent anti-spyware bill(05.22.07)

Lavasoft Ad-Ware, recomended purchase product for protection and removal



ZQuest

ZQuest is a Trojan that can be spread through email, web pages and instant messages. ZQuest forces pop-ups and modifies viewed web pages on the fly. ZQuest may show up along side an infection of SurfSideKick. The registry key needs to be deleted in safe mode:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{22131A58-5F9A-3EAA-28A7-C3059A3D0632}

May force your browser to topconverting.com, revenue.net, zwoops.com, Z-QUEST.COM, and other sites.

Information and Removal
symantec.com
nai.com
scanspyware.net



More "It's Not Spyaware" Claims - SurfSideKick

According to the SurfSideKick website: "Surf Sidekick guides relevant web sites to you at the precise moment you are actually interested in them. Just browse the internet as you normally do and ... ." Similar to NewDot they claim that it is not spyware and "helps" users search the web. There is one problem with that claim, SurfSideKick installs without the user's permission or knowledge.

Registry key: HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe must be deleted in safe mode.

Information and Removal
Ssk - Ssk.exe - Process Information
Ssk.exe is Adware.SurfSideKick greatis.com
Alias: SurfSideKick 2 sunbelt-software.com
SurfSideKick Removal majorgeeks.com
SurfSideKick ca.com
HOW TO REMOVE SSK.EXE (surfsidekick 2) techsupportforum.com
Hijackthis logfile....please help techsupportforum.com



MIRAR

Have you noticed an additional toolbar on your Browser called MIRAR? If so you have a spyware virus on your PC. The "uninstall" link for MIRAR actually links to their website and phony form that requests personal information that has nothing to with uninstalling the program. Never fill forms like this out.

The purpose here is to a) deter people from uninstalling the spyware or b) gather more personal information.

The following sites are associated with this spyaware:
mirarsearch.com
getnirar.com
net-nucleus.com
mt-download.com
adservs.com
findthewebsiteyouneed.com

Removal
http://www.spyany.com/program/article_spw_rm_Mirar.html
http://www.nuker.com/container/details/mirar_toolbar.php



Fake Spyware Scans

You may have had a pop-up window like the one below:

Do not click on the links in this window. These advertised scans are often launched by viruses or spyware that have already infected your PC. Downloading the software will "fix" the virus problem and in turn expose you to more spyware and viruses. Some companies have infected PCs with spyware and then billed users to have them removed. The above pop-up links to web-update.org and scanandrepair.com. They are listed as "Rogue/Suspect Anti-Spyware Products & Web Sites" by spywarewarrior.com. Read more.

oneclicksearches.com and psguard.com

oneclicksearches.com and psguard.com use Trojan.ByteVerify and variants to infect your PC.


What do oneclicksearches.com and psguard.com do to you?
  • Sets default homepage to: oneclicksearches.com
  • Turns on Active Desktop and defaults the page to %SystemRoot%\system32\\wppp.html which is psguard.com
  • Installs these programs in c:\winnt\system32\
    down1.exe
    hhk.dll
    hpF443.tmp
    intell32.exe
    intmon.exe
    msmsgs.exe
    oleext32.dll
    shnlog.exe
    uninstIU.exe
    wppp.html
  • Sets up a fake "Virus Alert" in your task bar. Clicking on the "alert" brings you to psguard.com where they try to sell you anti-spyware software.
  • The oneclicksearches.com home page uses hijacked microsoft.com icons so the site looks like a Windows security page.
  • Sets hundreds, possibly thousands of registry keys pointing to oneclicksearches.com

What you can do about it
  1. If you don't already have anti-virus software, get some. If you do have it, update the definitions lists. There are free anti-virus packages available from symantec and mcafee. Download stinger.exe.
  2. Disconnect from the Internet/Network
  3. Reboot in Safe Mode with Network support(reboot and hold F8)
  4. Run the anti-virus software in Safe Mode
  5. Disable Active Desktop(Control Panel, Folder Options)
  6. Do a search for the files listed above and delete them
  7. Open the Registry editor(Start, Run, regedit) and do a search for all keys with "oneclicksearches.com" and delete them. Do the same for "wppp.html" and "psguard.com"
  8. If you know approximately when you got the virus, do a search on your PC for any file created since that time. More than likely you will see recently created EXEs in the system32 folder. Rename these files rather than delete them just in case they are not part of the virus.
  9. Open a browser(while stil off-line!) and delete all cookies, cache, temp files, bookmarks that were added by the virus and change your home page back to what it was.
  10. Reboot your PC and test to see if the viruses are gone
  11. oneclicksearches.com psguard.com are registered through ESTDOMAINS, file a complaint with estdomains.com.
  12. Email the admins for oneclicksearches.com psguard.com at dep@sexpicsporn.com and psguard@ua.fm and tell them how disgusted you are with their tactics.
  13. File a complaint with the BBB
  14. File a complaint with FTC



Gator/GAIN

One of the earliest and most well-known examples. Often comes bundled with downloaded freeware or shareware like KaZaA, weatherbug, Napster, and the like. Gator launches adds and redirects your searches to their selected products. Having Gator installed will expose you to other types of spyware.

Removal: In Gator's case you may be able to remove it through Add/Remove Software in the Control Panel. To be sure find and delete the following files:
iegator.dll
fsg.exe
fsg-ag.exe
GMT.exe
Do a Registry search for it also and delete the keys in ...\Current Version\Run and ...\Current Version\RunOnce




Xupiter

An example of Brower Hijacking is the Xupiter toolbar. Keeps resetting your homepage to Xupiter.com, adds a toolbar and launches popups. Use these instructions: pchell.com to remove it, then send an email to help@xupiter.com, support@xupiter.com, and dnsadmin@tucows.com telling them you do not like their spyware advertising tactics.




fastsearch.cc

What a pain this one is. Sets registry keys for startup pages to
http://%69%6e%2e%77%65%62%63%6f%75%6e%74%65%72%2e%63%63/%2d%2d/?%79%64%74%66%73.
Why? The % followed by numbers and letters are hexidecimal numbers. %69 = i, %6e = n, etc. The entire string decoded is: in.webcounter.cc/--/?ydtfs, this page redirects your browser to fastsearch.cc(.cc is Cocos Islands). The reasons: for one, you cannot put the % in your web blocking list. Then, your browser keeps resolving to fastsearch.cc, but if you search your harddrive, cache and registry "fastsearch.cc" wont come up. This is called obfuscation.

This was apparently caused by CWS.Tapicfg a variant of the CoolWebSearch. It's named so because CoolWebSearch.com was one of the first ones to use it.

SpyBot, spywareblaster, and HijackThis did not clean it out but CWShredder did get it.

After you have cleaned out webcounter.cc or fastsearch.cc send and email to:
Helen Bauer - webmaster@fastsearch.cc and Katsuji Yoneyama - webmaster@webcounter.cc expressing your disgust at their advertising tactics.

To reduce the risk of spywear infection, load Spyware Blaster which will block specific spyware packages and also increase the security on your browser settings, specifically blocking or prompting for stylesheet downloads.



More Info:
Anti-spyware guidelines get final version(msn-cnet.com 01/12/2006)
Information Kit: Spyware
Whatis.com
spychecker.com
cexx.org
grc.com
spywareinfo.com
Spyware forum

Worms

Computer worm (wikipedia.org)
The Internet Worm of 1988 (std.com)
Fighting Internet Worms With Honeypots (securityfocus.com)
The Internet Worm Program: An Analysis (purdue.edu)
A REPORT ON THE INTERNET WORM (ryerson.ca)
What is an internet worm? (bbc.co.uk)
Monitoring and Early Warning for Internet Worms (blog.namics.com)

Fake System Alerts

Have you ever seen one of these?


This is not a real system message it is a junk message made to look like a system message. Sites associated with this kind of fake system message:
fix-ms.com
set32.com
patchupdate.info
gerfixit.com
windowsrepair.net
msregistryupdate.com
pcspywarescan.com
uric.com

Don't go to any of these sites. You can stop the messages by disabling Windows Messenger Service(Control Panel, Admin Tools, Select "Services", find the "Messenger" service, right-click and Stop. Also set to manual or disabled rather than automatic or boot). This is not the same as Instant Messaging.

More Information:
dell.com/supportforums
aumha.org
blogharbor.com/hacked/

Viruses

This page provides an overview of some specific virus cases, what they are and how to stop them.

Sober    Blaster     MyDoom    Gone     Lovsan    

If you are just looking for virus removal instructions or general information, try these links:
What are viruses, how do they work?(howstuffworks.com)
Protection and Detection
Research Viruses(ca.com)
Commentary on Windows and Viruses
Viruses Hoaxes(HoaxBustersHome.com)

Dissecting a Virus Attack

I have collected over 3100 virus emails since a large outbreak of the Sober Virus started on November 21th to study the messages, see where they are coming from and how different Internet Service Providers respond to the problem. To start with here is a breakdown of the sources of the virus emails. The exact IP address is not presented here since owner is probably an unwitting victim of a virus or hacker:


Source IPCountISPStartedStoppedFirst Complaint
24.167..1044Road Runner11/21/2005On-going11/22/2005
64.35..95TDS11/25/200512/01/200511/27/2005
67.151..28PaeTec11/22/200511/24/200511/22/2005
68.69..63adelphia.net11/25/2005On-going11/27/2005
68.187..1446charter.net11/21/2005On-going11/22/2005
69.40..311alltel.net11/21/2005On-going11/22/2005
69.239..171pacbell.net11/22/2005On-going11/28/2005
82.43..6blueyonder.co.uk12/02/200512/05/200512/02/2005
86.131..24btbroadband.com11/22/2005On-going11/29/2005
221.135..58sifycorp.com11/26/200512/03/200511/26/2005

This is not so much about the virus itself, but a discussion of how service providers or hosting companies address the issue. The quality of handling a virus attack and company policy varies greatly. For information about the virus and how to get rid of it, click here



adelphia.net
No direct link for abuse on the home page. Information about reporting abuse is found on the FAQ link. When you forward headers to abuse@adelphia.net they auto-reply quickly but there are no assurances in the reply that they will address the problem and recommend that you buy antispam software. However, they do provide an incident number. There have been no follow-ups to complaints other than the original auto-reply. There is no way on their site to lodge a formal complaint or report unless you are a customer with an ID and password.



alltel.net
Policy and contact email(abuse@alltel.net) is clearly marked on the Acceptable Use Policy page linked from the home page. However, they do not reply to reports sent to this address so I tried to file a complaint via a form an their website. These forms can be found under customer support and are designed for troubleshooting customer issues and not reporting abuse.



blueyonder.co.uk
Stopped soon after being reported. The complaint was handled in a clear and professional manner.



btbroadband.com
There is a complaint contact form at their Contact Us link. Send headers to abuse@btbroadband.com and they will reply with an auto-message that directs you to obtain anti-spam software or use mailbox filtering rules. The message contains this paragraph:

"I have carried out an investigation into this and have taken action against our user to stop this happening again."

But I have trouble believing this since the virus email keeps coming.



charter.net
With nearly 1500 virus emails from a charter client spanning several weeks, I have very little faith in their ability to address issues like this. Charter's website only has a complaint interface for customers. Sending your headers to abuse@charter.net results in an auto-reply that has no ticket number. There has been no follow-up. Awful.



pacbell.net
Very confusing. Complaints sent to abuse@pacbell.net result in replies from sbcglobal.net. The auto-reply email directs you to file you complaint at a specific link, but the link is complaint form for customers only who need help with DSL or Dial-up service. You have to provide an excessive amount of personal information to file the complaint. I have not received any follow-up from these reports and the virus emails keep coming.



PaeTec
Email stopped immediately after being reported.



rr.com
Headers forwarded to abuse@rr.com result in an instant auto-reply. They have a number of contact methods here: http://security.rr.com/contact.htm but they are geared towards customers. When you submit a complaint on their website, you get an email instructing you to forward the headers to abuse@rr.com. The vicious circle!



sifycorp.com
Handled quickly and professionally. Emails have stopped.



tds.net
Handled quickly and professionally. Emails have stopped.




About Sober

Typical Virus Email Subjects

Registration Confirmation Protected message is attached!
hi, ive a new mail address hey its me, my old address dont work at time...
Paris Hilton & Nicole Richie The Simple Life: View Paris Hilton...
Your Password Account and Password Information are attached!
smtp mail failed
Mail delivery failed


Removal Instructions/More information

ca.com
symantec.com
mcafee.com

Surviving a Virus Attack

By now you have probably received many emails like the following:




These are junk messages but they are not exactly spam emails because they are not selling anything. The sender addresses are spoofed just like other junk mail. Downloading the attached file will infect you PC with a virus. One mailbox I use for this project has received over 2500 messages like this in 24 hours. 2500 messages seems like an overwhelming pile of junk that should just be deleted, but that is exactly what the spammers want. By deleting the messages you are allowing someone else the opportunity to be infected. Infected computers send more virus emails. You have the power to stop the buck at your mailbox. System administrators will only shutdown virus sources if they are reported. But how do you research and report 2500 messages? What if I told you that these 2500 messages were only coming from 10 locations. Even if you just report one, you are helping stop the spread. Here is what you can do, you need to look at the headers of the email. The headers will tell where the email really originated from. Each email program has a different way to access the headers you may have to do a little research view the headers. When you do, find the field value "Originating-IP." The value will be series of four numbers separated by periods: 24.167.6.223. This is an IP Address. Next, open a command-line DOS window(Start, Run, CMD). At the prompt enter tracert -h 1 and the IP address and hit enter. Example:



Look at the line starting with "Tracing route..." and find the end of the string, the "rr.com" is what we are interested in, this is host of the IP address. In this case it is Road Runner ISP. Important: just because this is where the viruses are originating it does not mean they are doing it on purpose. It more than likely that the ISP is a victim of hacking and viruses. Go to the ISP's homepage and find the contact email for abuse. Copy the entire header from your virus email and forward it to the administrators. Just forward a small sample, a little reporting goes a long way.


NewDot Saga

Not only is NewDot difficult to remove, but they will sue you if you talk about it. NewDot installs very easily by simply opening an email or web page. NewDot's registry entry will try to launch this DLL on start-up: C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL. If you delete the DLL and registry entry it will reinstall. It may only be removed completely in safe mode. Hijack this can help. But NewDot is not done with you yet! They insist that their hidden-install-forced-download-impossible-to-remove-browser-hijack is not "spyware" but simply a new type of marketing and they will sue you if you say that it is "spyware"(some call it "Foistware"). They have even filed a lawsuit against the Internet Corporation For Assigned Names and Numbers for discussing NewDot's business practices.

Letter to ICANN from NewDot
ICANN Response to NewDot


NewDot Sues Lavasoft (LavaSoft is a recommended PC security tool)


Here is a case of someone from NewDot going into a spyware discussion blog a telling users that NewDot is not spyware(see post #3): pcreview.co.uk

NewDot has a large amount of information on the subject at their site, but since we cannot guarantee that the site is safe we will not link to it directly.

Removal and Information
Removal Discussion Thread
spywaredata.com
cexx.org
cnet.com
Analyze your PC for threats
Lavasoft suit(pdf)


Blaster and SVCHOST.EXE

If you are running Windows 2000 and get an SVCHOST.EXE Application Error when you use a dial-up connection you probably have the Blaster virus. When you get this error, open Task Manager and you should see msblast .exe in the program list. Download the McAfee/Network Associates Stinger program which will clean out Blaster and other virues and run it.
You will note that after you clean the virus, SVCHOST.EXE is still broken. You need to load a patch to fix it here. This link may not be current. Click here to search for additional links.


W32/Mydoom@mm

Avoid openning unscanned attachments. Delete emails with attachments from persons you don't know. If you've got it, then get stinger.exe to remove it.

Stinger 1.9.7 and the 4319 DATs will both require that infected Systems be rebooted to achieve complete removal of W32/Mydoom@mm.

The shimgapi.dll file is injected into the EXPLORER.EXE process if the system has been rebooted after the infection has occurred. In this situation, a reboot and rescan is required to remove this DLL from the system. McAfee information.


Gone.scr Virus: Case example of removing a virus manually

A new virus hit Outlook email on 12.04.01. It's called "gone.scr" and infects the Outlook address book through an email attachment masked as a screen saver program.

Double-clicking the attachment infects the PC.
The virus then uses email addresses in the outlook address book to forward the virus and message to more people in your name.

The program sits in C:\WINDOWS\SYSTEM and is hidden. The program is constantly running and accessing Outlook. Under these conditions it cannot be deleted.

Also, the virus creates a registry key which launches the program on boot. The program also recreates the registry key if it's deleted or renamed.

In order to disinfect, the program and registry key must be deleted and this cannot be done while Windows is running.

Follow these steps:
  • Restart in DOS mode or to a boot disk
  • On the command line type:
    ATTRIB -R -A -S -H C:\WINDOWS\SYSTEM\gone.scr
  • Hit ENTER
  • On the command line type:
    DEL C:\WINDOWS\SYSTEM\gone.scr
  • Hit ENTER
  • Restart the PC
  • Go to Start, Run and type REGEDIT, click OK
  • Find the key(by expanding the folders):
    HKEY_CURRENT_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{C:\windows\system\gone.scr}
  • Select this key and delete it
  • Also go to Start, Find and do a search for "gone.scr", There may be copies in temp folders.
  • Emtpy the Recycle Bin
  • Delete any emails with the attachment
  • Empty the Outlook Deleted Items folder



Lovsan

An infected machine (running msblast.exe or teekids.exe) will send out malformed packets across the local subnet to the RPC service running on port 135. When these packets are received by any unpatched system, it will create a buffer overflow and crash the RPC service on that system. All this can occur without the worm actually being on the machine. This means that the remote shell will still get created on TCP port 4444, and the system may unexpectedly crash upon receiving malformed exploit code. Other symptoms may include:
- inability to cut/paste
- inability to move icons
- Add/Remove Programs list empty
- dll errors in most Microsoft Office programs
- generally slow, or unresponsive system performance

By applying the MS03-026 patch to the machine, it will prevent the RPC service from failing, in-turn solving these symptoms. **It is very important that the machine is rebooted after the patch has been installed.** The machine can then be updated to the latest dats/engine/config and an on-demand scan run to pickup msblast.exe or teekids.exe, IF it exists. I must reiterate, all these symptoms are related to the RPC vulnerability and not necessarily due to W32/Lovsan running locally. Msblast.exe/teekids.exe may not be present at all.

Please visit the VIL links below for more information:
W32/Lovsan
(W32/Lovsan.b variant)
(W32/Lovsan.c variant)
(W32/Spybot.worm.lz which exploits the same RPC vulnerability)


Protection and Detection

Both Norton(Symantec) and McAfee have free/trial downloads of anti-virus packages that will eliminate most viruses.

Norton Virus Removal Tools
McAfee Free Scan

Spyware

Spyware "infects" your PC but does not have the same intent as a traditional virus. Spyware usually collects information from your cookies for advertising purposes, launches pop-ups and changes your default homepage. If your startup web page changes and you reset it but it changes back on reboot, you may have spyware.

Some spyware is legitimate, meaning it is part of something you intentionally downloaded. For example, you may have installed RealPlayer. RealPlayer checks your version for updates and upgrades and prompts you when new versions are available. They also launch popups for advertising. However, you are getting their product for free and if you uninstall it, the spayware goes away too.

It is important to note that these attacks are conducted by random hackers looking to damage personal PCs, but rather a targeted attempt by entities to control how you use the Internet and force advertising on you. They are doing this for money and it is not a prank.

The not-so-nice ones are very hard to get rid of sometimes. There are many free programs that can help:
SpyBot - Search and destroy
Spyware Blaster
Hijackthis
CWShredder


Lavasoft Ad-Ware, recomended purchase product for protection and removal



ZQuest

ZQuest is a Trojan that can be spread through email, web pages and instant messages. ZQuest forces pop-ups and modifies viewed web pages on the fly. ZQuest may show up along side an infection of SurfSideKick. The registry key needs to be deleted in safe mode:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{22131A58-5F9A-3EAA-28A7-C3059A3D0632}

May force your browser to topconverting.com, revenue.net, zwoops.com, Z-QUEST.COM, and other sites.

Information and Removal
symantec.com
nai.com
scanspyware.net



More "It's Not Spyaware" Claims - SurfSideKick

According to the SurfSideKick website: "Surf Sidekick guides relevant web sites to you at the precise moment you are actually interested in them. Just browse the internet as you normally do and ... ." Similar to NewDot they claim that it is not spyware and "helps" users search the web. There is one problem with that claim, SurfSideKick installs without the user's permission or knowledge.

Registry key: HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe must be deleted in safe mode.

Information and Removal
Ssk - Ssk.exe - Process Information
Ssk.exe is Adware.SurfSideKick greatis.com
Alias: SurfSideKick 2 sunbelt-software.com
SurfSideKick Removal majorgeeks.com
SurfSideKick ca.com
HOW TO REMOVE SSK.EXE (surfsidekick 2) techsupportforum.com
Hijackthis logfile....please help techsupportforum.com



NewDot Saga

Not only is NewDot difficult to remove, but they will sue you if you talk about it. NewDot installs very easily by simply opening an email or web page. NewDot's registry entry will try to launch this DLL on start-up: C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL. If you delete the DLL and registry entry it will reinstall. It may only be removed completely in safe mode. Hijack this can help. But NewDot is not done with you yet! They insist that their hidden-install-forced-download-impossible-to-remove-browser-hijack is not "spyware" but simply a new type of marketing and they will sue you if you say that it is "spyware"(some call it "Foistware"). They have even filed a lawsuit against the Internet Corporation For Assigned Names and Numbers for discussing NewDot's business practices.

Letter to ICANN from NewDot
ICANN Response to NewDot


NewDot Sues Lavasoft (LavaSoft is a recommended PC security tool)


Here is a case of someone from NewDot going into a spyware discussion blog a telling users that NewDot is not spyware(see post #3): pcreview.co.uk

NewDot has a large amount of information on the subject at their site, but since we cannot guarantee that the site is safe we will not link to it directly.

Removal and Information
Removal Discussion Thread
spywaredata.com
cexx.org
cnet.com
Analyze your PC for threats
Lavasoft suit(pdf)




MIRAR

Have you noticed an additional toolbar on your Browser called MIRAR? If so you have a spyware virus on your PC. The "uninstall" link for MIRAR actually links to their website and phony form that requests personal information that has nothing to with uninstalling the program. Never fill forms like this out.

The purpose here is to a) deter people from uninstalling the spyware or b) gather more personal information.

The following sites are associated with this spyaware:
mirarsearch.com
getnirar.com
net-nucleus.com
mt-download.com
adservs.com
findthewebsiteyouneed.com

Removal
http://www.spyany.com/program/article_spw_rm_Mirar.html
http://www.nuker.com/container/details/mirar_toolbar.php



Fake Spyware Scans

You may have had a pop-up window like the one below:

Do not click on the links in this window. These advertised scans are often launched by viruses or spyware that have already infected your PC. Downloading the software will "fix" the virus problem and in turn expose you to more spyware and viruses. Some companies have infected PCs with spyware and then billed users to have them removed. The above pop-up links to web-update.org and scanandrepair.com. They are listed as "Rogue/Suspect Anti-Spyware Products & Web Sites" by spywarewarrior.com. Read more.

oneclicksearches.com and psguard.com

oneclicksearches.com and psguard.com use Trojan.ByteVerify and variants to infect your PC.


What do oneclicksearches.com and psguard.com do to you?
  • Sets default homepage to: oneclicksearches.com
  • Turns on Active Desktop and defaults the page to %SystemRoot%\system32\\wppp.html which is psguard.com
  • Installs these programs in c:\winnt\system32\
    down1.exe
    hhk.dll
    hpF443.tmp
    intell32.exe
    intmon.exe
    msmsgs.exe
    oleext32.dll
    shnlog.exe
    uninstIU.exe
    wppp.html
  • Sets up a fake "Virus Alert" in your task bar. Clicking on the "alert" brings you to psguard.com where they try to sell you anti-spyware software.
  • The oneclicksearches.com home page uses hijacked microsoft.com icons so the site looks like a Windows security page.
  • Sets hundreds, possibly thousands of registry keys pointing to oneclicksearches.com

What you can do about it
  1. If you don't already have anti-virus software, get some. If you do have it, update the definitions lists. There are free anti-virus packages available from symantec and mcafee. Download stinger.exe.
  2. Disconnect from the Internet/Network
  3. Reboot in Safe Mode with Network support(reboot and hold F8)
  4. Run the anti-virus software in Safe Mode
  5. Disable Active Desktop(Control Panel, Folder Options)
  6. Do a search for the files listed above and delete them
  7. Open the Registry editor(Start, Run, regedit) and do a search for all keys with "oneclicksearches.com" and delete them. Do the same for "wppp.html" and "psguard.com"
  8. If you know approximately when you got the virus, do a search on your PC for any file created since that time. More than likely you will see recently created EXEs in the system32 folder. Rename these files rather than delete them just in case they are not part of the virus.
  9. Open a browser(while stil off-line!) and delete all cookies, cache, temp files, bookmarks that were added by the virus and change your home page back to what it was.
  10. Reboot your PC and test to see if the viruses are gone
  11. oneclicksearches.com psguard.com are registered through ESTDOMAINS, file a complaint with estdomains.com.
  12. Email the admins for oneclicksearches.com psguard.com at dep@sexpicsporn.com and psguard@ua.fm and tell them how disgusted you are with their tactics.
  13. File a complaint with the BBB
  14. File a complaint with FTC



Gator/GAIN

One of the earliest and most well-known examples. Often comes bundled with downloaded freeware or shareware like KaZaA, weatherbug, Napster, and the like. Gator launches adds and redirects your searches to their selected products. Having Gator installed will expose you to other types of spyware.

Removal: In Gator's case you may be able to remove it through Add/Remove Software in the Control Panel. To be sure find and delete the following files:
iegator.dll
fsg.exe
fsg-ag.exe
GMT.exe
Do a Registry search for it also and delete the keys in ...\Current Version\Run and ...\Current Version\RunOnce




Xupiter

An example of Brower Hijacking is the Xupiter toolbar. Keeps resetting your homepage to Xupiter.com, adds a toolbar and launches popups. Use these instructions: pchell.com to remove it, then send an email to help@xupiter.com, support@xupiter.com, and dnsadmin@tucows.com telling them you do not like their spyware advertising tactics.




fastsearch.cc

What a pain this one is. Sets registry keys for startup pages to
http://%69%6e%2e%77%65%62%63%6f%75%6e%74%65%72%2e%63%63/%2d%2d/?%79%64%74%66%73.
Why? The % followed by numbers and letters are hexidecimal numbers. %69 = i, %6e = n, etc. The entire string decoded is: in.webcounter.cc/--/?ydtfs, this page redirects your browser to fastsearch.cc(.cc is Cocos Islands). The reasons: for one, you cannot put the % in your web blocking list. Then, your browser keeps resolving to fastsearch.cc, but if you search your harddrive, cache and registry "fastsearch.cc" wont come up. This is called obfuscation.

This was apparently caused by CWS.Tapicfg a variant of the CoolWebSearch. It's named so because CoolWebSearch.com was one of the first ones to use it.

SpyBot, spywareblaster, and HijackThis did not clean it out but CWShredder did get it.

After you have cleaned out webcounter.cc or fastsearch.cc send and email to:
Helen Bauer - webmaster@fastsearch.cc and Katsuji Yoneyama - webmaster@webcounter.cc expressing your disgust at their advertising tactics.

To reduce the risk of spywear infection, load Spyware Blaster which will block specific spyware packages and also increase the security on your browser settings, specifically blocking or prompting for stylesheet downloads.



More Info:
Anti-spyware guidelines get final version(msn-cnet.com 01/12/2006)
Information Kit: Spyware
Whatis.com
spychecker.com
cexx.org
grc.com
spywareinfo.com
Spyware forum

BotNets and Zombies

What is a Botnet? It is a network of hijacked machines connected to the Internet. The machines often become infected by specially designed virus programs( malware) or have some other security exploit(hack). These hijacked/infected are referred to as "zombies", so a zombie is a node on a Botnet. Also called Drone Armies.

Botnets can be used for many different tasks: sending spam, spreading viruses, hosting phishing sites, launching Denial of Service Attacks, and as platforms for network intrusions. In days gone by, computer time and computer storage space were expensive and hard to come by. It was common for hackers to "steal" processor time or disk space. However, now computers are cheap and easy to get, botnets generally have much more sinister applications.

Most real spam likely comes from infected PCs. This is why email header tracing has become an ineffective method for fighting spam. Following the path an email has traveled will only lead you to a victim's PC. Not only that, it is a crap-shoot when it comes to ISP response. We have documented cases where it has taken weeks of constant reporting and complaints for an ISP to shutdown an infected PC. In the meantime, the infected PCs have sent out millions of junk emails.

Because the Internet grows every day and because of the lack of standards and user knowledge, the threat of botnets will continue to increase. The problem has also expanded because cheap high-speed connections mean users leave their home PCs on and connected for extended and unsupervised periods.


For home users we always recommend:
  1. Shutting off your DSL/Cable Modem when not in use
  2. Recycling your modem regularly, this means powering it down or unplugging it to refresh the IP
  3. Keeping OS security updates current
  4. Running updated virus scans after Internet use(And run these in safe or command line mode occasionally)

For corporate users we always recommend:
  1. Having an independently certified security audit
  2. Dedicated network security staff
  3. Running regular network-wide virus scans
  4. Documented policies and procedures for handling intrusions and methods for informing the public/customers/shareholders

To take action educate yourself with the articles below and check out the Independent System Operator Task Force (isotf.org). They issue alerts, reports and have an interface for reporting Botnets. You can see in their reports that it is common for an ISP to have hundreds of intrusions per month and many have huge percentages of cases that go unresolved for extended periods.

Recent (02.14.07)
A virus has been spreading recently that was specifically designed to launch a denial of service attack against anti-spam websites. So far CastleCops has been one of the biggest victims but spamhaus and SpamCop have also been targeted. This tactic is not new, similar event in 2003 with the Mimail worm ,but it is becoming more severe.
Storm Worm DDoS Attack (secureworks.com)
Botnet with reference to SANS (isc.sans.org)
Imperfect Storm aids spammers (securityfocus.com)
Articles
Fraudsters Declare War on Anti-Scam Services(computerworld.com.au)
Software vulnerabilities spiked 39 percent in 2006(computerworld.com.au)
Malware Attacks Getting Much Worse (crm-daily.com)
Internet guru warns of botnet pandemic(zdnet.co.uk)
Net pioneer predicts overwhelming botnet surge(zdnetindia.com)
What Is A Bot? (netsecurity.about.com)
Is your computer part of a criminal network? (theglobeandmail.com)
Are hackers using your PC to spew spam and steal? (usatoday.com)
What good are 1,000 remote-controlled PCs? (cnet.com)
Is your computer a “zombie”? You could lose your email access if it is! (crt.net.au)
THE CASE OF THE “ZOMBIE KING” (fbi.gov)
Quicky Analysis of a Proxy/Zombie Network (lowkeysoft.com)

software

Software Junk

What is it?

Unwanted email advertising ridiculously low prices for name brand software products.

Why is it a problem?

The advertised items are more than likely pirated versions of the software.

How would it effect me?

This is a list of issues people have experienced when buying software like this:

  • Software arrives on obviously pirated CDs and not in the "cereal box" container
  • The delivered product is not the advertised version. Example: Full Professional version is advertised but a limited version is delivered.
  • The software wont load. Reasons could be that your computer devices recognize that the disks are not authorized versions because of advanced pirating security tools or that this disks simply contain errors because they were not copied properly.
  • The software will not function with other legal components installed on your computer.
  • Companies using pirated sotware may be fined.
  • Customers who experience a problem find it impossible to get support, return the product, or obtain a refund.
  • Pirate software may contain malware
Samples

View Samples

What can be done?

  • Send the junk mail to swpiracy@coldrain.net
  • Don't buy products from junk mailers
  • Find discounts from true software discounters
  • If you truly cannot afford expensive name brand software consider open source options

  • Samples





    Counterfeit goods

    Counterfeit Goods

    What is it?

    Most often advertising "replica" name-brand watches but nearly every consumer good has been noted from electronics to clothing to jewelry. There is a non-junk mail component to the counterfeiting world that involves fake credit cards, currency, checks and other negotiable items.

    Why is it a problem?

    Counterfeits are usually produced by organized criminal groups. Purchases of these goods can fund other criminal activities down the line like narcotics, human smuggling, weapons sales and terrorism. Fake products are often manufactured in "sweatshop" or slavery-like conditions, including child labor and possibly prison labor. Some fake products have been known to explode or poison users. Global illicit traffic is now a $600 Billion industry, representing 7-9% of all global trade, a considerable increase from previous decades. This increase is being partially driven by the growth in Internet commerce and electronic fraud.

    How would it effect me?

    Trying to get a refund, replacement or any kind of customer service for one of these items is impossible. If the items are stolen rather than faux the purchaser is part of the crime. People may cynically think: "Who cares? Fendi and Louis Viton over-charge for handbags, I'm not hurting anyone by buying a knock-off." Wrong. "It’s cheap for a reason. It’s cheap because it’s probably been made by someone who’s exploited, indentured servant or even child labor..." (tillekeandgibbins.com/Publications/pdf/dark_underbelly_counterfeit_handbags.pdf). If you are concerned about the quality and lifespan of a product it just isn't there with counterfeit goods.

    Scope of Global IP Piracy and Counterfeiting Problem (ogc.doc.gov)

    Samples

    Cases
    View Samples

    What can be done?

    Send the junk mail to fake@coldrain.net


    Resources and Information

    General
    Counterfeit Gourmet Crabs(and tracking systems) (cs.virginia.edu)
    Fake Disney Park in China (cnn.com)
    Counterfeit Super Bowl tickets will surface, buyer beware (trb.com)
    Despite security, fake Super Bowl tickets persist (abcactionnews.com)
    Counterfeit Disney Dollars (mouseplanet.com)
    Wartime Counterfeit Postage (psywar.org)
    Road Atlas "copyright traps" (straightdope.com)
    Counterfeit Subway Tokens (fbi.gov)
    Pirates and bootleggers beware (direct.gov.uk)
    Product Counterfeits Can Be Dangerous, Deadly (wnbc.com)
    The cost of piracy to UK businesses amounts to over GBP 10 billion according to the Alliance Against Counterfeiting and Piracy. (manufacturingtalk.com)
    Bayh bill protects intellectual property (fortwayne.com)
    Counterfeit Drugs: Coming to a Pharmacy Near You (acsh.org)
    Counterfeit Capsules and Phony Pills (acsh.org)
    SWITZERLAND: Global food industry unites against counterfeiting (just-food.com)
    South-east Asia awash with fake drugs (guardian.co.uk)
    Federal Industry Committee's Call For Action On Counterfeiting and Piracy Welcomed By Canadian Anti-Counterfeiting Network (cnw.ca)
    ALLDATA wins case against pirating and counterfeiting of registered trademark by Long Beach-based business computers, networks and software distributor (abrn.com)
    Survey: More Enforcement Will Stop Counterfeiting (chinacsr.com)
    Police Seize Suspected Counterfeit Clothing At Valley Mall Store (rocktownweekly.com)
    Global congress calls for greater effort, resources in combating counterfeiting & piracy (themanufacturer.com)
    Flood Of Knockoffs Triggers Wide Crackdown (cbsnews.com)
    Customs Dept. to Observe Week from January 21-27 (jis.gov.jm)
    Knocking out China's knock-offs (atimes.com)
    Miami Man Arrested for Counterfeiting Prescription Drug Labels (allamericanpatriots.com)
    Nine arrested in counterfeiting raid (thisisthenortheast.co.uk)
    OSU 'Gets Real' about fakes (thelantern.com)
    Nations join forces to check counterfeit boom (swissinfo.org)
    Global Industry Leaders Cite Survey In Quest For A Counterfeit/Piracy-Free World (ip-watch.org)
    New Survey Finds Counterfeit Products Cost Global Economy Billions (chosun.com)

    Drugs
    Prescription Drugs (knujon.com)

    Electronics
    Man badly burned when cell phone in pocket flares (sfgate.com)
    Hazardous Counterfeit Products: Exploding Electronics (cbsnews.com)
    Counterfeit Electronics (csus.edu)
    "Parts Is Parts, Right?" (ccnmag.com)
    Electronic manufacturing and consumers confront a rising tide of counterfeit electronics (ieee.org)
    The billion dollar problem (my-esm.com)
    Counterfeit Electronics as a Terrorist Tool (schneier.com)
    Counterfeit Wave Rises In The East (edn.com)
    Counterfeit Electronics Are An Increasing Problem (kdka.com)

    Handbags
    Counterfeit Bags May Have Links To Organized Crime, Terrorism (themilwaukeechannel.com)
    Getting real about fake designer goods (bankrate.com)
    How buying fake designer handbags can harm you and impact on our economy. (henriettashandbags.com)
    U.S. Customs and Border Protection Intercepts Counterfeit Handbags Worth Over $2 Million (cbp.gov)
    Fake Designer Bags in New York City, part 3 (littleviews.com)
    The Dark Underbelly Of Counterfeit Handbags (tillekeandgibbins.com)
    Fake Designer Handbags - How To Spot a Counterfeit Purse (chinatownconnection.com)

    Watches
    What are counterfeit watches and how to avoid getting burned buying a watch that was not the real thing (chronocentric.com)
    Rolex or Replica?? Don't get E-Screwed!! (qualitytyme.net)
    The watch industry against the counterfeit scourge (fhs.ch)
    RFID takes on the counterfeit watch (zdnet.com)
    As luxury industry goes global, knockoffs follow (post-gazette.com)
    WHAT IS A COUNTERFEIT WATCH OR CLOCK? (jcwa.or.jp)
    UNDERCOVER OPERATION NABS HUNDREDS OF COUNTERFEIT WATCHES (sheriff.org)
    The Rolex Report: An Unauthorized Reference Book For The Rolex Enthusiast (amazon.com)

    Bateries
    Health Canada warns Canadians about unsafe counterfeit household batteries (hc-sc.gc.ca)
    Consumer Alert Regarding Counterfeit KODAK Batteries (kodak.com)
    examples of counterfeit batteries (nokiamea.com)
    Counterfeit Batteries Market (havocscope.com)
    WARNINGS: Counterfeit Lithium-Ion Battery (canon-europe.com)
    Counterfeit Equipment Lurks (wirelessweek.com)
    Counterfeit Batteries Discovered in Tianjin (customs.gov.cn)
    Nokia Investigates Exploding Cell Phones (pcworld.com)
    IC Provides Battery Authentication (powerelectronics.com)

    Money
    "KNOW YOUR MONEY" (secretservice.gov)
    Spotting Counterfeit Currency (frbatlanta.org)
    Counterfeit Detection (indigoimage.com)
    How Counterfeiting Works (money.howstuffworks.com)
    Counterfeiting Prevention - Canada (bankofcanada.ca)
    How to spot the fake - and what to do if any slips through (bcentral.co.uk)
    False-paper trail leads to North Korea. (digg.com)
    Iran, Syria Accused of Counterfeiting US Dollars (fas.org)
    Canada among worst for counterfeit money (cbc.ca)
    Police shut down counterfeit money operation in Colombia (newsfromrussia.com)
    Counterfeit Money and Financial Instruments (nytimes.com)
    HOMELAND SECURITY AGENTS SEIZE "BILLION DOLLAR" BOGUS FEDERAL RESERVE NOTES (ice.gov)
    Hot on the Trail of Funny Money (scvhistory.com/)

    Checks
    National Check Fraud Center (ckfraud.org)
    Results of "Operation Cyber Sweep" (crime.about.com)
    Check Fraud Manual (frbservices.org)
    Counterfeit Cashier's Checks (1stsource.com)
    Public Advisory: Special Report on Counterfeit Checks and Money Orders - Canada (usdoj.gov)
    Counterfeit Check Scams (lookstoogoodtobetrue.com)
    Scam Involving Counterfeit Official Checks (fdic.gov)
    Alerts published by the Division of Banks. (dfi.wa.gov)
    check fraud a guide to avoiding losses (occ.treas.gov)
    Cyber Sweep (ic3.gov)
    Foreign Check Counterfeiters Active in Idaho (state.id.us)
    BBB WARNS CONSUMERS ABOUT FAKE CHECK SCHEMES (bbbvideo.com)

    Credit Cards
    On the dark side of credit card fraud (bankrate.com)
    Can you spot a counterfeit credit card? (aipb.org)
    Counterfeiting and Credit Card Fraud - Canada (rcmp-grc.gc.ca)
    Plastic Payments: Trends In Credit Card Fraud (fbi.gov)
    counterfeit credit cards (secretservice.gov)
    Counterfeit credit card gangs on rise - Australia (theage.com.au)
    Catching counterfeit credit cards (cnn.com)
    Keeping Up With Credit Card Fraud (morebusiness.com)
    What is Visa doing to help prevent counterfeit fraud (visa.ca)
    Getting a Handle on Debit and Credit Cards (frbsf.org)
    The Internet Crime Complaint Center (ic3.gov)
    Nearly 2,000 fake credit cards seized from Chinese ship (findarticles.com)



    Cars and Car Parts
    The Hazards of Counterfeit Automobile Parts (ezinearticles.com)
    China is a leading source of counterfeit automotive parts production (uspto.gov)
    US: Parts makers welcome IPR enforcement plan (just-auto.com)
    MEMA Steps Into the Counterfeit Fight (autoserviceworld.com)
    ABRO Chief Testifies at Counterfeiting Subcommittee (autoserviceworld.com)


    Samples and Cases







    Vacations and Travel Scams

    Vacation Junk

    What is it?

    Usually through fax, rarely through email. Absurdly cheap vacation packages. More...

    Why is it a problem?

    Thousands have been taken by these scams, often the elderly. Internet travel deals are common these days and the scam artists ride the wave. "Americans lose more than $12 billion a year on travel-related scams" - AARP. More...

    How would it effect me?

    Customers who purchased these packages have experienced various problems from bad vacations to no vacations. More...

    Samples

    View Samples

    What can be done?

    If you believe you have been scammed: Cancel the purchase if possible; get your credit card company to issue a charge-back; Contact the Attorney General in your state and the state where the company is located; File a complaint with the FTC;

    If you receive a junk vacation advertisement via fax or email: send it to us at nonregistered@coldrain.net and the FTC
    More...


    Vacation Junk

    The Internet is full of fantastic deals for airfare, hotels, car rentals and even whole vacations. This has opened the door to fraud and deception. The success of LowestFare, Priceline, Hotwire, Expedia, and Orbitz has generated many other travel services that may or may not be legitimate. There are a few simple rules for picking one of these Internet deals:

    • Don't buy travel services from spam or fax junk advertisers
    • Read refund/return/cancellation policies carefully. If they don't have one published, don't buy from them!
    • If it's too good to be true, it probably is. Internet travel sites can sell at low prices because they buy bulk fares in advance knowing that airlines/hotels can't sell everything on their own and they make money on the margins. It's somewhat of a gamble but everyone wins: you get cheap tickets, the service gets fee profit and the airlines/hotels fill quotas. The "other" travel services are a little different. They often offer absurdly low prices before securing any services and hide fees on the back end you will be responsible for.
    • When in doubt, check them out. If they are a legitimate company, there will be reviews and documentation. Check with tripadvisor.com and the Better Business Bureau to see if they are legit and/or have any unresolved customer complaints(every company has complaints, the question is do they fix them? and what are the kind and how many complaints?). If there is no history at all, they may be fake.

    What are some things that have happened to folks who use less-than-reputable travel services?
    • Customers pay for a trip and don't get anything. When they try and get a refund of some kind of service, the company has disappeared.
    • The company sends tickets or vouchers but the airline/hotel does not honor them.
    • Customers are charged extra(and often large) fees when presenting vouchers.
    • One fare is promised but a different one is charged.
    • The company agrees to a schedule but the dates are then changed by the company.
    • Customers are promised a specific airline/hotel but different services appear on the voucher(s).

    Let's take a look at 2 services someone told us they had trouble with: CHEAPTICKETSCANCUN.COM and TRAVELCOMM.COM. Everything seemed fine at first until they discovered some fees that were not documented previously. They called CHEAPTICKETSCANCUN.COM to resolve the matter and claimed that they were put on hold indefinitely, spoken to rudely, hung up on, etc. They haven't actually taken the trip yet but they are worried. This could have all been avoided by looking at the history of these companies before making a purchase.

    In the example of CHEAPTICKETSCANCUN.COM there is no physical address of the company listed on their website, just a phone number. Compare this to Expedia.com who list their mailing address clearly in the site's legal info. So then where is CHEAPTICKETSCANCUN.COM registered you may ask? They are registered in Arizona through a anonymous proxy service, but the company is not in Arizona. The company is registered in Florida, but not under the name CHEAPTICKETSCANCUN.COM. The real company name is: Mexico Vacations, TC Lakehurst Orlando, FL 32802. In checking review sites it is easy to find that tripadvisor.co.uk has a review of them and it's not pretty.

    On to TRAVELCOMM.COM. A review of a BBB report shows that TRAVELCOMM.COM has had over 300 complaints in the last 36 months, about 10 complaints per month. Of these complaints 92 are unresolved at this time. This means you have a 30% chance of being ignored if you have a problem with them. In addition TRAVELCOMM.COM has been issued citations(and not the good kind!) by the FCC and FTC for sending unsolicited advertising. Still haven't made up your mind? Read this review(ripoffreport.com).

    Knowing this ahead of time, would you have purchased a vacation through them?
    Resources
    Schemes, Scams, Frauds. (crimes-of-persuasion.com)
    The Free Vacation Scam (usps.com)
    Travel Scams (thinkglink.com)
    Telemarketing Travel Fraud (ftc.gov)
    Vacation Scams - How to Spot Them (ezinearticles.com)
    DON'T GET TAKEN BY TRAVEL AND VACATION SCAMS (aces.edu)
    Scam Alert: Dream Vacation Adrift (aarp.org)
    10 Vacation Rental Scams to Avoid (coastrentals.com)
    Don't Get Burned By Hot Travel Deals (bbb.org)
    FTC Halts Vacation Scam; "Dream Vacations" Were a Nightmare, Agency Charges (ftc.gov)

    Samples

    Prescriptions

    Prescription Drugs

    What is it?

    Unwanted email selling prescription drugs, supplements or other controlled substances. Most often diet supplements and ED drugs(Erectile Dysfunction): Viagra, Cialis, etc. However, many other counterfeit and substandard prescription drugs are being pushed over the web. The emails are often worded to play on the fears and insecurities of men in the bedroom and/or the high price prescription drugs for seniors.

    "Rx" is an ancient symbol the meaning and origin of which is disputed but it now means "prescription." Green crosses are used in some countries denote pharmacies and often the word "Apothecary" instead of "Drugs" or "Pharmacy". More...

    Why is it a problem?

    Prescription drugs are expensive, controversial and dangerous even if you obtain them legally. Prescription drugs are complex chemicals that alter your body functions. Like many scams this targets the elderly, who are less likely to report the crime and more likely to suffer adverse effects from the toxins. There are, of course, completely legitimate on-line pharmacies like drugstore.com. Politics Alert!. Pharmaceuticals are a hot button topic in the United States(and probably elsewhere) as the population of baby-boomers feeds into the middle age bracket. Many seniors are going to Canada and Mexico to purchase cheaper versions of expensive drugs. This has resulted in accusations that pharmacies in these countries are selling lower standard versions of the drugs and polluting the U.S. supply. This has lead to counter-accusations by America's neighbors that the U.S. trying to scare people out of buying over the border. The issue is very confusing, but keep in mind that just because a website advertises cheaper Canadian drugs, it does not mean they are licensed pharmacy. If you buy prescription drugs from a licensed Canadian pharmacy it should be fine. If you buy from a random website, you are playing games with your health.

    Aside from counterfeit prescriptions many of these sites sell items that are pure snake oil. Mystery weight loss supplements, sexual enhancers, and steroids. These pills are in the same category as X-Ray Glasses.

    Beyond junk email counterfeit drugs are also a serious problem for international aid organizations. More...

    How would it affect me?

    Because the junk mail versions of prescription drugs are not the real thing they often contain substitutes or fillers that can be harmful to your body, especially to your liver and kidneys. For those not familiar with anatomy these organs have vital functions like cleaning the blood and processing sugar, damaging them is very serious. Fake prescription drugs have been found to contain high levels of chemicals that are considered poisons in high doses. More...

    Samples

    Read about mantipu.com in "The Worst"

    View Samples

    What can be done?


    Resources
    Buying Medicines and Medical Products Online (fda.gov)
    Counterfeit Drugs (fda.gov)
    FDA Warns Consumers Not to Buy or Use Prescription Drugs from Various Canadian Websites that Apparently Sell Counterfeit Products (fda.gov)
    Consumer Education: Counterfeit Medicine (fda.gov)
    Counterfeit Alert Network (fda.gov)
    Counterfeit and substandard medicines (who.int)
    EU report on pharmaceuticals - May, 2006 (europa.eu)
    Boards of Pharmacy Against Counterfeit Drugs (dangerouspill.com)
    Pharmaceutical Security Institute (psi-inc.org)
    The National Association of Boards of Pharmacy (nabp.net)
    safemedicines.org (safemedicines.org)
    buysafedrugs.info (buysafedrugs.info)

    Targeting Phony Pharmaceuticals (cbsnews.com)
    Chinese anti-malarial drug producer battling against fake drugs (people.com.cn)
    Nigeria leads fight against “killer” counterfeit drugs (who.int)
    Murder by fake drugs - Time for international action (bmj.com)
    China's battle with fake drugs (rsc.org)
    Estimates on Counterfeit Drugs - 2006 (dangerouspill.com)
    Fake prescription drugs warning (bbc.co.uk)
    Lethal flood of fake prescription drugs (scotsman.com)
    Fake drug sales ‘could nearly double by 2010’ (in-pharmatechnologist.com)
    Concerns about Illegal Online Pharmacies (drugstore.com)
    Still have questions? We have Answers: Q & A on Counterfeit Products (bms.com)
    Fake drugs costing lives (news.bbc.co.uk)
    Millions head south of the border for cheap drugs. But is it safe? (aarpmagazine.org)
    Poison pills (washtimes.com)
    The Poison Pill (mac.com/wrenbeck/blogwavestudio)
    Is it Safe to Buy Medicines Online? (poison.org)
    Counterfeit Drugs: A Rising Public Health Problem (webmd.com)
    Fake online pharmacies (scamwatch.gov.au)
    Fake drug sales ‘could nearly double by 2010’ (in-pharmatechnologist.com)
    Prescription for Fake Viagra Pharmacy: 20 Years in Prison (theinternetpatrol.com)
    The hidden dangers of on-line drugs (buysafedrugs.info)
    U.S. Customs Officers Stop Seizing Mailed Prescription Drugs Purchased From Canada (medicalnewstoday.com)
    Microsoft and Pfizer Fight Fake Viagra Spammers (buzzle.com)
    FDA claims progress in battle against fake drugs (in-pharmatechnologist.com)
    Poison control: Fake drugs are a health hazard (prn2.usm.my)
    The World Health Organization and its international partners are cracking down on bogus medicines (transworldnews.com)
    Teens using medicines to get high, U-M expert warns (med.umich.edu)
    Is this drug for real? (pharmatimes.com)
    Fake medicines from India seized in Europe (medindia.net)

    Samples


    Some samples may contain coarse or vulgar language

    Image Only Rx Junk

    Recently some of you may have noticed an increase in image-only(no html, url links or text) drug junk. We see this as progress and a reaction to efforts by services like KnujOn. There are those who see this as a threat, but don't worry, it's a minor issue and KnujOn already has a pre-process for this type that is applied before putting it through the core engine. Most of the sites advertised have pending actions against them.







    Common Samples
    Read about
    mantipu.com in "The Worst"









    Fake loans and mortgaes

    Mortgage and Loan Scams

    What is it?

    Unwanted email and faxes advertising impossibly low rate mortgages or loans.

    Why is it a problem?

    The housing market in the United States has been booming and is now slowing. This sort of up and down means significant amounts of money are changing hands. Scammers are posing as agents and banks to obtain personal information, steal people's money and even their houses. The targets are often elderly homeowners looking to make some extra cash by refinancing or taking out an equity line. Also, many individuals are buying and selling property without agents to save money(FSBO) Acording to the FBI there were 21,971 mortgage fraud cases in 2005 totalling over $1 billion in losses, this up from fewer than 600 in 2004 and even less in 2003. It is running "rampant" according to sources. Some of the hot spots are Michigan and Florida.

    How would it effect me?

    Mortgage transactions are complex legal and financial agreements. If you are not knowledgeable about them predators can take your money and even property.

    Samples

    View Samples
    Cases

    What can be done?

    • Send the junk mail to us
    • Read Freddie Mac's "Don't Borrow Trouble" before even thinking of getting a loan
    • Don't do business with junk mailers and faxers
    • Use this form(fdic.gov) to check and see if is truly an FDIC insured institution(United States)
    • Authorized lenders are required to disclose license information. If it's not there, they are not a real bank.
      Check with your state licensing boards to see if they are for real (CT, FL, CA, NY, MI, VA ).
    • Always have a real-estate professional and/or lawyer review any transaction
    • Check with a service like realtor.org to see if an agent is legitimate. Contact


    Resources

    Help Your Clients Understand How To Avoid Predatory Lending (realtor.org)
    House approves bill to strengthen rules on mortgage lenders (cnn.com)
    FDIC Bank Find (fdic.gov)
    HUD FHEO (hud.gov)
    How do I report fraud related to a HUD/FHA transaction? (hud.gov)
    Town's Residents Say They Were Targets of Big Mortgage Fraud (wsj.com)
    Governor signs bill to halt reverse mortgage scams (findarticles.com)
    Federal Reserve Board Consumer Information (federalreserve.gov)
    mortgagefraudblog.com
    stopmortgagefraud.com
    FINANCIAL CRIMES REPORT TO THE PUBLIC (fbi.gov)
    mortgagefraud.org
    Mortgage Fraud Recovery (mortgagefraud.com)
    Field Guide to Mortgage Fraud (realtor.org)
    Don't Be A Victim Of Loan Fraud (pueblo.gsa.gov)
    HUD - Don't Be A Victim of Loan Fraud (hud.gov)
    Mortgage fraud can no longer be ignored by officials (chicagotribune.com)
    Featured Articles~The Many Faces of Mortgage Fraud (mortgageoriginator.com)
    Find a HUD Approved Housing Counseling Agency (hud.gov)
    FBI Vows to Crack Down on Mortgage Fraud (washingtonpost.com)
    Mortgage fraud soars (detnews.com)

    Cases

    ui726.com


    This is a junk mail message(with an obfuscated URL no less) that leads to the following site:

    There is no address, phone number, FDIC or Equal Housing Lender information, or even the name of the institution. Just this fake rate-checking form. Compare this with a site like ditech.com which discloses their state licenses clearly on rate checking forms.

    Samples





    Faxes




    Dear HomeOwner,
    
    Your credit doesn't matter to us! If you OWN real estate
    and want IMMEDIATE cash to spend ANY way you like, or simply wish
    to LOWER your monthly payments by a third or more, here are the deals
    we have TODAY (hurry, these offers will expire TONIGHT) :
    Low as
    
    $452,000.00 at a 3.75,% fixed-rate
    $363,000.00 at a 3.51,% variable-rate
    $459,000.00 at a 3.83,% interest-only
    $252,000.00 at a 3.78,% fixed-rate
    $159,000.00 at a 3.31,% variable-rate
    
    Hurry, when these deals are gone, they are gone!
    Simply fill out this one-minute form..
    
    Don't worry about approval, your credit will not disqualify you!
    
    http://confrere
    
    
    
    
    
    
    
    
    
    Dear Home Owner,
    
    Your credit doesn't matter to us! If you OWN real estate
    and want IMMEDIATE cash to spend ANY way you like, or simply wish
    to LOWER your monthly payments by a third or more, here are the deals
    we have TODAY (hurry, these offers will expire TONIGHT) :
    Low as
    $401,000.00 at a 3.22,% fixed-rate
    $391,000.00 at a 3.62,% variable-rate
    $418,000.00 at a 3.63,% interest-only
    $221,000.00 at a 3.76,% fixed-rate
    $184,000.00 at a 3.02,% variable-rate
    
    Hurry, when these deals are gone, they are gone!
    Simply fill out this one-minute form...
    
    Don't worry about approval, your credit will not disqualify you!
    
    Sincerely,
    Emmit Reidelberger
    Approval Manager
    
    
    

    Diploma Mills

    Degrees

    What is it?

    More...

    Why is it a problem?

    More...

    How would it affect me?

    More...

    Samples

    View Samples

    What can be done?

    Resources

    Samples


    Have you ever imagined that the main thing stopping you from a great job and
    better wage was a few letters behind your name and surname? 
    
    Oh well now you can get them!
    
    PhD BA BSc MA MSc MBA
    
    Within 2 weeks! No Lessons Needed! 100% Verifiable!
    
    These are real, genuine qualifications that include Bachelors, Masters and
    Doctorate degrees.
    
    Those are 100% verifiable and student records and transcripts are available
    as well. 
    
    This little secret has been kept quiet for such a long time.  The
    opportunityis existant due to a legal loophole allowing some established
    colleges to award qualifications at their discretion.
    
    Obtain yours today.  Just call the number below.  You will thank me later.
    
    +ONE - 8 3 1 - THREE ZERO ZERO - DOUBLE 6 FOUR 3
    

    Better degree - better pay
    Academic Qualifications available from prestigious NON-ACC REDITED uni
    versities.
    
    Do y ou have the knowledge and the experience bu t lack the qualifications?
    
    Are you getting turned dow n time and time again for the job of your 
    dreams because you j ust don't have the rig ht letters after your name?
    
    Get the prestige that you deserve  today!
    
    Move ahead in your career today!
    
    Bache lors, M asters and PhD' s available  in your field!
    
    No examinations! No classes! No textbooks!
    
    Call to register and receive your qual ifications within days!
    
    24 hours a day 7 days a week!
    
    Confidentiality assured!
    
    Please call:
     1-206-600-68 25  
    Calls returned promptly
    
    
    The eyes are the window of the soul A fair exchange is no robbery. 
    You have to understand, somethings you will never understand  Penny wise, 
    pound foolish All things come to those who wait Dah mouth dat man tek fuh court woman, 
    ah de same mouth he ah tek an put she ah door. A fly will not get into a closed mouth. 
    Patience is bitter, but it bears sweet fruit  Nah every big head get sense.
    

    Better degree - better pay
    Academic Qualifications available from prestigious NON-ACC REDITED uni
    versities.
    
    Do y ou have the knowledge and the experience bu t lack the qualifications?
    
    Are you getting turned dow n time and time again for the job of your dreams 
    because you j ust don't have the rig ht letters after your name?
    
    Get the prestige that you deserve  today!
    
    Move ahead in your career today!
    
    Bache lors, M asters and PhD' s available  in your field!
    
    No examinations! No classes! No textbooks!
    
    Call to register and receive your qual ifications within days!
    
    24 hours a day 7 days a week!
    
    Confidentiality assured!
    
    Please call:
     1-206-600-68 25  
    Calls returned promptly
    
    
    The eyes are the window of the soul A fair exchange is no robbery. You have to understand, 
    somethings you will never understand  Penny wise, pound foolish All things come to those who 
    wait Dah mouth dat man tek fuh court woman, ah de same mouth he ah tek an put she ah door. A 
    fly will not get into a closed mouth. Patience is bitter, 
    but it bears sweet fruit  Nah every big head get sense.
    


    Get your university diploma
    
    Do you want a prosperous future,
    increased earning power
    more money and the respect of all?
    
    Call this number: +ONE - 8 31 - THREEHUNDREDS - 66 43
    
    There are no required tests, classes, books, or interviews!
    Get a Bachelors, Masters, MBA, and Doctorate (PhD) diploma!
    Receive the benefits and admiration that comes with a diploma!
    
    No one is turned down!
    
    Call today: +ONE - 8 31 - THREEHUNDREDS - 66 43
    
    Confidentiality assured!
    

    University Diplomas
    
    No required tests, classes, books, or interviews.
    
    Please call:
    
    1-206-338-3737
    
    
    fancy-blest pea blight turkey vulture
    gable-walled trolley maker town adjutant
    
    jute butts tool-dresser theft insurance
    sailor-train wages-man pocket print
    poetry-proof quasi judge die chaser
    Ultra-puritan time thrust tired-eyed
    sea lovage scale modulus soft patch
    hot-windy muscle cell induction top
    venerable-looking booster charge goose-pimply
    

    Diplomas Without Exams
    
    A G enuine Unive rsity Deg ree in 4-6 weeks!
    
    Have you ever th ought that the only thing stopp ing 
    you from a great job and better pay was a few 
    letters behind you n ame?
    Well now you can get  them!
    
    BA BSc MA MSc MBA PhD
    
    Within 4-6 weeks!
    No Study Required!
    100% Verifiable!
    
    These are    real, genuine deg rees that 
    include Bache lors, Masters, MBA and Doctorate  Degrees. 
    They are fully verifiable and certified transcripts are also available.
    
    Just call the number below.
    You thank me later
    
    Please call:
     1-20 6-600-6825  
    Calls returned promptly
    
    
    A false balance is abomination to the LORD: but a 
    just weight is his delight. A false witness that speaketh 
    lies, and he that soweth discord among brethren. Artificial 
    intelligence is no match for natural stupidity  A chat has 
    nine lives.. Do as you would be done by A Good Tongue is a Good Weapon. 
    Distance makes the heart grow fonder Life is like a drawing pin - 
    sharp at one end, and flat at the other He travels fastest who travels alone 
    
    

    Masters Based on Working Experience
    Fas t Tr ack De gree Pro gram
    
    Obtain the degr ee you deserve, based on your present knowledge and life
    experience. A prosperous future, money earning power, and the Admiration of all.
    
    De grees from an Established, Prestigi ous, Leading Institution.
    Your de gree will show exactly what you really can do.
    
    Get the Job, Promotion, Business Opportunity and Social Advancement you Desire!
    Eliminates classrooms and traveling.
    
    Achieve your Bac helors, Mas ters, MB A, or Ph D
    in the field of your expertise.
    
    Professional and affordable! Call now - your Gradu ation is a phone call away.
    
    Please call:
     1 -206-600-6825  
    Calls returned promptly
    
    
    If you lie down with dogs you will come up with fleas  He That Brings Good News Knocks 
    Hard To whom God gives, to him also the people give  Live and learn  They Brag Most That
     Can Do the Least One beats the bush, another takes the bird For the commandment is a lamp; 
    and the law is light; and reproofs of instruction are the way of life. The King can make a 
    knight, but not a gentleman 
    

    Masters Based on Working Experience
    Fas t Tr ack De gree Pro gram
    
    Obtain the degr ee you deserve, based on your present knowledge and life
    experience. A prosperous future, money earning power, and the Admiration of all.
    
    De grees from an Established, Prestigi ous, Leading Institution.
    Your de gree will show exactly what you really can do.
    
    Get the Job, Promotion, Business Opportunity and Social Advancement you Desire!
    Eliminates classrooms and traveling.
    
    Achieve your Bac helors, Mas ters, MB A, or Ph D
    in the field of your expertise.
    
    Professional and affordable! Call now - your Gradu ation is a phone call away.
    
    Please call:
     1 -206-600-6825  
    Calls returned promptly
    
    
    If you lie down with dogs you will come up with fleas  He That Brings Good News Knocks Hard 
    To whom God gives, to him also the people give  Live and learn  They Brag Most That Can Do the 
    Least One beats the bush, another takes the bird For the commandment is a lamp; and the law is 
    light; and reproofs of instruction are the way of life. The King can make a knight, but not a gentleman 
    
    

    Hi, mate
    
    University Diplomas
    No required tests, classes, books, or interviews.
    Please call:
    1-206-338-3737
    
    resume fenugreek isotherm contraband furious prune breach cheerleader uttermost craftsperson 
    respire hydrosphere, radio cloture gloat jogging lamellar wastrel conflict sure glisten archaic 
    lobster boil .lome tabulate cowslip taffy thenceforth sternberg impeccable parsonage congratulatory 
    vast! subjectivity mcconnell. peril wound rainbow nichols cordite jelly. bailey vassal petrol inaptitude.
    
    Your Emery
    
    

    Hi, prostate
    
    University Diplomas
    No required tests, classes, books, or interviews.
    Please call:
    1-206-338-3737
    
    eternal jacqueline greenwich hewitt proton nightmare continental piraeus canvass intersperse 
    euridyce pillage, companion proof technetium soccer beginner sofia thrash sudden rome bellatrix 
    wingspan soiree .dreamlike upperclassmen incorruptible attendee quantum howl sandwich argot ulcer 
    codeposit! insurgent parsonage. shamefaced piteous flaunt veridic 
    churchmen penetrable. old friable gloriana lifeguard.
    
    Your Lucia
    

    419/Deposit Scams/"Nigerian"

    Deposit Scams

    What is it?

    They are also called "Nigerian" or "419" scams. They can originate in any country, but because of the large number of cases from Nigeria and the frequent mention of Nigerian banks in the junk mail people use this terminology to describe them. They are called "419" because this is the number of the Nigerian criminal act that was written to combat them. It is important to note that this scam is not particular to the Internet and pre-dates the modern era. Email, however, has become the frequent starting point for them. We generally refer to them as "Deposit" Scams since they often require the victims to deposit money AND/OR promise the transfer of funds into the victim's account.

    The context and scheme vary(thousands upon thousands of variations) but they all have the crux the same scenario. A stranger contacts the victim explaining they need to move a large amount of money but because of some strange legal or political situation they need the victim's help to move it. In return for the victim's assistance the stranger is willing to part with a percentage of the money. The stranger usually asks the victim to pay a tax, fee, bribe or some other charge so the money can be released. Example: Someone emails you explaining that they have $400,000 in an African bank, but the government wont allow them to access it or move it out of the country. If you supply a bribe of $1000 the government will release the money into your account temporarily until the person can come the U.S.(or wherever) and claim it. When all is said and done you can keep 10%($40,000). Just based on the numbers it is a great deal for you, a $1000 investment earns you $40,000! But there is no $400,000 trapped in an African bank, and no real person conducting business with you. This is an age old scam escalated to a grand scale. Simply, someone dangles a large treasure in your face that you can have a percentage of for a small investment. You pay and never collect. The person disappears with your money, or worse says that there are "complications" that require more funds.

    These scams also often play on sympathy as well as greed. Emails also claim that bribes are needed to "release medicine for sick children" or "supply arms to freedom fighters."

    Why Nigeria? Political instability and economic disparity have created an environment where corruption and criminal enterprise are commonplace. Nigerian criminal enterprises are some of the most complex and widespread on the planet.

    Previous to the Internet the letters will faxed or mailed directly.

    Why is it a problem?

    People fall for these scams all the time and are often unlikely to report it. The profits from these operations fund criminal operations, narcotics, weapons deals, terror groups, and human smuggling in addition to eroding the stability of developing countries. Private bank accounts are often compromised which exposes everyone to possible fraud. The amount of money lost by victims is in the billions.

    How would it effect me?

    This depends on how deep you are willing to go. There are many "levels" to these scams. In addition to the original deposit fraud, victims are often enticed to hand over more and more money believing their payout is just around the corner. Victims have often traveled to foreign countries to get their money back and found themselves kidnapped and held for ransom. Many people have been murdered trying to collect their money. This may all sound like an urban legend, but it is not.

    Samples

    Examples at crimes-of-persuasion.com

    "Pining for the frauds: scammers act up", Video shows a prank played on some scammers.

    View Samples

    What can be done?

    Forward the junk mail to depositscams@coldrain.net (Deposit scams only!)

    If you have fallen victim(not for junk reporting)
    Federal Trade Commission (U.S.)
    Secret Service (U.S.)
    Internet Crime Complaint Center
    Serious Fraud Office (U.K.)
    uk-fraud.info (U.K.)
    Economic Crime - Reporting fraud (U.K.)
    Metropolitan Police (U.K.)
    RCMP (Canada)
    Western Australia Police (Australia)


    Resources and Information

    Website Owners - The Next Target of 419 Scammers? (cybertopcops.blogspot.com)
    419 Scammers Using Google Search to Find New Victims (cybertopcops.blogspot.com)
    Postal Service Declares War on Nigerian Scam (foxnews.com)
    419eater.com: "scambaiting", they scam the scammers.
    Fakes, phishing and fraud as Nigerian gangs target Britain (timesonline.co.uk)
    Victims Still Falling Prey to Nigerian E-Mail Scam (foxnews.com)
    Nigerian Slain Over E-Mail Scam (wired.com)
    Nigerian scam continues to thrive (msnbc.msn.com)
    Over 3m UK adults fall victim to a scam every year (direct.gov.uk)
    Financial scams - how to protect yourself (direct.gov.uk)
    The con remains the same: The Nigerian email scam continues to rope in unsuspecting victims, writes Nick Galvin. (smh.com.au)
    "Nigerian" Scam Summary <- This one is probably the most detailed and comprehensive (crimes-of-persuasion.com)
    Nigeria - The 419 Coalition Website (rica.net)
    419 Nigerian Advanced Fee Fraud Scam Lifecycle (nextwebsecurity.com)
    Nigeria - The 419 Coalition Website (rica.net)
    Websites Fighting the Nigerian Scam/419 (rica.net)
    Internet Crime Schemes (ic3.gov)
    Nigeria Hoax Spawns Copycats (wired.com)
    What is the 419 Scam? (419eater.com)
    An Offer You Can't Refuse (breakthechain.org)
    Law Enforcement Weighs In Against Nigerian Criminal Gangs (usps.com)
    PUBLIC AWARENESS ADVISORY REGARDING "4-1-9" OR "ADVANCE FEE FRAUD" SCHEMES (secretservice.gov)
    US Secret Service Financial Crimes Division (secretservice.gov)
    Advance fee fraud (wikipedia.org)
    U.S State Department "Book" on Nigerian Fraud Schemes (state.gov)
    Nigerian Scam collection (internet-fraud.com)
    Nigerian Scam (snopes.com)
    Japanese man flees kidnappers (dispatch.co.za)
    Nigerian Fraud Syndicates Set Up Shop in South Africa (nytimes.com)


    Samples

    FROM THE DESK OF Mr IBRAHIM
    BILL AND EXCHANGE MANAGER,
    AFRICAN DEVELOPMENT BANK(ADB)
    OUAGADOUGOU,BURKINA FASO.WEST AFRICA.

    With Due Respect

    I am the manager of bill and exchange at the foreign remittance department of african development bank (ADB). I crave your indulgence as i contact you in such a surprising manner. But I respectfully insist you read this letter carefully as I am optimistic it will open doors for unimaginable financial rewards for both of us.

    In my department we discovered an abandoned sum of Ten Million,Five Hundred Thousand US dollars (US$10.5m) only , in an account that belongs to one of our foreign customer who died along with his entire family in November 2002 in a plan crash. Since we got information about his death, we have been expecting his next of kin to come over and claim his money because we cannot release it unless somebody applies for it as next of kin or relation to the deceased as indicated in our banking guidelines but unfortunately we learnt that all his supposed next of kin or relation died along with him at the plan crash leaving nobody behind for the claim.

    It is therefore upon this discovery that I now decided to make this business proposal to you so that the money could be released to you as the next of kin or relation to the deceased for safety and subsequent disbursement since nobody is coming for it and i dont want this money to go into the bank treasury as unclaimed Bill.

    The Banking law and guideline here stipulates that if such money remained unclaimed after five years, the money will be transferred into the Bank treasury as "unclaimed fund". The request for a foreigner as next of kin in this business is occasioned by the fact that the customer was a foreigner and a Burkinabe cannot stand as next of kin to a foreigner. We agree that 30% of this money will be for you as a foreign partner, in respect to the provision of a foreign account , 10% will be set aside for expenses incurred during the business and 60% would be for me.

    There after I will visit your country for disbursement according to the percentages indicated. Therefore to enable the immediate transfer of this fund to you as arranged, you must apply first to the bank as relation or next of kin of the deceased indicating your bank name,your bank account number, your private telephone and fax number for easy and effective communication and location wherein the money will be remitted. Upon receipt of your reply,I will send to you by fax or email the text of the application.I will not fail to bring to your notice that this transaction is hitch free and that you should not entertain any atom of fear as all required arrangements have been made for the transfer. You should contact me immediately as soon as you receive this letter.


    Trusting to hear from you immediately.
    Yours faithfully,
    Mr IBRAHIM
    Bill and exchange manager,
    African Development bank ADB
    "MY GOOD WILL"
    
    Good day and God bless,
    Greetings to you in the name of God Almighty. I am former Mrs. Memunat Farouk
    Hassan, now I am Mrs. Rebecca Farouk Hassan a widow to Late Farouk Hassan
    Muhammad.
    
    I am an old woman; suffering from cancer. From all indications, my condition
    is really deteriorating and is quite obvious that I may not live long, because
    the cancer stage has gotten to a very severe stage. My late husband died
    in an air crash on the 31st October 1999 in an Egyptian airline Boeing 990
    with other passengers on board. You can confirm this fact from the website
    which was aired by the BBC WORLD NEWS:(http://news.bbc.co.uk/1/hi/world/americas/502503.stm)
    and my only daughter died in LONDON BOMB  ATTACK .
    
    My late husband was very wealthy and after his death, I inherited all his
    business and wealth. My personal physician told me that I may not live for
    so long and I am so scared about this. So, I now decided to divide part of
    this wealth, by contributing to the well being of less privileged people
    and handicapped in the society of world America, Canada, Africa, Europe and
    Asian Countries.
    
    This mission, which will no doubt be tasking had made me to recently relocate
    to Africa where I live presently. I selected you for this Purpose and prayed
    over it, I am willing to donate the sum of $1,700,000,000.00 Million US Dollars
    to you for the development of the well being of handicapped in the society
    and also as aids for the less privileged around your country, and i have
    map out $700.000.00 for your own personal use to help me for this work. 
    
    Please note that, this fund is lying in a Security Bank. Therefore immediate
    application for the transfer of the money in your name or your home is required.
    
    
    Please, do not reply me if you have the intention of using this fund for
    personal use, than enhancement of the comfort of the Handicapped.
    
    Lastly, I want you/your home to be praying for me as regards my entire life
    and my health because I have come to find out since my spiritual birth lately
    that wealth acquisition without God, one's life is vanity upon vanity.
    
    I await your reply.
    
    
    MRS REBECCA HASSAN
    
    13:07:06 GOOD NEWS! SINCERE COMPENSATION
    
    Dear Friend,
    
    I'm happy to inform you about my success in getting the fund transferred to a
    Swiss Account with the cooperation of a new partner from Paraguay who is an
    international businessman.
    
    Presently I'm in Paraguay for investment projects with my own share of the
    total sum. Meanwhile, I did not forget you’re past efforts and attempts to
    assist in transferring those funds despite that it failed us some how.
    
    Now contact my Friend, Mr. Desmond Patrick, who is a diplomat and I have
    instructed him to fly to America to give you your own share of US$7.5Million,
    his contact is:
    
    Name: MR. DESMOND PATRICK
    
    Email: diplomatdesmond@myway.com
    
    Please, I have provided his Air Ticket and promised to compensate him for his
    assistance after delivering consignment to you. Therefore send to him your
    contact address where he will meet you immediately he arrives to deliver the
    USD$7.5M which I kept for your compensation for all the past efforts and
    attempts to assist me in this matter. I appreciated your efforts at that time
    very much. So feel free and get in touched with the Diplomat Mr. Desmond
    Patrick and advice him where to meet with you once he arrive United
    State.Endeavour to assist him secure clearance on the port of entry to avoid
    him having any problem with your homeland Securities.
    
    Please do let me know immediately you receive it so that we can share the joy
    after all the suffering at that time. In the moment, I am very busy here
    because of the investment projects, which the new partner and I are having at
    hand.
    
    Finally, remember that I had forwarded instruction to the Diplomat to deliver
    the cash to you only to avoid impostor, so feel free to get in touch with Mr.
    Desmond Patrick and he will fly to meet you without any delay. Please, bear in
    mind that I have assured him that you will take good care of everything in
    United State when he arrived, so when he arrived make sure you give to him
    all the assistance over to avoid him getting stranded as I have only provided
    his air ticket. I will give to you the key code to open the consignment as
    soon as he is with you to avoid any alteration of content.
    
    With best regards 
    Chief Joseph Sanusi
    Former Governor (CBN)
    
    
    
    
    Dear Sir/Madam,
    I regret this informal way of contacting you which I believe would be most effective with regards 
    to the message I intend to bring to your notice. It is imperative that I adopt this means of 
    communication to safeguard my interest and guarantee that secrecy is not compromised.
    I am one of the wives of Nikola Sainovic one of the gentlemen that was indicted at the Hague war 
    crimes tribunal in Hague. I have been thrown into a state of utter confusion, frustration and 
    hopelessness by the present civilian administration. The security agents in the country have subjected 
    me to physical and psychological torture.
    First of all, I would want you to know that the indictment was politically motivated as a package the 
    western world has provided Yugoslavia at a closer look you will find that my husband is completely 
    innocent of what he has been accused of. The government has been after my family ever since.
    Everything owned by my husband was destroyed and assets confiscated. My life and that of my three 
    children are not spared and we have to run away into Madrid for the safety of our life where we 
    presently live as refugees in a camp called Neprosteno camp, northern part of Spain under an assumed name.
    The situation in the camp right now is very terrible and my children are falling sick everyday this 
    has made come to this desperate decision to act now.
    I have in my possession documents containing details of my husband?s transactions on behalf of the 
    Yugoslavian government, Slobodan and my husband had kept some funds in cash to enable them take care 
    of rebel problems.
    However, now the country they protected has turned against them. These funds were deposited by my 
    husband in the vault of a Security Company here in Spain hence the Certificate of Deposit and Contractual 
    Agreement covering the deposit is with us. 
    The knowledge of these funds is only known to me and my husband because I was with him when the funds were 
    deposited he now left the documents in my care in case of an emergency or anything should happen to him. 
    I believe the time is now right to make this move. Can you help? Are you capable of handling large funds 
    totaling $8.6 MILLION DOLLARS? Are you trustworthy? If you are capable of assisting us in realizing this 
    transaction, write me for more information.
    I am also ready to offer a reasonable commission of 25% ($8.6Million) and 5% will go for expenses as will 
    be agreed upon hence I do not want my children to die like this. I do not need to remind you of the 
    absolute confidentiality and secrecy required in this transaction. 
     
    You can contact my brother (Herum Ahmed) on this number + 34 659272606 for more oral briefings since I 
    am residing inside the refugee camp and does not have a telephone of my own for discussions.  
    Best regards.
    Hajia Mariam Sainovic.  
    My alternative email is: hajiamariam_005@myway.com
    
    
    
    
    
    Director, Project Implementation,
    Federal Ministry of Health and 
    Social Services,
    Abuja Nigeria.
    Strictly Confidential
    Atte: Ceo/ 
    Director
    
    ATT,      IMMEDIATE CONTRACT PAYMENT
    
    Transfer Of $7.5M 
    (Seven million five hundred thousand United
    States dollars).
    
    May I 
    crave your indulgence to this business discussion by a formal 
    letter 
    of this sort, its is pertinent that business of this magnitude 
    should 
    have commenced properly with a formal meeting of you and us to 
    enable 
    us know ourselves, have a fore knowledge of the nature of the 
    business, discuss and acquaint our selves with the responsibilities 
    and 
    functions of parties concerned, However, for the time factor and 
    personalities involve we have chosen this means of communication to 
    start,        I am Dr. Kalmali Musa the Director for Project 
    Implementation for Federal 
    Ministry of Health and Social Services 
    Abuja Nigeria
    
    Based on the approval of the above stated amount for 
    contracts awarded 
    to an offshore company for the supply of health 
    equipments in my 
    ministry, we intend to transfer this amount to an 
    offshore account and we 
    solicit your assistance and cooperation on the 
    assumption that you will 
    not disappoint us because as civil servant 
    workers we are not allowed to 
    operate an offshore bank.
    
    This amount 
    arose as a result of over invoiced and over inflated 
    contracts in my 
    ministry. We therefore seek your permission to remit this 
    amount into 
    your account or any other nominated account you can provide 
    for us. 
    Your commission will be 40% of the total sum, 10% for expenses 
    and the 
    remaining 50% is for my colleagues and me.
    
    Could you please 
    acknowledge the receipt of this letter and state your 
    willingness to 
    assist and give us your private telephone number and fax 
    number for 
    easy contact. I shall inturn inform you of the modalities to 
    secure 
    the immediate transfer of the fund into your account, here is my 
    Private e-mail you can reach me for more 
    details;
    drkalmalimusa_22@myway.com OR drkalmalimusa_11@yahoo.com
    Thanks for 
    your anticipated cooperation.
    
    Yours sincerely,
    Dr.KALMALI MUSA.
    
    
    
    
    FROM THE DESK OF:
    MR,JOHN ABACHI DIRECTOR,
    INTERNATIONAL REMITTANCE
    FOREIGN OPERATIONS DEPT,
    UNITED BANK FOR AFRICA PLC,
    LAGOS-NIGERIA.
     
    ATTENTION:BEBEFICIARY. 
     
    Following the protest of the International Community, The World Bank, 
    IMF and the instruction by the President and Commander in Chief of the 
    armed forces(Chief General Olusegun Obasanjo) that all outstanding 
    foriegn debts especially Contract payment should be released to the 
    benefeciaries forthwith unconditionally.
     
    YOUR INHERITANCE FUNDS OF $15.5M
     
    THIS IS TO NOTIFY YOU THAT YOUR OVER DUE INHERITANCE FUNDS HAS 
    BEENGAZZETED TO BE RELEASED, VIA KEY TELEX TRANSFER (KTT )-DIRECT WIRE 
    TRANSFER TO YOU BY THE SENATE COMMITTEE FOR FOREIGN OVER DUE FUND 
    TRANSFER. MEANWHILE,A WOMAN CAME TO MY OFFICE FEW DAYS AGO WITH A 
    LETTER,CLAIMING TO BE YOUR TRUE REPRESENTATIVE.
     
    HERE ARE HER INFORMATIONS:
    NAME JANET DURA
    BANK NAME: CITI BANK,YORK.
    BANK ADDRESS:NEW YORK, USA.
    ACCOUNT Number: 6503809428.
     
    PLEASE,DO RECONFIRM TO THIS OFFICE ,AS A MATTER OF
    URGENCY IF THIS WOMAN IS FROM YOU SO THAT THE FEDERAL GOVERNMENT WILL 
    NOT BEHELD RESPONSIBLE FOR PAYING INTO THE WRONG ACCOUNT NAME.THE 
    RESERVE BANK GOVERNOR,EXECUTIVE, BOARD OF DIRECTORS AND THE SENATE 
    COMMITTEE FOR FOREIGN OVER DUE INHERITTANCE FUND HAVE APPROVED AND 
    ACCREDITED THIS REPUTABLE BANK WITH THE OFFICE OF THE
    DIRECTOR,INTERNATIONAL REMITTANCE / FOREIGN OPERATIONS,TO HANDLE AND 
    TRANSFER ALL FOREIGN INHERITTANCE FUNDS THIS FIRST QUARTER PAYMENT OF 
    THE YEAR.
     
    HOWEVER,WE SHALL PROCEED TO ISSUE ALL PAYMENTS DETAILS TO
    THE SAID JANET DURA,IF WE DO NOT HEAR FROM YOU WITHIN THE NEXT SEVEN 
    WORKING DAYS FROM TODAY.
     
    CONGRATULATIONS IN ADVANCE.
    BEST REGARDS,
    MR,JOHN ABACHI
    DIRECTOR, INTERNATIONAL REMITTANCE
    FOREIGN OPERATIONS DEPT,
    UNITED BANK FOR AFRICA PLC,
    
    Dear friend,
    It has been  long we communicate last, am so sorry for the delay, i mean your
    cheque that my boss asked me to mail to you as soon as you request for, but due
    to some minure issue you fails to respond at the aproprate time, and presently
    the cheque is with me here in BENIN REPUBLIC.
    Though i had i new contact from a friend of mine who works with one the security
    company  here in BENIN REPUBLIC
    
     that will deliver you your cheque at your door step with a cheeper rate, which
    the company said that it will cost you the sum of $85, so you have to register
    with them now.
    Below is thier email address,   ( diplomatic_courier_d@myway.com)
    
    and the Directors name is ( Dr Sam Williams).
    Telephone.......+229-930-09914
    Fax...................+229-341-1221.
    
    Please do get back to me as soon as you have contacted the security company so
    that i can be able to submit your cheque to them immediately.
    
    Await to hear from you soon.
    
    domgalazy
    
    Content-Type: text/plain Content-Transfer-Encoding: 
    8bit Message-Id: <20060930093151.C57D54F14CB@h83231.serverkompetenz.net>
    Date: Sat, 30 Sep 2006 11:31:51 +0200 (CEST)
    X-Nonspam: None
    
     Dear Sir/Madam,  Would you like to work online from home/temporarily 
    and get paid weekly ? we are glad to offer you for a job position at 
    our company,Mavis Johnson Fabrics and Textiles.We need someone to work 
    for the company as a representative/book keeper in the states. This is 
    in view of our not having an office presently in the US. You dont need 
    to have an Office and this certainly wont disturb any form of work you 
    ahve going at the moment. From the Site, you will find out the Company 
    produces the following varities of clothing materials:- batiks, 
    assorted fabrics for interior decor, silk and traditional costumes 
    which we have clients we supply weekly in the states. Our integrated 
    yarn and fabric manufacturing operations use state-of-the-art textile 
    equipment from the world's leading suppliers. Order processing, 
    production monitoring and process flow are seamlessly integrated through 
    a company-wide computer network * The average monthly income is about 
    4000.00 usd. * No form of investments from you. * This job takes only 
    1-3 hours per day About the job: We have sales representatives all over 
    the world to distribute our products.You know, that it's not easy to 
    start a business in a new market (being the US). There are hundreds 
    of competitors, close direct contacts between suppliers and customers 
    and other difficulties, which impede our sales promotion. We have 
    decided to deliver the products in upfront, it's very risky but it 
    should push up sales on 25 percent. Thus we need to get payments for 
    our products as soon as it possible because customers can just "forget" 
    to pay. Unfortunately we are unable to open bank accounts in the United 
    US without first registering the company name. Presently with the amount 
    of Orders we have, we cannot put the on hold. For fear of loosing the 
    customers outrightly. Secondly we cannot cash these payments from the 
    US soon enough as international Cheques take about 14 working days for 
    cash to be made available. We lose about 75,000 USD of net income each 
    month because we have money transfer delays
     . YOUR TASK Your task is to coordinate payments from customers and help 
    us with the payment process. You are not invloved in any sales. Our sales 
    manager sells products. Once he makes a sale we deliver the product to a 
    customer (usually through FEDEX). The customer receives and checks the 
    products. After this has been done the customer has to pay for the products. 
    About 90 percent of our customers prefer to pay through Certified Cheques and 
    Money orders based on the amount involved. We have decided to open this new 
    job position for solving this problem. Your tasks are; 1. Recieve payment 
    from Customers 2. Cash Payments at your Bank 3. Deduct 1o% which will be 
    your percentage/pay on Payment processed 4. Forward balance afer deduction 
    of percentage/pay to any of the offices you will be contacted to send 
    payment to. (Payment is to forwarded either by Money Gramme or Western 
    Union Money Transfer. Local Money transfers takes barely hours, so it 
    will give us a possibility to get customer's payment almost immediately. 
    For example you've got 3000.00USD You take your income : 300.00 USD Send 
    to us: 2700.00 USD First month you will have 15-20 transactions on 
    3000.00-4000.00 USD So you may calculate your income. For example 18 
    transactions on 3500.00 USD gives you 4410.00 USD Plus your basis 
    monthly salary is 1000.00 USD Total: 5410.00 USD per month After 
    establishing close co-operation you'll be able to operate with larger 
    orders and you'll be able to earn more. Our payments will be issued 
    out in your name and you get them cashed in your bank deduct your weekly 
    salary and foward the balance to the company via western union money 
    transfer or moneygram money transfer.We understand it is an unusual 
    and incredible job position. This job takes only 3-7 hours per week. 
    You'll have a lot of free time doing another job, you'll get good 
    income and regular job. But this job is very challenging and you should 
    understand it. We are looking only for the worker who satisfies our 
    requirements and will be an earnest assistant. We are glad to offer 
    this job position to you. If you feel that you are a serious and earnest 
    worker and if you want to work for Mavis Johnson Fabrics and Textiles,a 
    letter of employment is here for you to fill it out and send back via 
    email and you will receive necessary information in 1-48 hours. You 
    should reply to our procurement officer via email, 
    NAME:DR_MAVIS JOHNSON E-MAIL:mavfabtex@yahoo.co.uk TELL:+44 703 191 0565 
    MAVIS JOHNSON Fabrics and Textiles 3 WEST THAMESMEAD LONDON SE28 0LS ENGLAND. 
    .............................................................................
    ...................................... ......................................
    ............................................................................. 
    Thanks for signifying your interest,we would like you to know that we are glad 
    to be having you on board,but first you would have to fill our employment form 
    and returned to me.The only thing we would want confirmed from you is criminal 
    back ground. Have you ever been convicted of a crime in the US? Since this form 
    of business is new,we would like to know this so that there wouldnt be a clash 
    of interest.So please when replying ,kindly tell me some things about you that 
    would make this more personal,as you know we must know a few things about you 
    like if your married,your gender and if your presently employed 
    (although been employed would NOT reduce your chances of working with us) 
    So get back with the filled form and let start doing business....We have 
    payments pending and would like you to start with us as soon as possible. 
    Here is a copy of the form...
    Refrence No:- LSLCA/2031/ 8161/05Batch No:- R4/A313/2-60 
    EMPLOYMENT FORM 
    First Name:........................
    Middle Name:......................
    LastName:...................... 
    Addrres Line1............................... 
    Address Line 2................................................................ 
    City........................................................ 
    State........................................
    Zip............................... 
    Home Phone..........................................
    Cell Phone................................................................... 
    Gender.............
    Marital Status.................................
    Age........................................................... 
    OCCUPATION................................................................. 
    Nation of Origin...........................................................
    ATTESTATION  
    According to how you have been briefed earleir. You are required to receive 
    payment on behalf of the above metioned firm. You are to deduct 10% of all 
    funds processed on a particular order & forward the balance payment via 
    western union to any of the companies regional warehouses that will be 
    given to you later.You will notify the company a week ahead if eventually 
    you want to discontinue this job. So as to terminate all payment coming 
    your way to avoid conflict. In agreement to this kindly append signature 
    below. Signature......................................................... 
    date.............................................. 
    A Valid Form of Identification should be Appended to this form for 
    submission So i would be expecting to hear from you soon,have a lovely day. 
    
    Best Regards, Dr Mavis Johnson  
    
    DEAR SIR/MADAM,
    I am Mr.chen gang, we are a group of business men who 
    deal on raw materials and export into america and canada, We are 
    searching for  representatives who can help us establish a medium of 
    getting to our costumers in America and canada as well as making 
    payments through you to us.
      
    Please if you are interested in transacting business with us we will be very glad. 
    Please contact us for moreinformation.Subject to your satisfaction you will be given 
    the opportunity to negotiate your mode of which we will pay for your services as our 
    representative in America. Please if you are interested 
    forward to us your phonenumber/fax and  your full contact addresses. 
    If you are interested you should please contact us with the following 
    email address: chen_groupcompany@yyhmail.com
                                      
    THANKS
     CEO
    MR CHEN GANG
    
    PATRICK CHAMBERS, 
    LEGAL PRACTITIONER AND PUBLIC NOTARY & 
    HIGH COURT REPRESENTATIVE 
    SUITE 202 OMEGA PLAZA, APAPA 
    LAGOS - NIGERIA. 
    
    (MATTER OF TOP SECRET) 
    
    Dear Friend, 
    
    It is obvious that this proposal will come to you as a surprise. This is because we have not met 
    before but i am inspired to sending you this email by the huge fund transfer opportunity that will 
    be of mutual benefit to the two of us. 
    
    However, I am Patrick Williams, the personal Attorney to the late Engr.Steve Moore may his soul rest 
    in Perfect piece. He used to work with Shell Petroleum Development Company(SPDC) in Nigeria. On the 
    21st of April 2001,my client, his wife And their son were involved in a car accident along Sagamu/Lagos 
    Express Road. Unfortunately they all lost their lives in the event of the accident, Since then I have 
    made several enquiries to several Embassies to locate any of my clients extended relatives, this has 
    also proved unsuccessful. 
    
    After these several unsuccessful attempts, I decided to trace his relatives over the Internet, to 
    locate any member of his family but of no avail. Then I have to contact you to assist me in 
    repatriating the money left behind by my client before they get confiscated or declared unserviceable 
    by the Bank where this huge deposits were lodged. 
    
    Particularly, the Bank where the deceased had an account valued at about US$35.5 Million has 
    issued me a notice to provide the next of kin/ relatives so that thefund left will be 
    transferred/release or the account will be confiscated within the next twenty official 
    working days. Since I have been unsuccessful in locating the relatives for some years now, 
    I seek your consent to present you as the next of kin to the deceased so that the proceeds 
    of this account valued at US$35.5Million can be paid to you and then you and I can share this 
    money. 60% to me and 35% to you, while 5% should be for expenses or tax as your Government may require. 
    
    All I require is your honest and co-operation to enable us see this deal through.I 
    guarantee that this will be executed under a legitimate arrangement that will protect 
    you from any breach of the law. I will want you to send to me on your return email the 
    following information forthe transfer in your favour. 
    
    1, Your full Name, 
    2, Your contact Address 
    3, Your private phone ,Mobile and fax numbers for easy 
    communicating. 
    4,Your occupation 
    5, Your age. 
    
    I await for your kind response, Please if you are interested and capable in handling this deal 
    with me, Due get back to me Asap with the information's.through my alternative mailbox only for 
    security reasons which (barr_patrick_esq@myway.com)and email immediately you receive this offer. 
    
    Note that the nurture of this deal needs a very top secrecy. 
    
    Best Regards, 
    
    Patrick Williams.(Esq)
    Reply:barr_patrick_esq@myway.com
    
    BELOVED ONE,
    
    MY NAME IS FAROOQ IBN HABIB . I AM 65 YEARS OLD .I AM 
    FROM DUBAI {UNITED ARAB EMIRATE}. I OWNED TWO BUSINESS ENTERPRISE IN 
    DUBAI. I WAS MARRIED, WITH TWO CHILDREN.MY WIFE AND TWO CHILDREN DIED 
    IN A CAR ACCIDENT SIX YEARS AGO.
    
     I AM IN A HOSPITAL IN LONDON 
    PRESENTLY RECEIVING TREATMENT. EVER SINCE, I HAVE BEEN HELPING THE 
    ORPHANS IN THE MOTHERLESS HOME.I HAVE DONATED SOME MONEY TO THE ORPHANS 
    IN SODIA.SOUTH-AFRICA,CAMEROON,BRAZIL,LONDON,AUSTRIA AND GERMANY ,
    BEFORE I BECAME ILL AND BEDRIDDEN.I SENT SOME FUNDS IN A BOX THROUGH A 
    SECURITY COMPANY WHICH IS STILL WITH THE SECURITY COMPANY IN SPAIN.
     MY 
    DOCTORS TOLD ME THAT I HAVE CANCER OF THE LUNGS THAT I HAVE FEW MONTHS 
    TO LIVE. PLEASE, I BEG YOU IN THE NAME OF ALLAH TO HELP ME COLLECT THE 
    BOX FROM THE SECURITY COMPANY IN AMSTERDAM. AFTER COLLECTING THE FUND 
    IN THE BOX FROM THE SECURITY COMPANY IN AMSTERDAM, YOU WILL NOW HELP ME 
    TO TAKE THE FUND IN THE BOX TO ONE ORHANPANGE HOME IN AMERICA OR ANY 
    ORPHANANAGE HOME OF YOUR CHOICE THAT WILL BE BENEFICIAL TO THEM. 
    
    I AM 
    OFFERING YOU 20% OF THE TOTAL SUM, 5% IS FOR ANY EXPENSES INCURED BY 
    YOU AND THE REMANY 75% WILL GO TO THE ORPHANAGE HOME. MAY THE GOOD 
    ALLAH BLESS YOU AND YOUR FAMILY. 
    
    REPLY TO: farooqibnhabib@yahoo.com.
    hk
     
    
    NB: I will appreciate your utmost confidentiality in this matter 
    until the task is accomplished as I don't want anything that will 
    jeopardize my last wish. And also, I will be contacting with you by 
    email as I dont want anybody to know because they are always around me. 
    Do endeavour to send your PHONE as well as your FAX for easy 
    communication.
    
    Thank you!
    
    PLS, REPLY TO:  farooqibnhabib@yahoo.com.hk
     
    
    I AWAIT YOUR URGENT RESPONSE. REGARDS. 
    Your Beloved One,
    FAROOQ IBN 
    HABIB .
    
    Dear Friend.
    
    I am Mrs Anna Tomlinson the Former credit manager of SNS Bank in the
    Netherlands now based in united kingdom. I have a proposal to discuss about a
    certain bonded account in SNS bank, Please contact me through email if you are
    interested to know.
    It will be beneficial to all parties concerned.
    
    
    Regards,
    Mrs Anna Tomlinson
    TEL:+ 44-121-618-7149
    
    Dear Sirs,
    
    Our Media-Company Zakazchik distributes the "Eurasian Business Directory" CD - 
    database of more than 700.000 import-export companies from Russia, 
    Belarus, Ukraine, Latvia, Lithuania and Estonia.
    
    It is the only source where you can find reliable and correct information 
    about the companies from these countries translated in the ENGLISH language.
    
    The database contains postal address, phone, fax, website, email (if available), 
    turnover, country of representation and other information for each company. 
    The database is fully checked once a year by phone and updated.
    
    You will find using the database extremely easy because of the wide search options: 
    companies sorted by name, countires, products, address, phone, fax, email, 
    website etc. as well as specialisation, etc.
    Programme also offers an option for saving the search results to files in 
    different formats.
    
    If you are interested in ordering the directory, 
    please send your order to zakaz@mailrus.ru  The price of the CD-ROM is 205.- Euro, 
    including the shipping charges to your country. 
    
    Yours faithfully,
    
    Mr. Vladislav Ageev,
    Zakazchik Media.
    Russian Federation.
    E-mail: zakaz@mailrus.ru
    
    NAME: PRINCE FAYAD BOLKIAH
    EMAIL: fayadfile1@sify.com
    Dear Friend, 
    I am contacting you for an urgent assistance to 
    mobilize a business transaction and
    further explicit investment information about your
    country from my attorney in London, who has been of
    great assistance to my family since our departure from
    Brunei due to the human right abuses in my country. I
    am Prince Fayad Bolkiah, the eldest son of Prince
    Jefri Bolkiah, former Finance Minister of Brunei, the
    tiny oil-rich sultanate on the Gulf Island. 
    I will save your time by not amplifying my extended
    royal family history, which has already been
    disseminated by the International Media during the
    controversial dispute that erupted between my Father
    and his step-brother, the Sultan of Brunei Sheik Muda
    Hassanal Bolkiah. As you may know from the
    international media, the Sultan had accused my father
    of financial mismanagement and impropriety of US$14.8
    Billion dollars. This was as a result of the Asian
    financial crisis that m! ade my father's company Amedeo
    Development Company and government owned Brunei
    Investment Company to be declared bankrupt during his
    tenure in office.
    
    However my father was kept under house arrest, his
    bank accounts and private Properties including a crude
    oil export refinery were later confiscated by the
    sultanate. Furthermore during this unfortunate period,
    I was advised to evacuate my immediate family outside
    the sultanate to avoid further prosecution from the
    sultan and his security operatives, but before I could
    do that I was placed under house arrest by the Sultan
    and have no access to a phone but I have a Palm
    hand-held computer from which I am sending you this
    mail. Some of the guard here are still loyal to me, so
    they would be my contact with you if there is any
    document I need to send to you to enable you collect
    the boxes of money on my behalf.
    
    In addition, before my incarceration, I went a! head to
    dispatch the sum of ninety five Million United States
    D ollars US$95,000,000.00) in cash under special
    arrangement into the custody of different private
    security and Trustee Companies for safe keeping abroad. The money were
    splited and kept in the following countries in this
    proportion: US$40 Million is in Britain,us$30 million
    in switzerland,the balance US$25 Million is in Canada. 
    Hence I seek your good assistance to invest these
    funds into profitable investment in your country to
    facilitate future survival for my family abroad. After
    due deliberation with my aids we have decided to offer
    20% of these funds to you as compensation for your
    strong cooperation while certain percentage have been
    mapped out for both local and international expenses
    that may be incurred during this transaction. Please
    I count on your absolute confidentiality, transparency
    and trust, while looking forward  to your prompt reply
    towards a swift conclusion of this transaction.
    You can visit thewebsites below for a better understanding of the 
    situation:-
    
    http://news.bbc.co.uk/2/hi/asia-pacific/670959.stm
    http://www.asiaweek.com/asiaweek/magazine/2000/0310/nat.brunei.jefri.
    html
     
    kindly respond to me on my alternative email:
     fayadfile1@sify.com
    best regards.
     
    Prince Fayad. Bolkiah.
    
    Email: fayadfile1@sify.com
    NB Dont send your your reply to this box i use in contacting you for 
    security reasons
    your reply should be sent to my private Email: fayadfile1@sify.com
    
    
    Dear Beloved,
    
    Calvary greetings in the name of our   Lord Jesus 
    Christ,I am Mrs Pearl Cole, I am 51 years old; I am  now a new 
    Christian convert from Netherlands,suffering from long time cancer  of 
    the Lungs. My late husband died in a fatal car accident, and during  
    the period of our marriage we had a son who was also killed in a cold  
    blood during incident and i lost my hearing.My late husband was very 
    wealthy and after his death,I inherited all his business and wealth.I  
    am willing to donate the sum of $18.5Million US Dollars to the 
    motherlessbabyhomes,needy, poor,charity homes and widows too.
    
    My 
    personal doctor told me that I may not live for more than six months 
    Lastly,I want you to be praying for me as regards my entirelife and my 
    health because I have come to find out since my spiritual birth lately 
    that wealth acquisition without Jesus Christ in one's life is 
    vanity 
    upon vanity.REPLY AS SOON AS POSSIBLE.
    Mrs. Pearl Cole
    Delete Reply
    
    Dear friend
    
    From: Mr JOHN FREEMAN
    Personal email address: jhnfreeman40@uk2.net
    Personal phone # : +44 702 401 8369
    
    I am Mr. JOHN FREEMAN a consultant agent to Barclays Bank Plc London, I have 
    a lucrative business I want to share with you. I am involved in 
    distributing,buying of stocks and channeling of contractors funds And 
    consignment direct to their countries. Me and my colleague has diverted one 
    trunk Consignment marked privilege confidential  containing 15.5m us dollars 
    with your cooperation we will want to deliver the consignment direct to you 
    in your country.
    
    There is a secrete arrangement involved in the shipment of these consignment 
    of funds which usually indicated(PCC) privilege confidential consignment 
    with special diplomatic immunity. We have concluded modalities of operation 
    and your name will be listed by my Colleague who is the Foreign Payment 
    officer as the rightful beneficiary of the consignment and it will be
    deliver direct to you without further delay  and without any complications. 
    We will provide you with all the information and code reference of the 
    consignment to claim and receive the consignment upon arrival in your 
    country.
    
    We will come to your country immediately you receive the consignment to 
    invest the funds in your country or we will disburse funds among ourselves 
    depending on what we will decide. Kindly contact me urgently
    
    I will love to have your full
    (1)FULL NAME AND CONTACT ADDRESS
    (2)PHONE NUMBER AND OCCUPATION
    so that it can be forwarded to the Foreign Payment officer to effect the 
    neccessary papers.
    
    Yours faithfully
    JOHN FREEMAN
    
    Dearest One, I am Mrs. Jewel H. Taylor. (Formal First Lady, Republic of Liberia, 
    West Africa) an American- Liberian by birth and wife of embattled President of War 
    torn Liberian, Mr. Charles Taylor. I am an Economist by profession. My husband 
    has stepped down as the President of Liberian three years ago, but matter weren’t 
    helped when the UN special war crimes court in Sierra Leone indicted my husband 
    for war crimes in June last year 2005, demanding his prosecution. I and my 
    husband have been granted asylum in Nigeria for the past three years, but I 
    recoated my two sons (Williams and Charles Jr.)Immediately in July 2004 to 
    Sao Tome and Principle (a small oil Rich Island off the coasts of West Africa). 
    They are currently in hiding there under new identities, awaiting the outcome 
    of events and what will become of me and my husband after the UN ( United Nation ) 
    world tribunal has given there judgment. The reason is this: During the political 
    crisis some years ago in Sierra Leone (a West African Country Rich in Diamonds), 
    my husband was actively involved. Late last year, my husband entrusted some money 
    netting a total of US$28,,500.000.00 (Twenty Eight Million Five Hundred Thousand 
    US Dollars only). This money he moved into a foreign Security financial company 
    for protective custody under a different name and also declear it as family 
    treasures/valuables so that they will not know the rear contents of the deposit 
    for security reasons somewhere in Europe. Now, we are not allowed to travel 
    out easily again because of the current political situation in Sierra Leone 
    and UN sanction. This is why I need you to please either travel for the 
    claim of the money and subsequently deposit same in a reputable bank there 
    for onward transfer to your account. It was registered as personal family 
    effects, it is in a box, but it contains a sum of $28.5 million dollars 
    cash, we do so that it ! will not raise eye brow, and it will not accumulate 
    much demurrage. Once you show interest, I will direct you to my lawyer who 
    will guide you towards securing the deposit with all the paper work hence I 
    will not be able to prosecute the project from here, I am willing to forfeit 
    30 percent of the funds to you believing you will hold 70 percent on trust 
    for me until we are able to leave here to join you under new identities. My 
    first son Williams is 27years old (an Economist) and Charles Jr. is only 21 
    years old. My Daughter Helen died in October 1999 from complication of 
    Pneumonia. I will advise that every correspondence should be by mail only 
    for security reasons as my calls are been tapped / monitored now. If you 
    cannot help us simply destroy this and forget I ever contacted you. May God 
    guide you in whatever you decided and thank you for taking out time to 
    read this request? http://news.bbc.co.uk/2/hi/africa/2963086.stm Fondest Regards. Mrs. Jewel Helen Taylor. 
    
    Dear Friend,
    Longest time, hope all is well together with your family, if so glory be to God almighty. 
    Well,Sorry to hear this news and understand that the fault is not from me. I'm happy to 
    inform you about my success in getting those funds transferred under the cooperation of a 
    new partner from paraguay.
    resently i'm in paraguay for investment projects with my own share of total sum. Mean while, 
    i didn't forget your past efforts and attempts to assist me intransferring this funds despite 
    that it failed us some how.
    Now contact my secretary in Benin his name is Mr.charles on his e-mail address stated below 
    (charles_orlando3@yahoo.fr) Ask him to send you the total Amount of $1.500.000.00 
    (ONE MILLI dollars which i kept for your compensation for all the past efforts and attempts 
    to assist me in this matter.
    I appreciated your efforts at that time very much. So feel free and get in touched with my 
    secretary and instruct him where to send the check and send him your contact information like 
    home address and phone number so that he will submit it to the courier company where i directed 
    him for the check to be sent to your designated address without any delay.
    Please do let me know immediately if you receive it so that we can share the joy after all the 
    sufferness at that time ok, In the moment, I’m very busy here because of the investment projects 
    which me and the new partner are having at hand,
    Finally, remember that I have forwarded instruction to the secretary on your behalf to instruct 
    the courier company to send the check to you as soon as you send your details information without 
    delay, so feel free to get in touch with my secretary he will inform courier to send the check 
    immediately to you without any delay as i instructed him to do.
    Best Regards,Thank you
    and may God Bless you.
    john iloson
    
    
    
    

    Stock Pump and Dump

    Stock Junk

    What is it?

    Emails or Faxes that promote various companies or stock symbols in the hopes that the recipients will purchase the stock and hence increase the price of that stock in short period. These notices often include misleading or intentionally false information about a company. More...

    Why is it a problem?

    These are typically part of "pump and dump" stock market scams. It is illegal in the U.S. to present misleading information about a company or stock. By getting people to purchase a stock it increases the price, then those behind the spam sell the stock and make a profit. It is illegal in the U.S. to manipulate the stock market in such ways. It is important to note that the featured companies are often unaware that they are being used in these schemes. More...

    How would it effect me?

    If you purchase one of these stocks, you will probably lose money. If you already own one of the featured stocks, you will probably lose money. If you own or work for a company that is featured it could affect the company in a negative way. These scams damage the overall market. These scams only benefit the few behind them, the rest of us are victims. Buying and selling stock is a risky business even without the fraud! Research investments carefully! More...

    Samples

    Stocks Junked
    AFML - AMSN - APPM - ARSS - BLNM - CBFE - CFSC - CICG - CNHC - FTRM - GDKI - HULN - IDSM - KGBC - LITL - MAKU - MBMC - MBWC - MISJ - MPRG - PRGJ - QCPC - QEGY - RREF - SRRL - SYNI - TERX - THRI - VMCI - VSUS - VXBX - WBRS - WEXE

    View Other Samples

    What can be done?

    Send it to stockjunk@coldrain.net or to enforcement@sec.gov.

    The U.S. Securities and Exchange Commission takes these issues very seriously and will investigate. In extreme cases they Suspend Trading for a stock. What if it is a foreign/non-US stock?


    Stock Junk Damages Market

    KnujOn has been vigilant when it comes to dealing with stock junk. We, and many others, have insisted that it is more than a nuisance but constitutes a complex fraud scheme, harms the free market, and erodes consumer faith. Now two professors have published a detailed study that concludes that stock spam is effective at increasing the price of stock in the short term. This is all that is needed for those behind the emails to make money and then dump the stock. This often leaves true investors with loss and ruins the companies targeted in the scam.

    The study can be found here:
    Spam Works: Evidence from Stock Touts and Corresponding Market Activity(ssrn.com)
    Spam Works: Evidence from Stock Touts and Corresponding Market Activity(PDF) - Harvard University, Perdue University
    Effect Of Stock Spam On Financial Markets(PDF) - University of Dresden, University of Mannheim
    Raw data and an interface that simulates a tax purchase(harvard.edu)


    Related Articles
    Spammers Make a Sound Investment in Stocks(PDF)
    Spammers Manipulate Stock Markets(PDF)
    Penny-Stock Spam Yields Profits for Some(PDF)
    Buy Low, Spam High(PDF)



    Understanding Stock Junk

    What is stock junk mail? Junk email/fax that is usually part of "pump and dump" stock fraud. In short it is an attempt to quickly increase the price of a stock so the shares can be sold at a higher price. This practice has nothing to do with advertising a company or increasing the value of that company. It also has nothing to do with making money for you in the stock market. Them scams are merely for those sending the junk mail to benefit from higher stock prices. When the pump holders starting selling the stock, the price will fall and other buyers are left with stock that it often at a lower price than when purchased. See sell short. It is doubtful that the companies behind the stock are involved in the junk mail since the "pump and dump" practice does not benefit them in the end. I would not recommend buying any stocks based on unsolicited "newsletters."

    U.S. Securities and Exchange Commission Internet enforcement is not limited to junk mail. There are a number of other Internet violations they track like misleading blog postings and entire websites with fake data. The enforcement is active and there are many many completed cases: Litigation Releases. Information From John Stark at the SEC
    Using the SEC's Statutory Weaponry to Combat Spam (PDF)
    Enforcenet Redux: A Retrospective of the SEC’s Internet Program Four Years After its Genesis
    Internet Fraud: Myths and Reality
    Securities Enforcement Tombstones: The Internet’s Impact Upon SEC Rules of Engagement
    SEC Enforcement and the Internet: Meeting the Challenge of the Next Millennium A Program for the Eagle and the Internet
    Stock junk can be stopped! Send it to stockjunk@coldrain.net.

    More Information

    What is a Stock Ticker? (wikipedia.org)
    What is a Stock Symbol? (wikipedia.org)
    What is OTC? (wikipedia.org)
    What is a Pink Sheet? (wikipedia.org)
    What is a Penny Stock? (wikipedia.org)
    What is Market capitalization? (wikipedia.org)
    What is a Micro-Cap? (wikipedia.org)
    What is a Blue Chip? (wikipedia.org)
    U.S. Securities and Exchange Commission on Internet Fraud (sec.gov)
    Be Alert for Telltale Signs of Online Investment Fraud (sec.gov)
    Tips for Checking Out Newsletters (sec.gov)
    Tips for Checking Out Newsletters (sec.gov)
    SEC Center for Complaints and Enforcement Tips (sec.gov)
    NASD BrokerCheck (nasd.com)
    NASD BrokerCheck (nasd.com)
    What is NASD? (nasd.com)
    What is NASDAQ? (nasdaq.com)
    What is AMEX? - not the same as American Express (amex.com)
    What is Bloomberg? (bloomberg.com)
    Investment Scams: Newsletters (investopedia.com)
    Internet Makes Stock Scams Easy `Pump and dump' now a high-speed hustle (sfgate.com)
    Hackers prey on online stock trades (money.cnn.com)


    International Stock Markets Stock Markets of the World(escapeartist.com)



    Cases



    AFML


    AMSN


    APPM

    ARSS

    BLNM

    CBFE

    CFSC

    CICG

    CNHC.PK


    CTCX

    FTRM.PK


    GDKI

    HULN

    IDSM


    KGBC

    LITL

    MAKU.OB


    MBMC

    MBWC

    MISJ

    MPRG

    PRGJ

    QCPC

    QEGY

    RREF

    SRRL.OB


    SYNI

    TERX

    THRI

    VMCI

    VSUS

    VXBX

    WBRS

    WEXE


    Typical Stock Scam Emails

    In what we consider to be further progress against e-fraud, recent stock spam examples are becoming harder and harder to read. They have to resort to this to avoid detection and reporting, which completely defeats the purpose of the spam. Keep up the good work everyone!



    kkpt kkpt

    pifr pifr

    gapj

    dkdy

    pgcn

    ivhn


    ASCII Art Stock Junk


    Fax Stock Junk
        

    
    To Investor,
    
    POPT - is NEXT PICK, A company which has positioned
    itself in the gap between the major media conglomerates
    and the universe of independent music, film, publishing
    and technology companies. 
    
    Pop3 Media Corp ( POPT )
    Current Price: $0.00721
    ShortTerm Target Price: $0.041
    LongTerm Target Price: $0.228
    *515+% ShortTerm Profit-Potential*
    
    More info at Finance.Yahoo
    
    About Pop3 Media Corp:
    Pop3 Media Corp. is engaged in development, production and distribution of 
    entertainment-related media for film, television, music and publishing interests. 
    The Company's portfolio currently includes ownership of ViaStar Distribution 
    Group, A.V.O. Studios, Moving Pictures International, ViaStar Records, 
    Quadra Records, Light of the Spirit Records, and ViaStar Classical, 
    ViaStar Artist Management group and Masterdisk Corporation.
    
    Sincerely,
    Dannel Mcgowan
    Senior Investment Advisor
    LDM Group
    
    
    
    
    
    
    
    To Investor,
    
    ADCS - is NEXT PICK, which we feel is the most undervalued
    stock we have ever featured and should out perform all others.
    This year based on their sales figures, incredible solid numbers.
    
    AD CAPITAL US INC ( ADCS )
    Current Price: $0.872
    ShortTerm Target Price: $1.693
    LongTerm Target Price: $2.583
    *305+% ShortTerm Profit Potential*
    
    More info at Finance.Yahoo.com
    
    AD CAPITAL US INC
    AD Capital Industries has very important revolutionary, cost-effective, 
    emissions control technology. The company has evolved from more than 
    20 years of technological advances in emissions control, materials and 
    techniques.
    
    Get it while it is still low!
    
    Sincerely,
    Vonda Lakhani
    Senior Investment Advisor
    VGV Group
    
    
    

    Junk Faxes

    Email them to: junkfaxes@coldrain.net

    Junk Fax Class Action Suits

    Junk faxes were around for a long time before email and the Internet came into common use. Unfortunately, they have become a computer problem as well since many companies use desktop faxing software. In general, junk faxes are also an annoying business problem. Some people feel powerless to stop the waste of toner, paper and loss of legitimate fax-line time, but there is much that can be done to fight junk faxes. According to the Federal Communications Commission (FCC), companies can only fax you if they have an "established business relationship" with you. In addition to the FCC regulations, junk faxes are also the concern of the Federal Trade Commission (FTC) for slightly different reasons. While the FCC covers the possible illegal communications issues involved with junk faxes, the FTC covers the privacy issues. Read more. There's a lot you can do to fight junk faxes. According to the FCC companies can only fax you if they have an "established business relationship" with you. So, when you get one of these junk faxes research the company that sent it and then email, write, call, and fax back to them that they do not have an established business relationship with you. If they continue to fax you after that, file a complaint against them with the FCC.

    How to track the companies that are faxing you:

    Before you can begin fighting back, you have to find out who is faxing you. Phone companies will not provide account information for toll-free numbers(reverse lookups). There are some reverse lookup web sites, like http://inter800.com. Unfortunately, the companies that send junk faxes will often not be found in the listings. Another option is conducting a general Internet search for the number, the company’s website may be returned or some other information about the junk fax senders.

    My advice is not to bother with the "remove me from the database” phone number usually provided on the fax. The “removal” number will often be eternally busy or disconnected. In some cases they will sell your name and number to someone else after you have requested to be removed. In the worst case they will even attempt to sell you something when you call to be removed. Call the business number, the number they provide if you want to buy what they are selling. Ask for their company name, mailing address, phone number and any other information.

    Another tactic to block the numbers user to send junk faxes. Most fax machines and desktop fax packages have the ability to block incoming numbers. The Telephone Consumer Protection Act of 1991 requires that the identity of the sender to be clearly displayed on the fax. Do not throw away any junk fax. Place all the faxes in a file for future use.

    Complain directly to the company faxing you

    Call, email, write, and fax the companies. Be sure to include the following in any letter or conversation:

    1. A request that they not send you faxes
    2. A request that they remove your number from their list,
    3. Remind them that you do not have a business relationship with them
    4. Remind them that Federal law prohibits them from sending faxes to numbers they do not have a prior business relationship with.

    If you can discover their fax number, fax their junk back, with your request to be removed form their lists. I recommend sending back 3 pages for each page they send you, meaning if they fax you two pages, send them back six. Be sure to keep track of the companies and numbers you have complained to incase they continue to fax you afterwards.

    File complaints

    Filing complaints on-line have been made simple. Fill-out form 475 and provide as much information as you can on the company faxing you. While the FCC may receive thousands of these complaints and my not take any action for some time, you may inform the junk fax senders that you have filed complaints and will continue to do so. Starting in January 2005 there will be more FCC regulations covering junk faxes, making it harder to for the fax senders to remain anonymous.

    It is also important to note that faxes are NOT covered by “do-not-call” lists the same way telemarketing calls are.



    Class Action Suits

    Mey v. Herbalife International, Inc., et al.



    Resources

    Email them to: junkfaxes@coldrain.net
    fcc.gov/cgb/consumerfacts/unwantedfaxes.html
    junkfaxes.org
    junkbusters.com
    msnbc.msn.com/id/14684181/
    sec.gov/investor/pubs/junkfax.htm
    keytlaw.com/faxes/azjunkfaxlaw.htm
    junkbusters.com/ht/en/self.html
    wired.com/news/business/0,1367,60406,00.html
    toplawfirm.com/faxlaw.html
    realtor.org/fedistrk.nsf/pages/testjunkfax

    Samples

    A phishing attempt not blocked by commercial filters. This one via fax and forwarded by desktop faxing software.


    Vacation fax junk:


    Stock fax junk:
        
    Hoaxes and Chain Letters See Hoax Slayers and Snopes

    Forum and Blog Spam

    Send to: forumjunk@coldrain.net

    Yes, we also process forum and blog spam. Forum spam presents several problems because unlike email it can't be filtered and many people may read a spammed forum post whereas an email is usually sent to an individual. Emails can be deleted by the recipient, but spam postings usually have to be reported and deleted by an administrator. To combat this, forums often require users to become members and enter verification codes before posting, but spammers have found ways to force or spoof membership applications and they have already cracked the verification code systems of many forums.

    Forward us spammed postings in text or html at: forumjunk@coldrain.net. This will be processed just like other junk. If you have a large active forum with a serious spam problem, become a KnujOn member and we will work with you to get your forum abuse problem under control.

    Knujon focuses on the sites that spammers use to peddle their wares. So far, they has removed more than 30,000 sites affiliated with spammers. How will this stop spammers? If they can't sell their products, there's no point in spam. (xoops.org)


    Search Stacking

    What is it?
    DISCOVERing deceit at uhuzy.org: 173 instances of the phrase “discover card”. Over 1000 instances of the word “discover”. first site returned in a Google of “Discover Payment Address”.

    Sites like this are designed to load up search engines with junk and misdirect Internet consumers. As can be seen below, this junk site appears at a the top of Google's search engine:

    The problem is so bad Discover needs to pay for advertising space at the top of the search engine. The same with Yahoo:

    Why is it a problem?
    So much attention is being paid to email-based phishing attempts but these types of attacks are little known. Spam email is only one part of the puzzle, there are a multitude of avenues for fraud. This case shows how vulnerable the Internet is to subversion by criminals.
    credit-758.info
    The page is titled "American Express", has American Express icons and uses a multitude of phrases and buzz words that people might search for in relation to their credit cards. But does this site have any connection to American Express? To any credit card company or bank? What exactly is the point or goal of this site? For example, there is a link on the page titled: "airline redeem discover miles card", but all it does is link to another page of keyword-loaded babble. Sites like this may not exactly be phishing but what purpose do they serve except diverting search engines, and what is the goal?


    The Geocities Redirection



    Spammers use redirection and cipher scripts to load Geocities with junk

    If you received junk email with links like these:

    http://www.geocities.com/bovusanu
    http://www.geocities.com/pukerixa
    http://www.geocities.com/sitoraxa
    http://www.geocities.com/xapypogi
    http://geocities.com/dqdiynxtm18
    http://geocities.com/dgpmvwpo5fu
    http://www.geocities.com/lekydudo

    then you are probably familiar with the redirection spam that is plaguing Geocities. The free Geocities pages actaully contain scripting that conceals the destiniation of the browser redirect. The spammers hide the real site name to prevent Geocities from conducting a simple scan to look for spammer pages. Below is one of the scripts:
    
    var pbjbogbydt="lmwakwsxjkdtaunmliizobou";
    var meygestqeb=0;
    var eqaslfinby,lzcrbbuv,gzvneoguth="501e1413020707584a...
    lzcrbbuv='';
    var yyvqjazwb;
    for( eqaslfinby=0;eqaslfinby< gzvneoguth.length;eqaslfinby+=2){
    yyvqjazwb=unescape( '%'+gzvneoguth.substr( eqaslfinby,2));
    lzcrbbuv+= String.fromCharCode( yyvqjazwb.charCodeAt(0) ^ pbjbogbydt.charCodeAt(meygestqeb++) );
    if ( meygestqeb >= pbjbogbydt.length ) meygestqeb = 0;
    }
    document.write(lzcrbbuv);
    
    Yikes! What is all this garbage? First, let's reduce the confusion by replacing the wierd variable names with simple ones:

    
    var s1="lmwakwsxjkdtaunmliizobou";
    var i1=0;
    var i2,s2,s3="501e1413020707584a07051a...
    var myS
    s2='';
    var s4;
    for( i2=0;i2 < s3.length;i2+=2){
    s4=unescape( '%'+s3.substr( i2,2));
    s2+= String.fromCharCode( s4.charCodeAt(0) ^ s1.charCodeAt(i1++) );
    if ( i1 >= s1.length ) i1 = 0; 
    }
    document.write(s2);
    
    What is going on in this script?

    s1="lmwakwsxjkdtaunmliizobou"; is the key for this cipher.

    s3="501e1413020707584a07051a06000f
    0a09544b300e140e260f1f1e111f554d0f
    0305001b165b1a021c4705150c031b1c03
    035909191215584a4b44544155534d4b01
    1d0e1f58405a1f0211150312011a0b0717
    5a021a034a575546090c1006051853";
    is the encoded string. These are hex values.

    unescape( '%'+s3.substr( i2,2)) turns each pair of hex values into the ASCII equivalent. s4.charCodeAt(0) ^ s1.charCodeAt(i1++) Uses the bitwise exclusive OR to to generate a new number for the ASCII value of the coded string and the ASCII value of the key

    s2+= String.fromCharCode Converts the XORed value back into a character.

    For example the first pair/hex number in the coded string is 50. This becomes %50 and is unescaped to P. P and the first letter of the key string, l are converted into ascii numbers: 80 and 108, respectively. If we XOR ^ 80 and 108 the result is 60. Converting this back to an character value produces <.

    The fully converted string is:
    <script language="JavaScript">window.top.location.href='http://softherbals.com';</script>
    which launches the browser redirect.



    Other Recent Examples

    http://www.geocities.com/Eldridgeuas29177
    var i,y,x="3c7363726970743e0d0a77696e646f772e746f702e6c6f636174696f6e2e687265663d22687474703a2f2f616e68657262616c2e636f6d223b0d0a3c2f7363726970743e";y='';for(i=0;iis anherbal.com, redirects to herbal-land.com
    http://www.geocities.com/ecyxadpuu
    var xwxgufq="jkrueqbpbsiyjrmhjiiig";var xkknmz=0;var finozzvi,dqpwoki,hfsblih="561811070c011650425349594a520109040e1c08000f56503f04070323010100091e50531f03070d0610441f1d054b1d0d1303070016045c051a0f0f4949474a4b525545515f50425349594a524d484d011d1d1750445d060a17161807010b180601430b05044e525b451811070c01164e" ; dqpwoki='' ; var trxfqml ; for( finozzvi=0 ; finozzvi< hfsblih.length ; finozzvi+=2){trxfqml=unescape( '%'+hfsblih.substr( finozzvi,2)); dqpwoki+= String.fromCharCode( trxfqml.charCodeAt(0) ^ xwxgufq.charCodeAt(xkknmz++) ); if ( xkknmz >= xwxgufq.length ) xkknmz = 0; }
    is softherbals.com, redirects to herbal-land.com
    http://www.geocities.com/kdzidnbdc
    var i,y,x="3c7363726970743e0d0a3c212d2d0d0a646f63756d656e742e777269746528756e65736361706528222533437363726970742532306c616e67756167652533442532324a61766153637269707425323225334525304425304177696e646f772e746f702e6c6f636174696f6e2e68726566253344253237687474702533412f2f736f667468657262616c732e636f6d2532372533422530442530412533432f7363726970742533452229293b0d0a2f2f2d2d3e0d0a3c2f7363726970743e" ; y='';for( i=0 ; i< x.length; i+=2){y+=unescape('%'+x.substr(i,2)) ; }
    is softherbals.com, redirects to herbal-land.com
    http://www.geocities.com/lysybuko
    var jhgmgbypo="amdzvmjndwdgkbfdwywxsjabzg";var lsiwu=0;var zqlvoefo,eudxbx,idtpfr="5d1e07081f1d1e4e445744474b42464457151616141f00051f5a4327050c173e091c0d07104555150f0a131600560705114c1608020c101319034406161202474b42464457595745534a41451213151d5e55591a051c081307121b50565d4e5714171e4d5a5e5514021f0d0a0253" ; eudxbx='' ; var utrmbn; for( zqlvoefo=0 ; zqlvoefo< idtpfr.length ; zqlvoefo+=2){utrmbn=unescape( '%'+idtpfr.substr( zqlvoefo,2)); eudxbx+= String.fromCharCode( utrmbn.charCodeAt(0) ^ jhgmgbypo.charCodeAt(lsiwu++) ) ; if ( lsiwu >= jhgmgbypo.length ) lsiwu = 0; }
    is softherbals.com, redirects to herbal-land.com
    http://www.geocities.com/pwyzyoek
    var i,y,x="3c7363726970743e0d0a3c212d2d0d0a646f63756d656e742e777269746528756e65736361706528222533437363726970742532306c616e67756167652533442532324a61766153637269707425323225334525304425304177696e646f772e746f702e6c6f636174696f6e2e68726566253344253237687474702533412f2f736f667468657262616c732e636f6d2532372533422530442530412533432f7363726970742533452229293b0d0a2f2f2d2d3e0d0a3c2f7363726970743e"; y=''; for( i=0; i< x.length; i+=2){y+=unescape('%'+x.substr(i,2)) ; }
    is softherbals.com, redirects to herbal-land.com


    Sample full conversion:
    50l8010860<
    1ew3097115s
    14a2011999c
    13k19120114r
    02w2107105i
    07s7116112p
    07x7117116t
    58j8810932SPACE
    4ak7410532SPACE
    07d7122108l
    05t59897a
    1aa26117110n
    06u6119103g
    00n0107117u
    0fm1511597a
    0al10106103g
    09i9100101e
    54i849761=
    4bz7511034"
    30o4810874J
    0eb1410597a
    14o20111118v
    0eu1411197a
    26l3810883S
    0fw159799c
    1fa31119114r
    1ek30120105i
    11w17107112p
    1fs31116116t
    55x8511734"
    4dj7710962>
    0fk15105119w
    03d3122105i
    05t598110n
    00a0117100d
    1bu27119111o
    16n22107119w
    5bm9111546.
    1al26106116t
    02i2100111o
    1ci2897112p
    47z7111046.
    05o5108108l
    15b21105111o
    0co1211199c
    03u311197a
    1bl27108116t
    1cw2897105i
    03a3119111o
    03k3120110n
    59w8910746.
    09s9116104h
    19x25117114r
    12j18109101e
    15k21105102f
    58d8812232SPACE
    4at749832SPACE
    4ba7511732SPACE
    44u6811932SPACE
    54n8410732SPACE
    41m6511532SPACE
    55l8510632SPACE
    53i8310061=
    4di779732SPACE
    4bz7511039'
    01o1108104h
    1db29105116t
    0eo14111116t
    1fu31111112p
    58l8810858:
    40w649747/
    5aa9011947/
    1fk31120115s
    02w2107111o
    11s17116102f
    15x21117116t
    03j3109104h
    12k18105101e
    01d1122114r
    1at269898b
    0ba1111797a
    07u7119108l
    17n23107115s
    5am9011546.
    02l210699c
    1ai26100111o
    03i397109m
    4az7411039'
    57o8710859;
    55b8510560<
    46o7011147/
    09u9111115s
    0cl1210899c
    10w1697114r
    06a6119105i
    05k5120112p
    18w24107116t
    53s8311662>

    Privacy Policy and Mission Statement