Categorizing Junk eMail
Usually our eyes glaze over when we look at the enormous pile of spam in our inbox. It all seems like such nonsense, an electronic Tower of Babel that loses any specific meaning in an ocean of noise. However, there a many different kinds of kinds of Junk eMail and understanding the difference and details of each kind helps fight the problem. KnujOn recognizes these various types and has a different process for each one. As a victim of Junk eMail it is important to understand the different threat each one represents and why it is necessary to address these threats head-on. The format of these reports are designed to give you the most useful and actionable information by addressing these questions: What is it? Why is it a problem? How would it affect me? and What can be done? We provide samples, resources and specific cases for each.
Delivery Medium
- Malware
Viruses and spyware. Emails can contain viruses and are usually spawned by another machine infected by the same virus. What is the difference between viruses and spyware? Sometimes nothing, but usually a virus replicates itself on your PC and then tries to infect other machines via email or infected files. Spyware launches pop-ups, hijacks browsers, loads bookmarks/favorites. Both can expose machines to hacking, theft or file damage. More...
Financial
- Mortgage/Loan
Offers of large loans for impossible rates. More...
- Stock Market Manipulation
Pump and Dump schemes that have become a very serious problem. More...
- Phishing
Faked emails that appear to come from banks, ebay, PayPal, Amazon or any other site that has on-line transactions. More...
- Traditional Deposit Scams
A total stranger want to give you money. Sometimes called "Nigerian"/419 scams, they can come from anywhere and predate the Internet by hundreds of years. No one gives anything away for free. More...
Product-Driven
- Counterfeits
Counterfeits and "replicas" More...
- Prescription Drugs
Offers sales of controlled substances. More...
- Software
Name brand software offered for bellow list prices. More...
- Vacations
Super-Cheap vacation and travel packages. More...
- Degrees
Offers GED, BA, MBA, PhD and it is all BS. More...
- Miscellaneous, Bizarre Stuff
It is junk mail, but is it spam? More...
Phishing
Send to phishing@coldrain.netWhat is it?
What is phishing? As opposed to regular junk mail or spam, phishing emails are specifically designed coerce or fool consumers into revealing sensitive information. Names, userIDs, account numbers, passwords, PIN numbers, social security numbers, and other information that would be useful to those wanting to break into on-line bank accounts, commit credit card fraud, or perpetrate identity theft.
Why is it a problem?Phishers will often lift content and graphics from real websites for purpose of fooling users into thinking they are viewing the real site. Ebay.com, PayPal.com and Amazon.com are frequent targets of these attacks. Someone who fraudulently accesses one of these online accounts could make hundreds of bogus transactions before being discovered. Phishers will also often register similar domain names: "amason.com", "PaiPal.com", "ebayy.com". This generally undermines consumer confidence and erodes faith in Internet commmerce.
How would it effect me?If you fall for one of these tricks your bank account could be emptied, your credit cards used illegally, your identity stolen and your credit rating ruined.
Samples and Cases
Recent
Typical
PayPal/Ebay
Amazon
Chase
visa
Credit Unions
- Send the phishing email to phishing@coldrain.net
- Whenever conducting transactions or updating information over the Internet go directly to site by manually typing in the URL, never click links in emails.
- Always keep paper trails of your transactions. Review your bank statements and credit card bills every month!
- Check your credit rating frequently
- "Fry" your Phish at CastleCops (castlecops.com)
- Forward the email to the security department at the sepcific institution
- Forward the email to Anti Phishing Working Group (antiphishing.org)
- Check Websense alerts for attempts directed at your bank. (websense.com)
Cases and Samples
Websense Security Labs has received reports of a phishing attack that targets customers of Hang Seng Bank. Users who visit the site will be asked for personal as well as account information, such as ATM pin number, account number, and details. (websense.com)Alerts at Websense (websense.com)
Fake fax, bypassed filters
View full size




Report any fraud emails like this to phishing@coldrain.net and phishing@visa.com. More information at Visa's security pages.
Common among these attempts is the insistence that the customer's account has been compromised and they must login immediately to remedy the situation. "Logging in" to one of these sites basically means that you have handed your username and password over to someone who will use it to impersonate you and steal your money.
What you can do
Every instance should be reported. PayPal, Ebay, and Amazon all have email addresses
for reporting phishing attempts.
Amazon.com: stop-spoofing@amazon.com
PayPal.com: spoof@paypal.com
Ebay.com: spoof@ebay.com
In the case of online banks, you may have to go to the bank's real website and
find out their policy and reporting method. Some banks tell their customers to
"just delete it." We believe that this is a very bad policy.
More Cases
Common Examples
Knujon has received thousands of phishing attempts against Fifth Third Bank in recent months and we are aggressively reporting all of them. Below is an example:

You can forward these attempts to us and 53investigation@security.53.com
Phishers are using a new tactic on their site to fool people who mistakenly click on the linked email. Using JavaScript a subnet at chinanet.cn.net projects a fake address over the real address contained in the browser window, as shown below:

While deceptive it is flawed. The image is off-center and will overlay all windows not just the immediate browser. This is clearly an effort to lure ebay customers into having their identities stolen.

Links to update-user5463.info which is registered to a "David Abrahams." Forward emails like this to abuse@bankofamerica.com.
These emails all use hijacked Amazon.com images but link to "cyberdyneoem.com".

Send any suspicious Amazon.com emails to: stop-spoofing@amazon.com. Read more about spoofing at Amazon.com.
Lloyds TSB and the UK Financial Services Authority fake email. If you have an email similar to the one below, forward it to emailscams@lloydstsb.co.uk

Read more about email scams: here.
Forged Bank of the West email
Attempt to obtain customer information form LaSalle Bank customers

LaSalle is located in the United States, but the email would actaully dump the customer data to a subnet at a Japanese site. There is no evidence that the Japanese site was operating the subnet or knew about it. The subnet has been deleted.
Report any suspect LaSalle emails to emailhoax@abnamro.com. Read more about LaSalle's security policies here.
We received a carefully constructed email warning PayPal users of a possible security breach and asking them to log into their PayPal account. The log-in link did not go to PayPal but a subdomain on heyjule.com in Korea. To be fair to heyjule.com, the subdomain has been deleted, it is possible they were not even aware of the problem.
The following email requesting ebay customer information was revealed by KnujOn as actually linking to a subnet on an educational site in China:

The subnet has been reported by KnujOn and shutdown. If you have email similar to this, read ebay's security information: http://pages.ebay.com/securitycenter/stop_spoof_websites.html.
This is an attempt by "amen-pro.com" in Paris, France to obtain personal customer information from U.S. customers of the Marshall & Ilsley Corporation in Wisconsin.
This email was forwarded to M & I's security personnel. If you are customer of M & I Bank, read their fraud/identity theft information before replying to any email or entering personal information via the Internet.
Knujon has uncovered dozens of attempts to trick PayPal customers into revealing passwords and other personal information. The emails are designed to mimic PayPal customer alerts but hijacking the content. However, the links within the email that request personal information redirect to this address: 61.166.6.60. This is a site in China which is not affiliated with PayPal. PayPal is an online payment system run by ebay.com.

Filling out the information on this page will transmit passwords & usernames to people at lijian-guanfang-gainshop and ghotel-lijiang.com out of "Beijin", China. They also claim to be located in Pompano Beach, FL. The information will probably be used for some kind of identity theft. The irony is that the email claims to be a security alert itself, confusing the ordinary user and further eroding trust in e-commerce.
We have seen obfuscated urls in the past, phishers and spammers that replace characters in a domain address with their hexadecimal equivalents. Example: %2E%63%6F%6D is ".com". However, today KnujOn received a PayPal scam with this link:
http://0xd8daf761/modules/PNphpBB2/cache/PNTheme/saving.php
0xd8daf761 is a hexadecimal conversion of the ip address: 216.218.247.97 which is nfb.hippo.ws a free member bulletin board in French(Oddly enough .ws is the TLD for Western Samoa). hippo.ws is a jumble of postings and one of the first is "the internet is shit" which is poignant given the situation here.
At any rate, be on the look out 0xd8daf761 style urls, KnujOn is set to catch them!
Common Examples
Dear valued PayPal® member : It has come to our attention that your PayPal® account information needs to be updated as part of our continuing commitment to protect your account and to reduce the instance of fraud on our website. If you could please take 5-10 minutes out of your online experience and update your personal records you will not run into any future problems with the online service. However, failure to update your records will result in account suspension. Please update your records on or before January 25, 2006. Once you have updated your account records, your PayPal® session will not be interrupted and will continue as normal. To update your PayPal® records click on the following link: http://www.paypal.com/cgi-bin/webscr?cmd=login-run Thank You. PayPal® UPDATE TEAM Accounts Management As outlined in our User Agreement, PayPal® will periodically send you information about site changes and enhancements. Visit our Privacy Policy and User Agreement if you have any questions. http://www.paypal.com/cgi-bin/webscr?cmd=p/gen/ua/policy_privacy -outside
At the last reviewing at your amazon account we discovered that your information is inaccurate. We apologize for this but because most frauds are possible because we don't have enough information about our clients, we require this verification. Please login and reenter your personal information. Please follow this link to update your personal information: http://www.amazon.com/exec/obidos/sign-in.html (To complete the verification process you must fill in all the required fields) Please note: If you don't update your information within next 48 hours , we will be forced to suspend your account untill you have the time to contact us by phone. We apreciate your support and understanding, as we work togeder to keep amazon market a safe place to trade. Thank you for your attention on this serious matter and we apologize. Regards, Jeff Bezos Founder & CEO
Greetings from Amazon Payments. Your bank has contacted us regarding some attempts of charges from your credit card via the Amazon system. We have reasons to believe that you changed your registration information or that someone else has unauthorized access to your Amazon account Due to recent activity, including possible unauthorized listings placed on your account, we will require a second confirmation of your identity with us in order to allow us to investigate this matter further. Your account is not suspended, but if in 48 hours after you receive this message your account is not confirmed we reserve the right to suspend your Amazon registration. If you received this notice and you are not the authorized account holder, please be aware that it is in violation of Amazon policy to represent oneself as another Amazon user. Such action may also be in violation of local, national, and/or international law. Amazon is committed to assist law enforcement with any inquires related to attempts to misappropriate personal information with the intent to commit fraud or theft. Information will be provided at the request of law enforcement agencies to ensure that perpetrators are prosecuted to the full extent of the law. To confirm your identity with us click here: https://www.amazon.com/exec/obidos/flex-sign-in/ref=pd_irl_gw_r/ 103-3177084-7567864?opt=oa&page=recs/sign-in-secure.html After responding to the message, we ask that you allow at least 72 hours for the case to be investigated. Emailing us before that time will result in delays. We apologize in advance for any inconvenience this may cause you and we would like to thank you for your cooperation as we review this matter. Thank you for your interest in selling at Amazon.com. Amazon.com Customer Service http://www.amazon.com This message and any files or documents attached may contain classified information. It is intended only for the individual or entity named and others authorized to receive it. If you are not the intended recipient or authorized to receive it, you are hereby notified that any disclosure, copying, distribution or taking any action in reliance on the contents of this information is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately then delete it from your system. Please also note that transmission cannot be guaranteed to be secure or error-free.
Dear PayPal, We recently noticed one or more attempts to log in to your PayPal account from a foreign IP address (209.145.1.34). If you recently accessed your account while traveling, the unusual log in attempts may have been initiated by you. However, if you did not initiate the sessions, please visit PayPal as soon as possible to verify your identity: https://www.paypal.com/us/cgi-bin/webscr? cmd=_login-run Verify your identity is a securi! ty measure that will ensure that you are the only person with access to the account. Thanks for your patience as we work together to protect your account. Sincerely, PayPal Helps Keep You Safe Our comprehensive fraud-prevention program is one of the key reasons PayPal is a safe way to pay online. We monitor transactions 24/7. We believe that innovation and careful analysis is the way to beat fraud. That’s why PayPal has developed industry-leading models to review every transaction—and help detect suspicious activity. Experts work behind the scenes to help protect you. We have a team of agents worldwide who work to help shield you from fraud and identity theft. If we suspect fraud in your account, we’ll contact you immediately We work with authorities to shut down fraudulent websites PayPal's Fraud Investigation Team stops criminals. Our Fraud Investigation Team is dedicated to creating a safe PayPal community. Our team includes former law enforcement officials who: Identify and help prevent fraud before it occurs Work with law enforcement around the world to help stop online criminals
We recently noticed one or more attempts to log in to your Amazon account from a foreign IP address and we have reasons to belive that your account was hijacked by a third party without your authorization. If you recently accessed your account while traveling,the unusual log in attempts may have been initiated by you. However,if you are the rightfull holder of the account, click on the link below, fill the form and then submit as we try to verify your identity. Click Here! The log in attempt was made from: IP address: 205.88.09.66 ISP host: cache-dq04.proxy.cox.net If you choose to ignore our request,you leave us no choise but to temporaly suspend your account. We ask that you allow at least 72 hours for the case to be investigated and we strongly recommend not to make any changes to your account in that time. If you received this notice and you are not the authorized account holder, please be aware that it is in violation of Amazon policy to represent oneself as another Amazon user. Such action may also be in violation of local, national, and/or international law. Amazon is committed to assist law enforcement with any inquires related to attempts to misappropriate personal information with the intent to commit fraud or theft. Information will be provided at the request of law enforcement agencies to ensure that perpetrators are prosecuted to the fullest extent of the law. *Please do not respond to this e-mail as your reply will not be received. Thanks for your patience as we work together to protect your account. Regards, Security Department Amazon Inc.
PayPal Security Measures! We are contacting you to remind you that: on 02 Nov 2005 our Account Review Team identified some unusual activity in your account, one or more attempts to log in to your PayPal account from a foreign IP address. IP Address Time Country 80.53.1.130 Aug 10, 2005 15:05:08 PDT Poland 80.53.255.174 Aug 10, 2005 15:07:58 PDT Poland 80.80.125.1 Aug 10, 2005 15:13:09 PDT Rusia 85.55.2.65 Aug 10, 2005 21:28:08 PDT Spania 81.82.87.172 Aug 10, 2005 21:33:43 PDT Belgium In accordance with PayPal's User Agreement and to ensure that your account has not been compromised, access to your account was limited. Your account access will remain limited until this issue has been resolved. To secure your account and quickly restore full access, we may require some additional information from you. To securely confirm your PayPal information please go directly to https://www.paypal.com/ log in to your PayPal account and perform the steps necessary to restore your account access as soon as possible or click on the link bellow: To continue your verification procedure click here Thank you for using PayPal! The PayPal Team -------------------------------------------------------------------------------- Please do not reply to this e-mail. Mail sent to this address cannot be answered. For assistance, log in to your PayPal account and choose the "Help" link in the footer of any page. To receive email notifications in plain text instead of HTML, update your preferences here. PayPal Email ID PP785445
Chase Fraud
Links to 194.86.65.51
Links to fantasticflyers.com

Links to jdfamilies.com

Links to rrcs-24-213-165-171.nyc.biz.rr.com

Credit Union Fraud
You may have received an email like the ones below. While the message text only refer to a generic credit union, the headers are forged with ncua.gov or cuna.org.
The messages are virtually the same text except for the fake case ID, we have recorded
4:
CU1-818-214-242146
CU1-833-557-9888
FCU1-GX833-234-P4TYUN1
FCU1-813-214-242146
Why four fake codes? They are related to the sources of the messages. Each one seems to be
coming from one of three IP addresses:
CU1-833-557-9888 or CU1-818-214-242146 = 66.165..
FCU1-GX133-234-P4TYUN1 = 209.190..
FCU1-813-214-242146 = 207.36..
The first string of messages linked to 210.72.224.26, a subnet in China. Later, the link changed to: http://www.tamin.org/.CREDIT-UNION/update.php. There is no content at this location but the site is still up. Tamin.org is registered to a company in Iran.
cuna.org recommends that you delete these messages, but KnujOn thinks that this is the wrong approach. You may send any of these messages to phishing@coldrain.net.
Senders
Credit Union
Credit Union 1
Credit Union Security Department
Credit Union Security Service
C.U.N.A. Security Service
C.U.N.A. Security Department
FCU Security Service
FCU Security Department
Federal Credit Union
Subjects
WARNING: ACCOUNT UPDATE
Update Your Billing Information
CRITICAL UPDATE
FCU: Account update
System maintenance: update your Federal Credit Union
FCU NOTICE: Important security update
http://211.97.60.218/usage/.CREDIT-UNION/update.php
In attention of all Credit Union customers, As the Internet and information technology enables us to expand our services, we are committed to maintaining the trust customers have placed in us for protecting the privacy and security of information we have about you. In order to protect your information against unauthorized access, identity theft and account fraud we earnestly ask you to update your profile. To get started, please click the link below: http://www.co-opnetwork.org/public/update_profile/index.htm If you received this notice and you are not the authorized account holder, please be aware that it is in violation of our policy to represent oneself as another Credit Union user. Such action may also be in violation of local, national, and/or international law. CUNA is committed to assist law enforcement with any inquiries related to attempts to misappropriate personal information with the intent to commit fraud or theft. Information will be provided at the request of law enforcement agencies to ensure that perpetrators are prosecuted to the fullest extent of the law. Thanks for your patience as we work together to protect your account. Regards, CUNA Customer Support Center. This site is directed at or made available to persons in the United States and Credit Union customers only. Persons outside the United States may visit Credit Unions on line. Products and services described, as well as associated fees, charges, interest rates, and balance requirements may differ among geographic locations. Not all products and services are offered at all locations.
http://211.97.60.218/usage/.CREDIT-UNION-1/authenticate.php
Credit Union 1 is constantly working to ensure security by regularly
screening the accounts in our system. We recently reviewed your account,
and we need more information to help us provide you with secure service.
Until we can collect this information, your access to sensitive account
features will be limited. We would like to restore your access as soon
as possible, and we apologize for the inconvenience.
--------------------------------------------------------------------------------
Why is my account access limited?
Your account access has been limited for the following reason(s):
* We would like to ensure that your account was not accessed by an
unauthorized third party. Because protecting the security of your
account is our primary concern, we have limited access to sensitive
Credit Union 1 account features. We understand that this may be an
inconvenience but please understand that this temporary limitation is
for your protection.
(Your case ID for this reason is CREDIT UNION 1 XG868-214-242146.)
At Credit Union 1, one of our most important responsibilities to you, our
customer, is the safekeeping of the nonpublic personal ("confidential")
information you have entrusted to us and using this information in a
responsible manner. Appropriate use of the confidential information you
provide us is also at the heart of our ability to provide you with
exceptional personal service whenever you contact us.
--------------------------------------------------------------------------------
How can I restore my account access?
Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations."
Completing all of the checklist items will automatically restore your
account access.
http://211.97.60.218/usage/.CREDIT-UNION-1/authenticate.php
Credit Union 1 is constantly working to ensure security by regularly
screening the accounts in our system. We recently reviewed your account,
and we need more information to help us provide you with secure service.
Until we can collect this information, your access to sensitive account
features will be limited. We would like to restore your access as soon
as possible, and we apologize for the inconvenience.
--------------------------------------------------------------------------------
Why is my account access limited?
Your account access has been limited for the following reason(s):
* We would like to ensure that your account was not accessed by an
unauthorized third party. Because protecting the security of your
account is our primary concern, we have limited access to sensitive
Credit Union 1 account features. We understand that this may be an
inconvenience but please understand that this temporary limitation is
for your protection.
(Your case ID for this reason is CREDIT UNION 1 XG868-214-242146.)
At Credit Union 1, one of our most important responsibilities to you, our
customer, is the safekeeping of the nonpublic personal ("confidential")
information you have entrusted to us and using this information in a
responsible manner. Appropriate use of the confidential information you
provide us is also at the heart of our ability to provide you with
exceptional personal service whenever you contact us.
--------------------------------------------------------------------------------
How can I restore my account access?
Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations."
Completing all of the checklist items will automatically restore your
account access.
http://211.97.60.218/usage/.CREDIT-UNION/update.php
Credit Union is constantly working to ensure security by regularly
screening the accounts in our system. We recently reviewed your account,
and we need more information to help us provide you with secure service.
Until we can collect this information, your access to sensitive account
features will be limited. We would like to restore your access as soon
as possible, and we apologize for the inconvenience.
--------------------------------------------------------------------------------
Why is my account access limited?
Your account access has been limited for the following reason(s):
* We would like to ensure that your account was not accessed by an
unauthorized third party. Because protecting the security of your
account is our primary concern, we have limited access to sensitive
Credit Union account features. We understand that this may be an
inconvenience but please understand that this temporary limitation is
for your protection.
(Your case ID for this reason is PCU1-818-214-242146.)
At Credit Union, one of our most important responsibilities to you, our
customer, is the safekeeping of the nonpublic personal ("confidential")
information you have entrusted to us and using this information in a
responsible manner. Appropriate use of the confidential information you
provide us is also at the heart of our ability to provide you with
exceptional personal service whenever you contact us.
--------------------------------------------------------------------------------
How can I restore my account access?
Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations."
Completing all of the checklist items will automatically restore your
account access.
http://211.97.60.218/usage/.CREDIT-UNION/update.php
Credit Union is constantly working to ensure security by regularly
screening the accounts in our system. We recently reviewed your account,
and we need more information to help us provide you with secure service.
Until we can collect this information, your access to sensitive account
features will be limited. We would like to restore your access as soon
as possible, and we apologize for the inconvenience.
--------------------------------------------------------------------------------
Why is my account access limited?
Your account access has been limited for the following reason(s):
* We would like to ensure that your account was not accessed by an
unauthorized third party. Because protecting the security of your
account is our primary concern, we have limited access to sensitive
Credit Union account features. We understand that this may be an
inconvenience but please understand that this temporary limitation is
for your protection.
(Your case ID for this reason is PCU1-818-214-242146.)
At Credit Union, one of our most important responsibilities to you, our
customer, is the safekeeping of the nonpublic personal ("confidential")
information you have entrusted to us and using this information in a
responsible manner. Appropriate use of the confidential information you
provide us is also at the heart of our ability to provide you with
exceptional personal service whenever you contact us.
--------------------------------------------------------------------------------
How can I restore my account access?
Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations."
Completing all of the checklist items will automatically restore your
account access.
http://211.97.60.218/usage/.CREDIT-UNION/update.php
Credit Union is constantly working to ensure security by regularly
screening the accounts in our system. We recently reviewed your account,
and we need more information to help us provide you with secure service.
Until we can collect this information, your access to sensitive account
features will be limited. We would like to restore your access as soon
as possible, and we apologize for the inconvenience.
--------------------------------------------------------------------------------
Why is my account access limited?
Your account access has been limited for the following reason(s):
* We would like to ensure that your account was not accessed by an
unauthorized third party. Because protecting the security of your
account is our primary concern, we have limited access to sensitive
Credit Union account features. We understand that this may be an
inconvenience but please understand that this temporary limitation is
for your protection.
(Your case ID for this reason is PCU1-818-214-242146.)
At Credit Union, one of our most important responsibilities to you, our
customer, is the safekeeping of the nonpublic personal ("confidential")
information you have entrusted to us and using this information in a
responsible manner. Appropriate use of the confidential information you
provide us is also at the heart of our ability to provide you with
exceptional personal service whenever you contact us.
--------------------------------------------------------------------------------
How can I restore my account access?
Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations."
Completing all of the checklist items will automatically restore your
account access.
http://www.tamin.org/.CREDIT-UNION/update.php
Credit Union is constantly working to ensure security by regularly
screening the accounts in our system. We recently reviewed your account,
and we need more information to help us provide you with secure service.
Until we can collect this information, your access to sensitive account
features will be limited. We would like to restore your access as soon
as possible, and we apologize for the inconvenience.
--------------------------------------------------------------------------------
Why is my account access limited?
Your account access has been limited for the following reason(s):
* We would like to ensure that your account was not accessed by an
unauthorized third party. Because protecting the security of your
account is our primary concern, we have limited access to sensitive
Credit Union account features. We understand that this may be an
inconvenience but please understand that this temporary limitation is
for your protection.
(Your case ID for this reason is CU1-833-557-9888.)
At Credit Union, one of our most important responsibilities to you, our
customer, is the safekeeping of the nonpublic personal ("confidential")
information you have entrusted to us and using this information in a
responsible manner. Appropriate use of the confidential information you
provide us is also at the heart of our ability to provide you with
exceptional personal service whenever you contact us.
--------------------------------------------------------------------------------
How can I restore my account access?
Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations."
Completing all of the checklist items will automatically restore your
account access.
http://www.tamin.org/.CREDIT-UNION/update.php
Credit Union is constantly working to ensure security by regularly
screening the accounts in our system. We recently reviewed your account,
and we need more information to help us provide you with secure service.
Until we can collect this information, your access to sensitive account
features will be limited. We would like to restore your access as soon
as possible, and we apologize for the inconvenience.
--------------------------------------------------------------------------------
Why is my account access limited?
Your account access has been limited for the following reason(s):
* We would like to ensure that your account was not accessed by an
unauthorized third party. Because protecting the security of your
account is our primary concern, we have limited access to sensitive
Credit Union account features. We understand that this may be an
inconvenience but please understand that this temporary limitation is
for your protection.
(Your case ID for this reason is CU1-833-557-9888.)
At Credit Union, one of our most important responsibilities to you, our
customer, is the safekeeping of the nonpublic personal ("confidential")
information you have entrusted to us and using this information in a
responsible manner. Appropriate use of the confidential information you
provide us is also at the heart of our ability to provide you with
exceptional personal service whenever you contact us.
--------------------------------------------------------------------------------
How can I restore my account access?
Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations."
Completing all of the checklist items will automatically restore your
account access.
http://www.tamin.org/.CREDIT-UNION/update.php
Credit Union is constantly working to ensure security by regularly
screening the accounts in our system. We recently reviewed your account,
and we need more information to help us provide you with secure service.
Until we can collect this information, your access to sensitive account
features will be limited. We would like to restore your access as soon
as possible, and we apologize for the inconvenience.
--------------------------------------------------------------------------------
Why is my account access limited?
Your account access has been limited for the following reason(s):
* We would like to ensure that your account was not accessed by an
unauthorized third party. Because protecting the security of your
account is our primary concern, we have limited access to sensitive
Credit Union account features. We understand that this may be an
inconvenience but please understand that this temporary limitation is
for your protection.
(Your case ID for this reason is CU1-833-557-9888.)
At Credit Union, one of our most important responsibilities to you, our
customer, is the safekeeping of the nonpublic personal ("confidential")
information you have entrusted to us and using this information in a
responsible manner. Appropriate use of the confidential information you
provide us is also at the heart of our ability to provide you with
exceptional personal service whenever you contact us.
--------------------------------------------------------------------------------
How can I restore my account access?
Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations."
Completing all of the checklist items will automatically restore your
account access.
http://www.tamin.org/.CREDIT-UNION/update.php
Credit Union is constantly working to ensure security by regularly
screening the accounts in our system. We recently reviewed your account,
and we need more information to help us provide you with secure service.
Until we can collect this information, your access to sensitive account
features will be limited. We would like to restore your access as soon
as possible, and we apologize for the inconvenience.
--------------------------------------------------------------------------------
Why is my account access limited?
Your account access has been limited for the following reason(s):
* We would like to ensure that your account was not accessed by an
unauthorized third party. Because protecting the security of your
account is our primary concern, we have limited access to sensitive
Credit Union account features. We understand that this may be an
inconvenience but please understand that this temporary limitation is
for your protection.
(Your case ID for this reason is CU1-818-214-242146.)
At Credit Union, one of our most important responsibilities to you, our
customer, is the safekeeping of the nonpublic personal ("confidential")
information you have entrusted to us and using this information in a
responsible manner. Appropriate use of the confidential information you
provide us is also at the heart of our ability to provide you with
exceptional personal service whenever you contact us.
--------------------------------------------------------------------------------
How can I restore my account access?
Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations."
Completing all of the checklist items will automatically restore your
account access.
http://www.tamin.org/.CREDIT-UNION/update.php
Credit Union is constantly working to ensure security by regularly
screening the accounts in our system. We recently reviewed your account,
and we need more information to help us provide you with secure service.
Until we can collect this information, your access to sensitive account
features will be limited. We would like to restore your access as soon
as possible, and we apologize for the inconvenience.
--------------------------------------------------------------------------------
Why is my account access limited?
Your account access has been limited for the following reason(s):
* We would like to ensure that your account was not accessed by an
unauthorized third party. Because protecting the security of your
account is our primary concern, we have limited access to sensitive
Credit Union account features. We understand that this may be an
inconvenience but please understand that this temporary limitation is
for your protection.
(Your case ID for this reason is CU1-818-214-242146.)
At Credit Union, one of our most important responsibilities to you, our
customer, is the safekeeping of the nonpublic personal ("confidential")
information you have entrusted to us and using this information in a
responsible manner. Appropriate use of the confidential information you
provide us is also at the heart of our ability to provide you with
exceptional personal service whenever you contact us.
--------------------------------------------------------------------------------
How can I restore my account access?
Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations."
Completing all of the checklist items will automatically restore your
account access.
http://www.tamin.org/.CREDIT-UNION/update.php
Credit Union is constantly working to ensure security by regularly
screening the accounts in our system. We recently reviewed your account,
and we need more information to help us provide you with secure service.
Until we can collect this information, your access to sensitive account
features will be limited. We would like to restore your access as soon
as possible, and we apologize for the inconvenience.
--------------------------------------------------------------------------------
Why is my account access limited?
Your account access has been limited for the following reason(s):
* We would like to ensure that your account was not accessed by an
unauthorized third party. Because protecting the security of your
account is our primary concern, we have limited access to sensitive
Credit Union account features. We understand that this may be an
inconvenience but please understand that this temporary limitation is
for your protection.
(Your case ID for this reason is CU1-818-214-242146.)
At Credit Union, one of our most important responsibilities to you, our
customer, is the safekeeping of the nonpublic personal ("confidential")
information you have entrusted to us and using this information in a
responsible manner. Appropriate use of the confidential information you
provide us is also at the heart of our ability to provide you with
exceptional personal service whenever you contact us.
--------------------------------------------------------------------------------
How can I restore my account access?
Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations."
Completing all of the checklist items will automatically restore your
account access.
http://www.tamin.org/.CREDIT-UNION/update.php
Credit Union is constantly working to ensure security by regularly
screening the accounts in our system. We recently reviewed your account,
and we need more information to help us provide you with secure service.
Until we can collect this information, your access to sensitive account
features will be limited. We would like to restore your access as soon
as possible, and we apologize for the inconvenience.
--------------------------------------------------------------------------------
Why is my account access limited?
Your account access has been limited for the following reason(s):
* We would like to ensure that your account was not accessed by an
unauthorized third party. Because protecting the security of your
account is our primary concern, we have limited access to sensitive
Credit Union account features. We understand that this may be an
inconvenience but please understand that this temporary limitation is
for your protection.
(Your case ID for this reason is CU1-818-214-242146.)
At Credit Union, one of our most important responsibilities to you, our
customer, is the safekeeping of the nonpublic personal ("confidential")
information you have entrusted to us and using this information in a
responsible manner. Appropriate use of the confidential information you
provide us is also at the heart of our ability to provide you with
exceptional personal service whenever you contact us.
--------------------------------------------------------------------------------
How can I restore my account access?
Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations."
Completing all of the checklist items will automatically restore your
account access.
http://210.72.224.26/usage/webalizer.png/.CREDIT-UNION/update.php
Credit Union is constantly working to ensure security by regularly
screening the accounts in our system. We recently reviewed your account,
and we need more information to help us provide you with secure service.
Until we can collect this information, your access to sensitive account
features will be limited. We would like to restore your access as soon
as possible, and we apologize for the inconvenience.
--------------------------------------------------------------------------------
Why is my account access limited?
Your account access has been limited for the following reason(s):
* We would like to ensure that your account was not accessed by an
unauthorized third party. Because protecting the security of your
account is our primary concern, we have limited access to sensitive
Credit Union account features. We understand that this may be an
inconvenience but please understand that this temporary limitation is
for your protection.
(Your case ID for this reason is FCU1-GX833-234-P4TYUN1.)
At Credit Union, one of our most important responsibilities to you, our
customer, is the safekeeping of the nonpublic personal ("confidential")
information you have entrusted to us and using this information in a
responsible manner. Appropriate use of the confidential information you
provide us is also at the heart of our ability to provide you with
exceptional personal service whenever you contact us.
--------------------------------------------------------------------------------
How can I restore my account access?
Please confirm your identity here: Restore My Online Banking and complete the "Steps to Remove Limitations."
Completing all of the checklist items will automatically restore your
account access.
Virus/Malware
MalWare
Viruses, trojans, spyware, worms. They go by lots of different names but they are all "MalWare", code indented to damage, break into, or control computer equipment. MalWare is used to create Botnets or networks of infected computers, which are in turn used to launch Denial of Service Attacks. A recent virus has been specifically used to target anti-abuse sites like CastleCops and SpamCop. The Storm Worm also contains code that will insert messages onto blogs and forums from infected machines.
Recent EventsViruses
Spyware/AdWare/Scumware
Fake System Alerts
Worms
Recent Events
How the Malware Marketplace Works
Vista attacked by 13-year-old virus
Apple Macintoshes Targeted by Porn-Based Computer Virus
Feds: Fake Harassment Complaint E-Mail Contains Virus
Decade old virus infects Vista
Online Videos Could Infect Computers With Viruses, Study Finds
Viruses
This page provides an overview of some specific virus cases, what they are and how to stop them.
Sober Blaster
MyDoom Gone
Lovsan
If you are just looking for virus removal instructions or general information, try these links:
What are viruses, how do they work?(howstuffworks.com)
Protection and Detection
Research Viruses(ca.com)
Commentary on Windows and Viruses
Viruses Hoaxes(HoaxBustersHome.com)
Dissecting a Virus Attack
We have collected over 3100 virus emails since a large outbreak of the Sober Virus started on November 21th to study the messages, see where they are coming from and how different Internet Service Providers respond to the problem. To start with here is a breakdown of the sources of the virus emails. The exact IP address is not presented here since owner is probably an unwitting victim of a virus or hacker:| Source IP | Count | ISP | Started | Stopped | First Complaint | |
|---|---|---|---|---|---|---|
| 24.167.. | 1044 | Road Runner | 11/21/2005 | ? | 11/22/2005 | |
| 64.35.. | 95 | TDS | 11/25/2005 | 12/01/2005 | 11/27/2005 | |
| 67.151.. | 28 | PaeTec | 11/22/2005 | 11/24/2005 | 11/22/2005 | |
| 68.69.. | 63 | adelphia.net | 11/25/2005 | ? | 11/27/2005 | |
| 68.187.. | 1446 | charter.net | 11/21/2005 | ? | 11/22/2005 | |
| 69.40.. | 311 | alltel.net | 11/21/2005 | ? | 11/22/2005 | |
| 69.239.. | 171 | pacbell.net | 11/22/2005 | ? | 11/28/2005 | |
| 82.43.. | 6 | blueyonder.co.uk | 12/02/2005 | 12/05/2005 | 12/02/2005 | |
| 86.131.. | 24 | btbroadband.com | 11/22/2005 | ? | 11/29/2005 | |
| 221.135.. | 58 | sifycorp.com | 11/26/2005 | 12/03/2005 | 11/26/2005 |
This is not so much about the virus itself, but a discussion of how service providers or hosting companies address the issue. The quality of handling a virus attack and company policy varies greatly. For information about the virus and how to get rid of it, click here
adelphia.net
No direct link for abuse on the home page. Information about reporting
abuse is found on the FAQ link. When you forward headers to abuse@adelphia.net
they auto-reply quickly but there are no assurances in the reply that they will
address the problem and recommend that you buy antispam software. However, they do provide an incident number.
There have been no follow-ups to complaints other than the original auto-reply.
There is no way on their site to lodge a formal complaint or report unless
you are a customer with an ID and password.
alltel.net
Policy and contact email(abuse@alltel.net) is clearly marked on the Acceptable Use Policy page
linked from the home page. However, they do not reply to reports sent to this address so I tried
to file a complaint via a form an their website. These forms can be found under customer support
and are designed for troubleshooting customer issues and not reporting abuse.
blueyonder.co.uk
Stopped soon after being reported. The complaint was handled in a clear and professional manner.
btbroadband.com
There is a complaint contact form at their Contact Us link. Send
headers to abuse@btbroadband.com and they will reply with
an auto-message that directs you to obtain anti-spam software or use
mailbox filtering rules. The message contains this paragraph:
"I have carried out an investigation into this and have taken action
against our user to stop this happening again."
But I have trouble believing this since the virus email keeps coming.
charter.net
With nearly 1500 virus emails from a charter client spanning several weeks, I have very little faith
in their ability to address issues like this. Charter's website only has a complaint interface
for customers. Sending your headers to abuse@charter.net results in an auto-reply
that has no ticket number. There has been no follow-up. Awful.
pacbell.net
Very confusing. Complaints sent to abuse@pacbell.net result in replies from sbcglobal.net. The auto-reply
email directs you to file you complaint at a specific link, but the link is complaint form
for customers only who need help with DSL or Dial-up service. You have to provide an excessive amount
of personal information to file the complaint. I have not received any follow-up from these reports and
the virus emails keep coming.
PaeTec
Email stopped immediately after being reported.
rr.com
Headers forwarded to abuse@rr.com result in an instant auto-reply. They have a number
of contact methods here: http://security.rr.com/contact.htm but they are geared towards
customers. When you submit a complaint on their website, you get an email instructing you
to forward the headers to abuse@rr.com. The vicious circle!
sifycorp.com
Handled quickly and professionally. Emails have stopped.
tds.net
Handled quickly and professionally. Emails have stopped.
About Sober
Typical Virus Email Subjects
- Registration Confirmation Protected message is attached!
- hi, ive a new mail address hey its me, my old address dont work at time...
- Paris Hilton & Nicole Richie The Simple Life: View Paris Hilton...
- Your Password Account and Password Information are attached!
- smtp mail failed
- Mail delivery failed
You may have received many emails like the following:


These are junk messages but they are not exactly spam emails
because they are not selling anything. The sender addresses are
spoofed just like other junk mail. Downloading the attached file will
infect you PC with a virus. One mailbox we use
for this project has received over 2500 messages like this in 24 hours. 2500
messages seems like an overwhelming pile of junk that should just be deleted, but
that is exactly what the spammers want. By deleting the messages you are allowing
someone else the opportunity to be infected. Infected computers send more
virus emails. You have the power to stop
the buck at your mailbox. System administrators will only shutdown
virus sources if they are reported. But how do you research and report
2500 messages? What if I told you that these 2500 messages
were only coming from 10 locations. Even if you just report one, you are helping
stop the spread. Here is what you can do, you need to look at the headers
of the email. The headers will tell where the email really originated from.
Each email program has a different way to access the headers you may have to do a
little research view the headers. When you do, find the field value "Originating-IP."
The value will be series of four numbers separated by periods: 24.167.6.223.
This is an IP Address. Next, open a command-line DOS window(Start, Run, CMD).
At the prompt enter tracert -h 1 and the IP address and hit enter. Example:

Look at the line starting with "Tracing route..." and find the end of the string,
the "rr.com" is what we are interested in, this is host of the IP address. In this
case it is Road Runner ISP. Important: just because this is where
the viruses are originating it does not mean they are doing it on purpose. It more than
likely that the ISP is a victim of hacking and viruses. Go to the ISP's homepage and
find the contact email for abuse. Copy the entire header from your virus email and
forward it to the administrators. Just forward a small sample, a little reporting goes a long
way.
Removal Instructions/More information
ca.com
symantec.com
mcafee.com
NewDot Saga
Not only is NewDot difficult to remove, but they will sue you if you
talk about it. NewDot installs very easily by simply opening an email or web page.
NewDot's registry entry will try to launch this DLL on start-up:
C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL. If you delete the DLL and registry entry it will
reinstall. It may only be removed completely in safe mode.
Hijack this can help.
But NewDot is not done with you yet! They insist that their
hidden-install-forced-download-impossible-to-remove-browser-hijack is not
"spyware" but simply a new type of marketing and they will sue you if you say that
it is "spyware"(some call it "Foistware"). They have even filed a lawsuit
against the Internet Corporation For Assigned Names and Numbers for
discussing NewDot's business practices.
Letter to ICANN from NewDot
ICANN Response to NewDot
NewDot Sues Lavasoft
(LavaSoft is a recommended PC security tool)
Here is a case of someone from NewDot going into a spyware discussion blog
a telling users that NewDot is not spyware(see post #3):
pcreview.co.uk
NewDot has a large amount of information on the subject at their site, but since
we cannot guarantee that the site is safe we will not link to it directly.
Removal and Information
Removal Discussion Thread
spywaredata.com
cexx.org
cnet.com
Analyze your PC for threats
Lavasoft suit(pdf)
Blaster and SVCHOST.EXE
If you are running Windows 2000 and get an SVCHOST.EXE Application Error
when you use a dial-up connection you probably have the
Blaster virus.
When you get this error, open Task Manager and you should see msblast .exe in the program list.
Download the McAfee/Network Associates Stinger program which
will clean out Blaster and other virues and run it.
You will note that after you clean the virus, SVCHOST.EXE is still broken. You need to load a patch to
fix it
here.
This link may not be current. Click
here to search for additional links.
W32/Mydoom@mm
Avoid openning unscanned attachments. Delete emails with attachments from persons you don't know. If you've got it, then get stinger.exe to remove it.
Stinger 1.9.7 and the 4319 DATs will both require that infected Systems be rebooted to achieve complete removal of W32/Mydoom@mm.
The shimgapi.dll file is injected into the EXPLORER.EXE process if the system has been rebooted after the infection has occurred. In this situation, a reboot and rescan is required to remove this DLL from the system. McAfee information.
Gone.scr Virus: Case example of removing a virus manually
This virus hit Outlook email in 2001. "gone.scr" infects the Outlook address book through an
email attachment masked as a screen saver program.
Double-clicking the attachment infects the PC.
The virus then uses email addresses in the outlook address book
to forward the virus and message to more people in your name.
The program sits in C:\WINDOWS\SYSTEM and is hidden. The program
is constantly running and accessing Outlook. Under these conditions it cannot
be deleted.
Also, the virus creates a registry key which launches the program on boot. The
program also recreates the registry key if it's deleted or renamed.
In order to disinfect, the program and registry key must be deleted and this
cannot be done while Windows is running.
Follow these steps:
- Restart in DOS mode or to a boot disk
- On the command line type:
ATTRIB -R -A -S -H C:\WINDOWS\SYSTEM\gone.scr - Hit ENTER
- On the command line type:
DEL C:\WINDOWS\SYSTEM\gone.scr - Hit ENTER
- Restart the PC
- Go to Start, Run and type REGEDIT, click OK
- Find the key(by expanding the folders):
HKEY_CURRENT_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{C:\windows\system\gone.scr} - Select this key and delete it
- Also go to Start, Find and do a search for "gone.scr", There may be copies in temp folders.
- Emtpy the Recycle Bin
- Delete any emails with the attachment
- Empty the Outlook Deleted Items folder
Lovsan
An infected
machine (running msblast.exe or teekids.exe) will send out malformed packets
across the local subnet to the RPC service running on port 135. When these
packets are received by any unpatched system, it will create a buffer
overflow and crash the RPC service on that system. All this can occur
without the worm actually being on the machine. This means that the remote
shell will still get created on TCP port 4444, and the system may
unexpectedly crash upon receiving malformed exploit code.
Other symptoms may include:
- inability to cut/paste
- inability to move icons
- Add/Remove Programs list empty
- dll errors in most Microsoft Office programs
- generally slow, or unresponsive system performance
By applying the MS03-026 patch to the machine, it will prevent the RPC
service from failing, in-turn solving these symptoms. **It is very important
that the machine is rebooted after the patch has been installed.** The
machine can then be updated to the latest dats/engine/config and an
on-demand scan run to pickup msblast.exe or teekids.exe, IF it exists. I
must reiterate, all these symptoms are related to the RPC vulnerability and
not necessarily due to W32/Lovsan running locally. Msblast.exe/teekids.exe
may not be present at all.
Please visit the VIL links below for more information:
W32/Lovsan
(W32/Lovsan.b variant)
(W32/Lovsan.c variant)
(W32/Spybot.worm.lz which
exploits the same RPC vulnerability)
Protection and Detection
Both Norton(Symantec) and McAfee have free/trial downloads of anti-virus packages that will eliminate most viruses.Norton Virus Removal Tools
McAfee Free Scan
Spyware
Spyware "infects" your PC but does not have the same intent as a traditional virus. Spyware usually collects information from your cookies for advertising purposes, launches pop-ups and changes your default homepage. If your startup web page changes and you reset it but it changes back on reboot, you may have spyware.
Some spyware is legitimate, meaning it is part of something you intentionally downloaded. For example, you may have installed RealPlayer. RealPlayer checks your version for updates and upgrades and prompts you when new versions are available. They also launch popups for advertising. However, you are getting their product for free and if you uninstall it, the spayware goes away too.
It is important to note that these attacks are conducted by random hackers looking to damage personal PCs, but rather a targeted attempt by entities to control how you use the Internet and force advertising on you. They are doing this for money and it is not a prank.
The not-so-nice ones are very hard to get rid of sometimes. There are
many free programs that can help:
SpyBot - Search and destroy
Spyware Blaster
Hijackthis
CWShredder
U.S. House approves less stringent anti-spyware bill(05.22.07)
Lavasoft Ad-Ware, recomended purchase product for protection and removal

ZQuest
ZQuest is a Trojan that can be spread through email, web pages and instant messages. ZQuest forces pop-ups and modifies viewed web pages on the fly. ZQuest may show up along side an infection of SurfSideKick. The registry key needs to be deleted in safe mode:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{22131A58-5F9A-3EAA-28A7-C3059A3D0632}
May force your browser to topconverting.com, revenue.net, zwoops.com, Z-QUEST.COM, and other sites.
Information and Removal
symantec.com
nai.com
scanspyware.net
More "It's Not Spyaware" Claims - SurfSideKick
According to the SurfSideKick website: "Surf Sidekick guides relevant web sites to you at the precise moment you are actually interested in them. Just browse the internet as you normally do and ... ." Similar to NewDot they claim that it is not spyware and "helps" users search the web. There is one problem with that claim, SurfSideKick installs without the user's permission or knowledge.Registry key: HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe must be deleted in safe mode.
Information and Removal
Ssk - Ssk.exe - Process Information
Ssk.exe is Adware.SurfSideKick greatis.com
Alias: SurfSideKick 2 sunbelt-software.com
SurfSideKick Removal majorgeeks.com
SurfSideKick ca.com
HOW TO REMOVE SSK.EXE (surfsidekick 2) techsupportforum.com
Hijackthis logfile....please help techsupportforum.com
MIRAR
Have you noticed an additional toolbar on your Browser called MIRAR? If so you have a spyware virus on your PC. The "uninstall" link for MIRAR actually links to their website and phony form that requests personal information that has nothing to with uninstalling the program. Never fill forms like this out.
The purpose here is to a) deter people from uninstalling the spyware or b) gather more personal information.
The following sites are associated with this spyaware:
mirarsearch.com
getnirar.com
net-nucleus.com
mt-download.com
adservs.com
findthewebsiteyouneed.com
Removal
http://www.spyany.com/program/article_spw_rm_Mirar.html
http://www.nuker.com/container/details/mirar_toolbar.php
Fake Spyware Scans
You may have had a pop-up window like the one below:
Do not click on the links in this window. These advertised scans are often launched by viruses or spyware that have already infected your PC. Downloading the software will "fix" the virus problem and in turn expose you to more spyware and viruses. Some companies have infected PCs with spyware and then billed users to have them removed. The above pop-up links to web-update.org and scanandrepair.com. They are listed as "Rogue/Suspect Anti-Spyware Products & Web Sites" by spywarewarrior.com. Read more.
oneclicksearches.com and psguard.com
oneclicksearches.com and psguard.com use Trojan.ByteVerify and variants to infect your PC.What do oneclicksearches.com and psguard.com do to you?
- Sets default homepage to: oneclicksearches.com
- Turns on Active Desktop and defaults the page to %SystemRoot%\system32\\wppp.html which is psguard.com
- Installs these programs in c:\winnt\system32\
down1.exe
hhk.dll
hpF443.tmp
intell32.exe
intmon.exe
msmsgs.exe
oleext32.dll
shnlog.exe
uninstIU.exe
wppp.html
- Sets up a fake "Virus Alert" in your task bar. Clicking on the "alert" brings you to psguard.com where they try to sell you anti-spyware software.
- The oneclicksearches.com home page uses hijacked microsoft.com icons so the site looks like a Windows security page.
- Sets hundreds, possibly thousands of registry keys pointing to oneclicksearches.com
What you can do about it
- If you don't already have anti-virus software, get some. If you do have it, update the definitions lists. There are free anti-virus packages available from symantec and mcafee. Download stinger.exe.
- Disconnect from the Internet/Network
- Reboot in Safe Mode with Network support(reboot and hold F8)
- Run the anti-virus software in Safe Mode
- Disable Active Desktop(Control Panel, Folder Options)
- Do a search for the files listed above and delete them
- Open the Registry editor(Start, Run, regedit) and do a search for all keys with "oneclicksearches.com" and delete them. Do the same for "wppp.html" and "psguard.com"
- If you know approximately when you got the virus, do a search on your PC for any file created since that time. More than likely you will see recently created EXEs in the system32 folder. Rename these files rather than delete them just in case they are not part of the virus.
- Open a browser(while stil off-line!) and delete all cookies, cache, temp files, bookmarks that were added by the virus and change your home page back to what it was.
- Reboot your PC and test to see if the viruses are gone
- oneclicksearches.com psguard.com are registered through ESTDOMAINS, file a complaint with estdomains.com.
- Email the admins for oneclicksearches.com psguard.com at dep@sexpicsporn.com and psguard@ua.fm and tell them how disgusted you are with their tactics.
- File a complaint with the BBB
- File a complaint with FTC
Gator/GAIN
One of the earliest and most well-known examples. Often comes bundled with downloaded freeware or shareware like KaZaA, weatherbug, Napster, and the like. Gator launches adds and redirects your searches to their selected products. Having Gator installed will expose you to other types of spyware.Removal: In Gator's case you may be able to remove it through Add/Remove Software in the Control Panel. To be sure find and delete the following files:
iegator.dll
fsg.exe
fsg-ag.exe
GMT.exe
Do a Registry search for it also and delete the keys in ...\Current Version\Run and ...\Current Version\RunOnce
Xupiter
An example of Brower Hijacking is the Xupiter toolbar. Keeps resetting your homepage to Xupiter.com, adds a toolbar and launches popups. Use these instructions: pchell.com to remove it, then send an email to help@xupiter.com, support@xupiter.com, and dnsadmin@tucows.com telling them you do not like their spyware advertising tactics.fastsearch.cc
What a pain this one is. Sets registry keys for startup pages tohttp://%69%6e%2e%77%65%62%63%6f%75%6e%74%65%72%2e%63%63/%2d%2d/?%79%64%74%66%73.
Why? The % followed by numbers and letters are hexidecimal numbers. %69 = i, %6e = n, etc. The entire string decoded is: in.webcounter.cc/--/?ydtfs, this page redirects your browser to fastsearch.cc(.cc is Cocos Islands). The reasons: for one, you cannot put the % in your web blocking list. Then, your browser keeps resolving to fastsearch.cc, but if you search your harddrive, cache and registry "fastsearch.cc" wont come up. This is called obfuscation.
This was apparently caused by CWS.Tapicfg a variant of the CoolWebSearch. It's named so because CoolWebSearch.com was one of the first ones to use it.
SpyBot, spywareblaster, and HijackThis did not clean it out but CWShredder did get it.
After you have cleaned out webcounter.cc or fastsearch.cc send and email to:
Helen Bauer - webmaster@fastsearch.cc and Katsuji Yoneyama - webmaster@webcounter.cc expressing your disgust at their advertising tactics.
To reduce the risk of spywear infection, load Spyware Blaster which will block specific spyware packages and also increase the security on your browser settings, specifically blocking or prompting for stylesheet downloads.
More Info:
Anti-spyware guidelines get final version(msn-cnet.com 01/12/2006)
Information Kit: Spyware
Whatis.com
spychecker.com
cexx.org
grc.com
spywareinfo.com
Spyware forum
Worms
Computer worm (wikipedia.org)The Internet Worm of 1988 (std.com)
Fighting Internet Worms With Honeypots (securityfocus.com)
The Internet Worm Program: An Analysis (purdue.edu)
A REPORT ON THE INTERNET WORM (ryerson.ca)
What is an internet worm? (bbc.co.uk)
Monitoring and Early Warning for Internet Worms (blog.namics.com)
Fake System Alerts
Have you ever seen one of these?
This is not a real system message it is a junk message made to look like a system message. Sites associated with this kind of fake system message:
fix-ms.com
set32.com
patchupdate.info
gerfixit.com
windowsrepair.net
msregistryupdate.com
pcspywarescan.com
uric.com
Don't go to any of these sites. You can stop the messages by disabling Windows Messenger Service(Control Panel, Admin Tools, Select "Services", find the "Messenger" service, right-click and Stop. Also set to manual or disabled rather than automatic or boot). This is not the same as Instant Messaging.
More Information:
dell.com/supportforums
aumha.org
blogharbor.com/hacked/
Viruses
This page provides an overview of some specific virus cases, what they are and how to stop them.
Sober Blaster
MyDoom Gone
Lovsan
If you are just looking for virus removal instructions or general information, try these links:
What are viruses, how do they work?(howstuffworks.com)
Protection and Detection
Research Viruses(ca.com)
Commentary on Windows and Viruses
Viruses Hoaxes(HoaxBustersHome.com)
Dissecting a Virus Attack
I have collected over 3100 virus emails since a large outbreak of the Sober Virus started on November 21th to study the messages, see where they are coming from and how different Internet Service Providers respond to the problem. To start with here is a breakdown of the sources of the virus emails. The exact IP address is not presented here since owner is probably an unwitting victim of a virus or hacker:| Source IP | Count | ISP | Started | Stopped | First Complaint | |
|---|---|---|---|---|---|---|
| 24.167.. | 1044 | Road Runner | 11/21/2005 | On-going | 11/22/2005 | |
| 64.35.. | 95 | TDS | 11/25/2005 | 12/01/2005 | 11/27/2005 | |
| 67.151.. | 28 | PaeTec | 11/22/2005 | 11/24/2005 | 11/22/2005 | |
| 68.69.. | 63 | adelphia.net | 11/25/2005 | On-going | 11/27/2005 | |
| 68.187.. | 1446 | charter.net | 11/21/2005 | On-going | 11/22/2005 | |
| 69.40.. | 311 | alltel.net | 11/21/2005 | On-going | 11/22/2005 | |
| 69.239.. | 171 | pacbell.net | 11/22/2005 | On-going | 11/28/2005 | |
| 82.43.. | 6 | blueyonder.co.uk | 12/02/2005 | 12/05/2005 | 12/02/2005 | |
| 86.131.. | 24 | btbroadband.com | 11/22/2005 | On-going | 11/29/2005 | |
| 221.135.. | 58 | sifycorp.com | 11/26/2005 | 12/03/2005 | 11/26/2005 |
This is not so much about the virus itself, but a discussion of how service providers or hosting companies address the issue. The quality of handling a virus attack and company policy varies greatly. For information about the virus and how to get rid of it, click here
adelphia.net
No direct link for abuse on the home page. Information about reporting
abuse is found on the FAQ link. When you forward headers to abuse@adelphia.net
they auto-reply quickly but there are no assurances in the reply that they will
address the problem and recommend that you buy antispam software. However, they do provide an incident number.
There have been no follow-ups to complaints other than the original auto-reply.
There is no way on their site to lodge a formal complaint or report unless
you are a customer with an ID and password.
alltel.net
Policy and contact email(abuse@alltel.net) is clearly marked on the Acceptable Use Policy page
linked from the home page. However, they do not reply to reports sent to this address so I tried
to file a complaint via a form an their website. These forms can be found under customer support
and are designed for troubleshooting customer issues and not reporting abuse.
blueyonder.co.uk
Stopped soon after being reported. The complaint was handled in a clear and professional manner.
btbroadband.com
There is a complaint contact form at their Contact Us link. Send
headers to abuse@btbroadband.com and they will reply with
an auto-message that directs you to obtain anti-spam software or use
mailbox filtering rules. The message contains this paragraph:
"I have carried out an investigation into this and have taken action
against our user to stop this happening again."
But I have trouble believing this since the virus email keeps coming.
charter.net
With nearly 1500 virus emails from a charter client spanning several weeks, I have very little faith
in their ability to address issues like this. Charter's website only has a complaint interface
for customers. Sending your headers to abuse@charter.net results in an auto-reply
that has no ticket number. There has been no follow-up. Awful.
pacbell.net
Very confusing. Complaints sent to abuse@pacbell.net result in replies from sbcglobal.net. The auto-reply
email directs you to file you complaint at a specific link, but the link is complaint form
for customers only who need help with DSL or Dial-up service. You have to provide an excessive amount
of personal information to file the complaint. I have not received any follow-up from these reports and
the virus emails keep coming.
PaeTec
Email stopped immediately after being reported.
rr.com
Headers forwarded to abuse@rr.com result in an instant auto-reply. They have a number
of contact methods here: http://security.rr.com/contact.htm but they are geared towards
customers. When you submit a complaint on their website, you get an email instructing you
to forward the headers to abuse@rr.com. The vicious circle!
sifycorp.com
Handled quickly and professionally. Emails have stopped.
tds.net
Handled quickly and professionally. Emails have stopped.
About Sober
Typical Virus Email Subjects
Registration Confirmation Protected message is attached!hi, ive a new mail address hey its me, my old address dont work at time...
Paris Hilton & Nicole Richie The Simple Life: View Paris Hilton...
Your Password Account and Password Information are attached!
smtp mail failed
Mail delivery failed
Removal Instructions/More information
ca.comsymantec.com
mcafee.com
Surviving a Virus Attack
By now you have probably received many emails like the following:

These are junk messages but they are not exactly spam emails because they are not selling anything. The sender addresses are spoofed just like other junk mail. Downloading the attached file will infect you PC with a virus. One mailbox I use for this project has received over 2500 messages like this in 24 hours. 2500 messages seems like an overwhelming pile of junk that should just be deleted, but that is exactly what the spammers want. By deleting the messages you are allowing someone else the opportunity to be infected. Infected computers send more virus emails. You have the power to stop the buck at your mailbox. System administrators will only shutdown virus sources if they are reported. But how do you research and report 2500 messages? What if I told you that these 2500 messages were only coming from 10 locations. Even if you just report one, you are helping stop the spread. Here is what you can do, you need to look at the headers of the email. The headers will tell where the email really originated from. Each email program has a different way to access the headers you may have to do a little research view the headers. When you do, find the field value "Originating-IP." The value will be series of four numbers separated by periods: 24.167.6.223. This is an IP Address. Next, open a command-line DOS window(Start, Run, CMD). At the prompt enter tracert -h 1 and the IP address and hit enter. Example:

Look at the line starting with "Tracing route..." and find the end of the string, the "rr.com" is what we are interested in, this is host of the IP address. In this case it is Road Runner ISP. Important: just because this is where the viruses are originating it does not mean they are doing it on purpose. It more than likely that the ISP is a victim of hacking and viruses. Go to the ISP's homepage and find the contact email for abuse. Copy the entire header from your virus email and forward it to the administrators. Just forward a small sample, a little reporting goes a long way.
NewDot Saga
Not only is NewDot difficult to remove, but they will sue you if you
talk about it. NewDot installs very easily by simply opening an email or web page.
NewDot's registry entry will try to launch this DLL on start-up:
C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL. If you delete the DLL and registry entry it will
reinstall. It may only be removed completely in safe mode.
Hijack this can help.
But NewDot is not done with you yet! They insist that their
hidden-install-forced-download-impossible-to-remove-browser-hijack is not
"spyware" but simply a new type of marketing and they will sue you if you say that
it is "spyware"(some call it "Foistware"). They have even filed a lawsuit
against the Internet Corporation For Assigned Names and Numbers for
discussing NewDot's business practices.
Letter to ICANN from NewDot
ICANN Response to NewDot
NewDot Sues Lavasoft
(LavaSoft is a recommended PC security tool)
Here is a case of someone from NewDot going into a spyware discussion blog
a telling users that NewDot is not spyware(see post #3):
pcreview.co.uk
NewDot has a large amount of information on the subject at their site, but since
we cannot guarantee that the site is safe we will not link to it directly.
Removal and Information
Removal Discussion Thread
spywaredata.com
cexx.org
cnet.com
Analyze your PC for threats
Lavasoft suit(pdf)
Blaster and SVCHOST.EXE
If you are running Windows 2000 and get an SVCHOST.EXE Application Error
when you use a dial-up connection you probably have the
Blaster virus.
When you get this error, open Task Manager and you should see msblast .exe in the program list.
Download the McAfee/Network Associates Stinger program which
will clean out Blaster and other virues and run it.
You will note that after you clean the virus, SVCHOST.EXE is still broken. You need to load a patch to
fix it
here.
This link may not be current. Click
here to search for additional links.
W32/Mydoom@mm
Avoid openning unscanned attachments. Delete emails with attachments from persons you don't know. If you've got it, then get stinger.exe to remove it.
Stinger 1.9.7 and the 4319 DATs will both require that infected Systems be rebooted to achieve complete removal of W32/Mydoom@mm.
The shimgapi.dll file is injected into the EXPLORER.EXE process if the system has been rebooted after the infection has occurred. In this situation, a reboot and rescan is required to remove this DLL from the system. McAfee information.
Gone.scr Virus: Case example of removing a virus manually
A new virus hit Outlook email on 12.04.01. It's called "gone.scr" and infects the Outlook address book through an email attachment masked as a screen saver program.Double-clicking the attachment infects the PC.
The virus then uses email addresses in the outlook address book to forward the virus and message to more people in your name.
The program sits in C:\WINDOWS\SYSTEM and is hidden. The program is constantly running and accessing Outlook. Under these conditions it cannot be deleted.
Also, the virus creates a registry key which launches the program on boot. The program also recreates the registry key if it's deleted or renamed.
In order to disinfect, the program and registry key must be deleted and this cannot be done while Windows is running.
Follow these steps:
- Restart in DOS mode or to a boot disk
- On the command line type:
ATTRIB -R -A -S -H C:\WINDOWS\SYSTEM\gone.scr - Hit ENTER
- On the command line type:
DEL C:\WINDOWS\SYSTEM\gone.scr - Hit ENTER
- Restart the PC
- Go to Start, Run and type REGEDIT, click OK
- Find the key(by expanding the folders):
HKEY_CURRENT_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{C:\windows\system\gone.scr} - Select this key and delete it
- Also go to Start, Find and do a search for "gone.scr", There may be copies in temp folders.
- Emtpy the Recycle Bin
- Delete any emails with the attachment
- Empty the Outlook Deleted Items folder
Lovsan
An infected
machine (running msblast.exe or teekids.exe) will send out malformed packets
across the local subnet to the RPC service running on port 135. When these
packets are received by any unpatched system, it will create a buffer
overflow and crash the RPC service on that system. All this can occur
without the worm actually being on the machine. This means that the remote
shell will still get created on TCP port 4444, and the system may
unexpectedly crash upon receiving malformed exploit code.
Other symptoms may include:
- inability to cut/paste
- inability to move icons
- Add/Remove Programs list empty
- dll errors in most Microsoft Office programs
- generally slow, or unresponsive system performance
By applying the MS03-026 patch to the machine, it will prevent the RPC
service from failing, in-turn solving these symptoms. **It is very important
that the machine is rebooted after the patch has been installed.** The
machine can then be updated to the latest dats/engine/config and an
on-demand scan run to pickup msblast.exe or teekids.exe, IF it exists. I
must reiterate, all these symptoms are related to the RPC vulnerability and
not necessarily due to W32/Lovsan running locally. Msblast.exe/teekids.exe
may not be present at all.
Please visit the VIL links below for more information:
W32/Lovsan
(W32/Lovsan.b variant)
(W32/Lovsan.c variant)
(W32/Spybot.worm.lz which
exploits the same RPC vulnerability)
Protection and Detection
Both Norton(Symantec) and McAfee have free/trial downloads of anti-virus packages that will eliminate most viruses.Norton Virus Removal Tools
McAfee Free Scan
Spyware
Spyware "infects" your PC but does not have the same intent as a traditional virus. Spyware usually collects information from your cookies for advertising purposes, launches pop-ups and changes your default homepage. If your startup web page changes and you reset it but it changes back on reboot, you may have spyware.
Some spyware is legitimate, meaning it is part of something you intentionally downloaded. For example, you may have installed RealPlayer. RealPlayer checks your version for updates and upgrades and prompts you when new versions are available. They also launch popups for advertising. However, you are getting their product for free and if you uninstall it, the spayware goes away too.
It is important to note that these attacks are conducted by random hackers looking to damage personal PCs, but rather a targeted attempt by entities to control how you use the Internet and force advertising on you. They are doing this for money and it is not a prank.
The not-so-nice ones are very hard to get rid of sometimes. There are
many free programs that can help:
SpyBot - Search and destroy
Spyware Blaster
Hijackthis
CWShredder
Lavasoft Ad-Ware, recomended purchase product for protection and removal

ZQuest
ZQuest is a Trojan that can be spread through email, web pages and instant messages. ZQuest forces pop-ups and modifies viewed web pages on the fly. ZQuest may show up along side an infection of SurfSideKick. The registry key needs to be deleted in safe mode:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{22131A58-5F9A-3EAA-28A7-C3059A3D0632}
May force your browser to topconverting.com, revenue.net, zwoops.com, Z-QUEST.COM, and other sites.
Information and Removal
symantec.com
nai.com
scanspyware.net
More "It's Not Spyaware" Claims - SurfSideKick
According to the SurfSideKick website: "Surf Sidekick guides relevant web sites to you at the precise moment you are actually interested in them. Just browse the internet as you normally do and ... ." Similar to NewDot they claim that it is not spyware and "helps" users search the web. There is one problem with that claim, SurfSideKick installs without the user's permission or knowledge.Registry key: HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe must be deleted in safe mode.
Information and Removal
Ssk - Ssk.exe - Process Information
Ssk.exe is Adware.SurfSideKick greatis.com
Alias: SurfSideKick 2 sunbelt-software.com
SurfSideKick Removal majorgeeks.com
SurfSideKick ca.com
HOW TO REMOVE SSK.EXE (surfsidekick 2) techsupportforum.com
Hijackthis logfile....please help techsupportforum.com
NewDot Saga
Not only is NewDot difficult to remove, but they will sue you if you
talk about it. NewDot installs very easily by simply opening an email or web page.
NewDot's registry entry will try to launch this DLL on start-up:
C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL. If you delete the DLL and registry entry it will
reinstall. It may only be removed completely in safe mode.
Hijack this can help.
But NewDot is not done with you yet! They insist that their
hidden-install-forced-download-impossible-to-remove-browser-hijack is not
"spyware" but simply a new type of marketing and they will sue you if you say that
it is "spyware"(some call it "Foistware"). They have even filed a lawsuit
against the Internet Corporation For Assigned Names and Numbers for
discussing NewDot's business practices.
Letter to ICANN from NewDot
ICANN Response to NewDot
NewDot Sues Lavasoft
(LavaSoft is a recommended PC security tool)
Here is a case of someone from NewDot going into a spyware discussion blog
a telling users that NewDot is not spyware(see post #3):
pcreview.co.uk
NewDot has a large amount of information on the subject at their site, but since
we cannot guarantee that the site is safe we will not link to it directly.
Removal and Information
Removal Discussion Thread
spywaredata.com
cexx.org
cnet.com
Analyze your PC for threats
Lavasoft suit(pdf)
MIRAR
Have you noticed an additional toolbar on your Browser called MIRAR? If so you have a spyware virus on your PC. The "uninstall" link for MIRAR actually links to their website and phony form that requests personal information that has nothing to with uninstalling the program. Never fill forms like this out.
The purpose here is to a) deter people from uninstalling the spyware or b) gather more personal information.
The following sites are associated with this spyaware:
mirarsearch.com
getnirar.com
net-nucleus.com
mt-download.com
adservs.com
findthewebsiteyouneed.com
Removal
http://www.spyany.com/program/article_spw_rm_Mirar.html
http://www.nuker.com/container/details/mirar_toolbar.php
Fake Spyware Scans
You may have had a pop-up window like the one below:
Do not click on the links in this window. These advertised scans are often launched by viruses or spyware that have already infected your PC. Downloading the software will "fix" the virus problem and in turn expose you to more spyware and viruses. Some companies have infected PCs with spyware and then billed users to have them removed. The above pop-up links to web-update.org and scanandrepair.com. They are listed as "Rogue/Suspect Anti-Spyware Products & Web Sites" by spywarewarrior.com. Read more.
oneclicksearches.com and psguard.com
oneclicksearches.com and psguard.com use Trojan.ByteVerify and variants to infect your PC.What do oneclicksearches.com and psguard.com do to you?
- Sets default homepage to: oneclicksearches.com
- Turns on Active Desktop and defaults the page to %SystemRoot%\system32\\wppp.html which is psguard.com
- Installs these programs in c:\winnt\system32\
down1.exe
hhk.dll
hpF443.tmp
intell32.exe
intmon.exe
msmsgs.exe
oleext32.dll
shnlog.exe
uninstIU.exe
wppp.html
- Sets up a fake "Virus Alert" in your task bar. Clicking on the "alert" brings you to psguard.com where they try to sell you anti-spyware software.
- The oneclicksearches.com home page uses hijacked microsoft.com icons so the site looks like a Windows security page.
- Sets hundreds, possibly thousands of registry keys pointing to oneclicksearches.com
What you can do about it
- If you don't already have anti-virus software, get some. If you do have it, update the definitions lists. There are free anti-virus packages available from symantec and mcafee. Download stinger.exe.
- Disconnect from the Internet/Network
- Reboot in Safe Mode with Network support(reboot and hold F8)
- Run the anti-virus software in Safe Mode
- Disable Active Desktop(Control Panel, Folder Options)
- Do a search for the files listed above and delete them
- Open the Registry editor(Start, Run, regedit) and do a search for all keys with "oneclicksearches.com" and delete them. Do the same for "wppp.html" and "psguard.com"
- If you know approximately when you got the virus, do a search on your PC for any file created since that time. More than likely you will see recently created EXEs in the system32 folder. Rename these files rather than delete them just in case they are not part of the virus.
- Open a browser(while stil off-line!) and delete all cookies, cache, temp files, bookmarks that were added by the virus and change your home page back to what it was.
- Reboot your PC and test to see if the viruses are gone
- oneclicksearches.com psguard.com are registered through ESTDOMAINS, file a complaint with estdomains.com.
- Email the admins for oneclicksearches.com psguard.com at dep@sexpicsporn.com and psguard@ua.fm and tell them how disgusted you are with their tactics.
- File a complaint with the BBB
- File a complaint with FTC
Gator/GAIN
One of the earliest and most well-known examples. Often comes bundled with downloaded freeware or shareware like KaZaA, weatherbug, Napster, and the like. Gator launches adds and redirects your searches to their selected products. Having Gator installed will expose you to other types of spyware.Removal: In Gator's case you may be able to remove it through Add/Remove Software in the Control Panel. To be sure find and delete the following files:
iegator.dll
fsg.exe
fsg-ag.exe
GMT.exe
Do a Registry search for it also and delete the keys in ...\Current Version\Run and ...\Current Version\RunOnce
Xupiter
An example of Brower Hijacking is the Xupiter toolbar. Keeps resetting your homepage to Xupiter.com, adds a toolbar and launches popups. Use these instructions: pchell.com to remove it, then send an email to help@xupiter.com, support@xupiter.com, and dnsadmin@tucows.com telling them you do not like their spyware advertising tactics.fastsearch.cc
What a pain this one is. Sets registry keys for startup pages tohttp://%69%6e%2e%77%65%62%63%6f%75%6e%74%65%72%2e%63%63/%2d%2d/?%79%64%74%66%73.
Why? The % followed by numbers and letters are hexidecimal numbers. %69 = i, %6e = n, etc. The entire string decoded is: in.webcounter.cc/--/?ydtfs, this page redirects your browser to fastsearch.cc(.cc is Cocos Islands). The reasons: for one, you cannot put the % in your web blocking list. Then, your browser keeps resolving to fastsearch.cc, but if you search your harddrive, cache and registry "fastsearch.cc" wont come up. This is called obfuscation.
This was apparently caused by CWS.Tapicfg a variant of the CoolWebSearch. It's named so because CoolWebSearch.com was one of the first ones to use it.
SpyBot, spywareblaster, and HijackThis did not clean it out but CWShredder did get it.
After you have cleaned out webcounter.cc or fastsearch.cc send and email to:
Helen Bauer - webmaster@fastsearch.cc and Katsuji Yoneyama - webmaster@webcounter.cc expressing your disgust at their advertising tactics.
To reduce the risk of spywear infection, load Spyware Blaster which will block specific spyware packages and also increase the security on your browser settings, specifically blocking or prompting for stylesheet downloads.
More Info:
Anti-spyware guidelines get final version(msn-cnet.com 01/12/2006)
Information Kit: Spyware
Whatis.com
spychecker.com
cexx.org
grc.com
spywareinfo.com
Spyware forum
BotNets and Zombies
What is a Botnet? It is a network of hijacked machines connected to the Internet. The machines often become infected by specially designed virus programs( malware) or have some other security exploit(hack). These hijacked/infected are referred to as "zombies", so a zombie is a node on a Botnet. Also called Drone Armies.Botnets can be used for many different tasks: sending spam, spreading viruses, hosting phishing sites, launching Denial of Service Attacks, and as platforms for network intrusions. In days gone by, computer time and computer storage space were expensive and hard to come by. It was common for hackers to "steal" processor time or disk space. However, now computers are cheap and easy to get, botnets generally have much more sinister applications.
Most real spam likely comes from infected PCs. This is why email header tracing has become an ineffective method for fighting spam. Following the path an email has traveled will only lead you to a victim's PC. Not only that, it is a crap-shoot when it comes to ISP response. We have documented cases where it has taken weeks of constant reporting and complaints for an ISP to shutdown an infected PC. In the meantime, the infected PCs have sent out millions of junk emails.
Because the Internet grows every day and because of the lack of standards and user knowledge, the threat of botnets will continue to increase. The problem has also expanded because cheap high-speed connections mean users leave their home PCs on and connected for extended and unsupervised periods.
For home users we always recommend:
- Shutting off your DSL/Cable Modem when not in use
- Recycling your modem regularly, this means powering it down or unplugging it to refresh the IP
- Keeping OS security updates current
- Running updated virus scans after Internet use(And run these in safe or command line mode occasionally)
For corporate users we always recommend:
- Having an independently certified security audit
- Dedicated network security staff
- Running regular network-wide virus scans
- Documented policies and procedures for handling intrusions and methods for informing the public/customers/shareholders
To take action educate yourself with the articles below and check out the Independent System Operator Task Force (isotf.org). They issue alerts, reports and have an interface for reporting Botnets. You can see in their reports that it is common for an ISP to have hundreds of intrusions per month and many have huge percentages of cases that go unresolved for extended periods.
Recent (02.14.07)
A virus has been spreading recently that was specifically designed to launch a denial of service attack against anti-spam websites. So far CastleCops has been one of the biggest victims but spamhaus and SpamCop have also been targeted. This tactic is not new, similar event in 2003 with the Mimail worm ,but it is becoming more severe.
Storm Worm DDoS Attack (secureworks.com)
Botnet with reference to SANS (isc.sans.org)
Imperfect Storm aids spammers (securityfocus.com)
Articles
Fraudsters Declare War on Anti-Scam Services(computerworld.com.au)
Software vulnerabilities spiked 39 percent in 2006(computerworld.com.au)
Malware Attacks Getting Much Worse (crm-daily.com)
Internet guru warns of botnet pandemic(zdnet.co.uk)
Net pioneer predicts overwhelming botnet surge(zdnetindia.com)
What Is A Bot? (netsecurity.about.com)
Is your computer part of a criminal network? (theglobeandmail.com)
Are hackers using your PC to spew spam and steal? (usatoday.com)
What good are 1,000 remote-controlled PCs? (cnet.com)
Is your computer a “zombie”? You could lose your email access if it is! (crt.net.au)
THE CASE OF THE “ZOMBIE KING” (fbi.gov)
Quicky Analysis of a Proxy/Zombie Network (lowkeysoft.com)
software
Software Junk
What is it?Unwanted email advertising ridiculously low prices for name brand software products.
Why is it a problem?The advertised items are more than likely pirated versions of the software.
How would it effect me?This is a list of issues people have experienced when buying software like this:
- Software arrives on obviously pirated CDs and not in the "cereal box" container
- The delivered product is not the advertised version. Example: Full Professional version is advertised but a limited version is delivered.
- The software wont load. Reasons could be that your computer devices recognize that the disks are not authorized versions because of advanced pirating security tools or that this disks simply contain errors because they were not copied properly.
- The software will not function with other legal components installed on your computer.
- Companies using pirated sotware may be fined.
- Customers who experience a problem find it impossible to get support, return the product, or obtain a refund.
- Pirate software may contain malware
What can be done?
Samples



Counterfeit goods
Counterfeit Goods
What is it?Most often advertising "replica" name-brand watches but nearly every consumer good has been noted from electronics to clothing to jewelry. There is a non-junk mail component to the counterfeiting world that involves fake credit cards, currency, checks and other negotiable items.
Why is it a problem?Counterfeits are usually produced by organized criminal groups. Purchases of these goods can fund other criminal activities down the line like narcotics, human smuggling, weapons sales and terrorism. Fake products are often manufactured in "sweatshop" or slavery-like conditions, including child labor and possibly prison labor. Some fake products have been known to explode or poison users. Global illicit traffic is now a $600 Billion industry, representing 7-9% of all global trade, a considerable increase from previous decades. This increase is being partially driven by the growth in Internet commerce and electronic fraud.
How would it effect me?Trying to get a refund, replacement or any kind of customer service for one of these items is impossible.
If the items are stolen rather than faux the purchaser is part of the crime. People may cynically think: "Who cares?
Fendi and Louis Viton over-charge for handbags, I'm not hurting anyone by buying a knock-off." Wrong.
"It’s cheap for a reason. It’s cheap because it’s probably been made by someone who’s exploited, indentured servant or even child labor..."
(tillekeandgibbins.com/Publications/pdf/dark_underbelly_counterfeit_handbags.pdf). If you are concerned about the
quality and lifespan of a product it just isn't there with counterfeit goods.
Scope of Global IP Piracy and Counterfeiting Problem (ogc.doc.gov)
Cases
View Samples What can be done?
Send the junk mail to fake@coldrain.net
Resources and Information
GeneralCounterfeit Gourmet Crabs(and tracking systems) (cs.virginia.edu)
Fake Disney Park in China (cnn.com)
Counterfeit Super Bowl tickets will surface, buyer beware (trb.com)
Despite security, fake Super Bowl tickets persist (abcactionnews.com)
Counterfeit Disney Dollars (mouseplanet.com)
Wartime Counterfeit Postage (psywar.org)
Road Atlas "copyright traps" (straightdope.com)
Counterfeit Subway Tokens (fbi.gov)
Pirates and bootleggers beware (direct.gov.uk)
Product Counterfeits Can Be Dangerous, Deadly (wnbc.com)
The cost of piracy to UK businesses amounts to over GBP 10 billion according to the Alliance Against Counterfeiting and Piracy. (manufacturingtalk.com)
Bayh bill protects intellectual property (fortwayne.com)
Counterfeit Drugs: Coming to a Pharmacy Near You (acsh.org)
Counterfeit Capsules and Phony Pills (acsh.org)
SWITZERLAND: Global food industry unites against counterfeiting (just-food.com)
South-east Asia awash with fake drugs (guardian.co.uk)
Federal Industry Committee's Call For Action On Counterfeiting and Piracy Welcomed By Canadian Anti-Counterfeiting Network (cnw.ca)
ALLDATA wins case against pirating and counterfeiting of registered trademark by Long Beach-based business computers, networks and software distributor (abrn.com)
Survey: More Enforcement Will Stop Counterfeiting (chinacsr.com)
Police Seize Suspected Counterfeit Clothing At Valley Mall Store (rocktownweekly.com)
Global congress calls for greater effort, resources in combating counterfeiting & piracy (themanufacturer.com)
Flood Of Knockoffs Triggers Wide Crackdown (cbsnews.com)
Customs Dept. to Observe Week from January 21-27 (jis.gov.jm)
Knocking out China's knock-offs (atimes.com)
Miami Man Arrested for Counterfeiting Prescription Drug Labels (allamericanpatriots.com)
Nine arrested in counterfeiting raid (thisisthenortheast.co.uk)
OSU 'Gets Real' about fakes (thelantern.com)
Nations join forces to check counterfeit boom (swissinfo.org)
Global Industry Leaders Cite Survey In Quest For A Counterfeit/Piracy-Free World (ip-watch.org)
New Survey Finds Counterfeit Products Cost Global Economy Billions (chosun.com)
Drugs
Prescription Drugs (knujon.com)
Electronics
Man badly burned when cell phone in pocket flares (sfgate.com)
Hazardous Counterfeit Products: Exploding Electronics (cbsnews.com)
Counterfeit Electronics (csus.edu)
"Parts Is Parts, Right?" (ccnmag.com)
Electronic manufacturing and consumers confront a rising tide of counterfeit electronics (ieee.org)
The billion dollar problem (my-esm.com)
Counterfeit Electronics as a Terrorist Tool (schneier.com)
Counterfeit Wave Rises In The East (edn.com)
Counterfeit Electronics Are An Increasing Problem (kdka.com)
Handbags
Counterfeit Bags May Have Links To Organized Crime, Terrorism (themilwaukeechannel.com)
Getting real about fake designer goods (bankrate.com)
How buying fake designer handbags can harm you and impact on our economy. (henriettashandbags.com)
U.S. Customs and Border Protection Intercepts Counterfeit Handbags Worth Over $2 Million (cbp.gov)
Fake Designer Bags in New York City, part 3 (littleviews.com)
The Dark Underbelly Of Counterfeit Handbags (tillekeandgibbins.com)
Fake Designer Handbags - How To Spot a Counterfeit Purse (chinatownconnection.com)
Watches
What are counterfeit watches and how to avoid getting burned buying a watch that was not the real thing (chronocentric.com)
Rolex or Replica?? Don't get E-Screwed!! (qualitytyme.net)
The watch industry against the counterfeit scourge (fhs.ch)
RFID takes on the counterfeit watch (zdnet.com)
As luxury industry goes global, knockoffs follow (post-gazette.com)
WHAT IS A COUNTERFEIT WATCH OR CLOCK? (jcwa.or.jp)
UNDERCOVER OPERATION NABS HUNDREDS OF COUNTERFEIT WATCHES (sheriff.org)
The Rolex Report: An Unauthorized Reference Book For The Rolex Enthusiast (amazon.com)
Bateries
Health Canada warns Canadians about unsafe counterfeit household batteries (hc-sc.gc.ca)
Consumer Alert Regarding Counterfeit KODAK Batteries (kodak.com)
examples of counterfeit batteries (nokiamea.com)
Counterfeit Batteries Market (havocscope.com)
WARNINGS: Counterfeit Lithium-Ion Battery (canon-europe.com)
Counterfeit Equipment Lurks (wirelessweek.com)
Counterfeit Batteries Discovered in Tianjin (customs.gov.cn)
Nokia Investigates Exploding Cell Phones (pcworld.com)
IC Provides Battery Authentication (powerelectronics.com)
Money
"KNOW YOUR MONEY" (secretservice.gov)
Spotting Counterfeit Currency (frbatlanta.org)
Counterfeit Detection (indigoimage.com)
How Counterfeiting Works (money.howstuffworks.com)
Counterfeiting Prevention - Canada (bankofcanada.ca)
How to spot the fake - and what to do if any slips through (bcentral.co.uk)
False-paper trail leads to North Korea. (digg.com)
Iran, Syria Accused of Counterfeiting US Dollars (fas.org)
Canada among worst for counterfeit money (cbc.ca)
Police shut down counterfeit money operation in Colombia (newsfromrussia.com)
Counterfeit Money and Financial Instruments (nytimes.com)
HOMELAND SECURITY AGENTS SEIZE "BILLION DOLLAR" BOGUS FEDERAL RESERVE NOTES (ice.gov)
Hot on the Trail of Funny Money (scvhistory.com/)
Checks
National Check Fraud Center (ckfraud.org)
Results of "Operation Cyber Sweep" (crime.about.com)
Check Fraud Manual (frbservices.org)
Counterfeit Cashier's Checks (1stsource.com)
Public Advisory: Special Report on Counterfeit Checks and Money Orders - Canada (usdoj.gov)
Counterfeit Check Scams (lookstoogoodtobetrue.com)
Scam Involving Counterfeit Official Checks (fdic.gov)
Alerts published by the Division of Banks. (dfi.wa.gov)
check fraud a guide to avoiding losses (occ.treas.gov)
Cyber Sweep (ic3.gov)
Foreign Check Counterfeiters Active in Idaho (state.id.us)
BBB WARNS CONSUMERS ABOUT FAKE CHECK SCHEMES (bbbvideo.com)
Credit Cards
On the dark side of credit card fraud (bankrate.com)
Can you spot a counterfeit credit card? (aipb.org)
Counterfeiting and Credit Card Fraud - Canada (rcmp-grc.gc.ca)
Plastic Payments: Trends In Credit Card Fraud (fbi.gov)
counterfeit credit cards (secretservice.gov)
Counterfeit credit card gangs on rise - Australia (theage.com.au)
Catching counterfeit credit cards (cnn.com)
Keeping Up With Credit Card Fraud (morebusiness.com)
What is Visa doing to help prevent counterfeit fraud (visa.ca)
Getting a Handle on Debit and Credit Cards (frbsf.org)
The Internet Crime Complaint Center (ic3.gov)
Nearly 2,000 fake credit cards seized from Chinese ship (findarticles.com)
Cars and Car Parts
The Hazards of Counterfeit Automobile Parts (ezinearticles.com)
China is a leading source of counterfeit automotive parts production (uspto.gov)
US: Parts makers welcome IPR enforcement plan (just-auto.com)
MEMA Steps Into the Counterfeit Fight (autoserviceworld.com)
ABRO Chief Testifies at Counterfeiting Subcommittee (autoserviceworld.com)
Samples and Cases





Vacations and Travel Scams
Vacation Junk
What is it?Usually through fax, rarely through email. Absurdly cheap vacation packages. More...
Why is it a problem?Thousands have been taken by these scams, often the elderly. Internet travel deals are common these days and the scam artists ride the wave. "Americans lose more than $12 billion a year on travel-related scams" - AARP. More...
How would it effect me?Customers who purchased these packages have experienced various problems from bad vacations to no vacations. More...
SamplesWhat can be done?
If you believe you have been scammed: Cancel the purchase if possible; get your credit card company to issue a charge-back;
Contact the Attorney General in your state and the state where the company is located; File a complaint
with the FTC;
If you receive a junk vacation advertisement via fax or email: send it to us at nonregistered@coldrain.net
and the FTC
More...
Vacation Junk
The Internet is full of fantastic deals for airfare, hotels, car rentals and even whole vacations. This
has opened the door to fraud and deception. The success of LowestFare, Priceline, Hotwire, Expedia, and Orbitz
has generated many other travel services that may or may not be legitimate. There are a few simple rules for picking one
of these Internet deals:
- Don't buy travel services from spam or fax junk advertisers
- Read refund/return/cancellation policies carefully. If they don't have one published, don't buy from them!
- If it's too good to be true, it probably is. Internet travel sites can sell at low prices because they buy bulk fares in advance knowing that airlines/hotels can't sell everything on their own and they make money on the margins. It's somewhat of a gamble but everyone wins: you get cheap tickets, the service gets fee profit and the airlines/hotels fill quotas. The "other" travel services are a little different. They often offer absurdly low prices before securing any services and hide fees on the back end you will be responsible for.
- When in doubt, check them out. If they are a legitimate company, there will be reviews and documentation. Check with tripadvisor.com and the Better Business Bureau to see if they are legit and/or have any unresolved customer complaints(every company has complaints, the question is do they fix them? and what are the kind and how many complaints?). If there is no history at all, they may be fake.
What are some things that have happened to folks who use less-than-reputable travel services?
- Customers pay for a trip and don't get anything. When they try and get a refund of some kind of service, the company has disappeared.
- The company sends tickets or vouchers but the airline/hotel does not honor them.
- Customers are charged extra(and often large) fees when presenting vouchers.
- One fare is promised but a different one is charged.
- The company agrees to a schedule but the dates are then changed by the company.
- Customers are promised a specific airline/hotel but different services appear on the voucher(s).
Let's take a look at 2 services someone told us they had trouble with: CHEAPTICKETSCANCUN.COM and TRAVELCOMM.COM. Everything seemed fine at first until they discovered some fees that were not documented previously. They called CHEAPTICKETSCANCUN.COM to resolve the matter and claimed that they were put on hold indefinitely, spoken to rudely, hung up on, etc. They haven't actually taken the trip yet but they are worried. This could have all been avoided by looking at the history of these companies before making a purchase.
In the example of CHEAPTICKETSCANCUN.COM there is no physical address of the company listed on their website, just a phone number. Compare this to Expedia.com who list their mailing address clearly in the site's legal info. So then where is CHEAPTICKETSCANCUN.COM registered you may ask? They are registered in Arizona through a anonymous proxy service, but the company is not in Arizona. The company is registered in Florida, but not under the name CHEAPTICKETSCANCUN.COM. The real company name is: Mexico Vacations, TC Lakehurst Orlando, FL 32802. In checking review sites it is easy to find that tripadvisor.co.uk has a review of them and it's not pretty.
On to TRAVELCOMM.COM. A review of a BBB report shows that TRAVELCOMM.COM has had over 300 complaints in the last 36 months, about 10 complaints per month. Of these complaints 92 are unresolved at this time. This means you have a 30% chance of being ignored if you have a problem with them. In addition TRAVELCOMM.COM has been issued citations(and not the good kind!) by the FCC and FTC for sending unsolicited advertising. Still haven't made up your mind? Read this review(ripoffreport.com).
Knowing this ahead of time, would you have purchased a vacation through them?
Resources
Schemes, Scams, Frauds. (crimes-of-persuasion.com)
The Free Vacation Scam (usps.com)
Travel Scams (thinkglink.com)
Telemarketing Travel Fraud (ftc.gov)
Vacation Scams - How to Spot Them (ezinearticles.com)
DON'T GET TAKEN BY TRAVEL AND VACATION SCAMS (aces.edu)
Scam Alert: Dream Vacation Adrift (aarp.org)
10 Vacation Rental Scams to Avoid (coastrentals.com)
Don't Get Burned By Hot Travel Deals (bbb.org)
FTC Halts Vacation Scam; "Dream Vacations" Were a Nightmare, Agency Charges (ftc.gov)
Samples
Prescriptions
Prescription Drugs
What is it?
Unwanted email selling prescription drugs, supplements or other controlled substances. Most often
diet supplements and ED drugs(Erectile Dysfunction): Viagra, Cialis, etc. However, many other
counterfeit and substandard prescription drugs are being pushed over the web. The emails are often
worded to play on the fears and insecurities of men in the bedroom and/or the high price
prescription drugs for seniors.
"Rx" is an ancient symbol
the meaning and origin of which is disputed but it now means "prescription." Green crosses are used
in some countries denote pharmacies and often the word "Apothecary" instead of "Drugs" or "Pharmacy".
More...
Prescription drugs are expensive, controversial and dangerous even if you obtain them legally.
Prescription drugs are complex chemicals that alter your body functions.
Like many scams this targets the elderly, who are less likely to report the crime
and more likely to suffer adverse effects from the toxins. There are, of course, completely legitimate
on-line pharmacies like drugstore.com.
Politics Alert!.
Pharmaceuticals are a hot button topic in the United States(and probably elsewhere) as the population of baby-boomers feeds into the middle age
bracket. Many seniors are going to Canada and Mexico to purchase cheaper versions of expensive drugs. This has resulted in accusations that pharmacies
in these countries are selling lower standard versions of the drugs and polluting the U.S. supply. This has lead to counter-accusations by America's
neighbors that the U.S. trying to scare people out of buying over the border. The issue is very confusing, but keep in mind that just because
a website advertises cheaper Canadian drugs, it does not mean they are licensed pharmacy. If you buy prescription drugs from a licensed
Canadian pharmacy it should be fine. If you buy from a random website, you are playing games with your health.
Aside from counterfeit prescriptions many of these sites sell items that are pure snake oil. Mystery
weight loss supplements, sexual enhancers, and steroids. These pills are in the same category as
X-Ray Glasses.
Beyond junk email counterfeit drugs are also a serious problem for international aid organizations.
More...
Because the junk mail versions of prescription drugs are not the real thing they often contain substitutes or fillers that can be harmful to your body, especially to your liver and kidneys. For those not familiar with anatomy these organs have vital functions like cleaning the blood and processing sugar, damaging them is very serious. Fake prescription drugs have been found to contain high levels of chemicals that are considered poisons in high doses. More...
Samples
Read about mantipu.com in "The Worst"
View Samples
- Don't buy drugs from junk mailers
- Don't take drugs without medical supervision
- If you buy prescription drugs be sure the seller is a licensed pharmacist. Check:
Check with LegitScript.com
http://ncbop.org/pharmacies_verifypermit.htm - If you are taking prescription drugs, know what you are taking. Use this lookup to get the details: http://www.pdrhealth.com/drug_info/index.html
- Forward the junk mail to rx@coldrain.net
- Report bad drugs and adverse effects to the FDA(U.S.)
CIPA(Canada)
Resources
Buying Medicines and Medical Products Online (fda.gov)
Counterfeit Drugs (fda.gov)
FDA Warns Consumers Not to Buy or Use Prescription Drugs from Various Canadian Websites that Apparently Sell Counterfeit Products (fda.gov)
Consumer Education: Counterfeit Medicine (fda.gov)
Counterfeit Alert Network (fda.gov)
Counterfeit and substandard medicines (who.int)
EU report on pharmaceuticals - May, 2006 (europa.eu)
Boards of Pharmacy Against Counterfeit Drugs (dangerouspill.com)
Pharmaceutical Security Institute (psi-inc.org)
The National Association of Boards of Pharmacy (nabp.net)
safemedicines.org (safemedicines.org)
buysafedrugs.info (buysafedrugs.info)
Targeting Phony Pharmaceuticals (cbsnews.com)
Chinese anti-malarial drug producer battling against fake drugs (people.com.cn)
Nigeria leads fight against “killer” counterfeit drugs (who.int)
Murder by fake drugs - Time for international action (bmj.com)
China's battle with fake drugs (rsc.org)
Estimates on Counterfeit Drugs - 2006 (dangerouspill.com)
Fake prescription drugs warning (bbc.co.uk)
Lethal flood of fake prescription drugs (scotsman.com)
Fake drug sales ‘could nearly double by 2010’ (in-pharmatechnologist.com)
Concerns about Illegal Online Pharmacies (drugstore.com)
Still have questions? We have Answers: Q & A on Counterfeit Products (bms.com)
Fake drugs costing lives (news.bbc.co.uk)
Millions head south of the border for cheap drugs. But is it safe? (aarpmagazine.org)
Poison pills (washtimes.com)
The Poison Pill (mac.com/wrenbeck/blogwavestudio)
Is it Safe to Buy Medicines Online? (poison.org)
Counterfeit Drugs: A Rising Public Health Problem (webmd.com)
Fake online pharmacies (scamwatch.gov.au)
Fake drug sales ‘could nearly double by 2010’ (in-pharmatechnologist.com)
Prescription for Fake Viagra Pharmacy: 20 Years in Prison (theinternetpatrol.com)
The hidden dangers of on-line drugs (buysafedrugs.info)
U.S. Customs Officers Stop Seizing Mailed Prescription Drugs Purchased From Canada (medicalnewstoday.com)
Microsoft and Pfizer Fight Fake Viagra Spammers (buzzle.com)
FDA claims progress in battle against fake drugs (in-pharmatechnologist.com)
Poison control: Fake drugs are a health hazard (prn2.usm.my)
The World Health Organization and its international partners are cracking down on bogus medicines (transworldnews.com)
Teens using medicines to get high, U-M expert warns (med.umich.edu)
Is this drug for real? (pharmatimes.com)
Fake medicines from India seized in Europe (medindia.net)
Samples
Some samples may contain coarse or vulgar language
Image Only Rx Junk
Recently some of you may have noticed an increase in image-only(no html, url links or text) drug junk. We see this as progress and a reaction to efforts by services like KnujOn. There are those who see this as a threat, but don't worry, it's a minor issue and KnujOn already has a pre-process for this type that is applied before putting it through the core engine. Most of the sites advertised have pending actions against them.





Common Samples
Read about mantipu.com in "The Worst"







Fake loans and mortgaes
Mortgage and Loan Scams
What is it?Unwanted email and faxes advertising impossibly low rate mortgages or loans.
Why is it a problem?The housing market in the United States has been booming and is now slowing. This sort of up and down means significant amounts of money are changing hands. Scammers are posing as agents and banks to obtain personal information, steal people's money and even their houses. The targets are often elderly homeowners looking to make some extra cash by refinancing or taking out an equity line. Also, many individuals are buying and selling property without agents to save money(FSBO) Acording to the FBI there were 21,971 mortgage fraud cases in 2005 totalling over $1 billion in losses, this up from fewer than 600 in 2004 and even less in 2003. It is running "rampant" according to sources. Some of the hot spots are Michigan and Florida.
How would it effect me?Mortgage transactions are complex legal and financial agreements. If you are not knowledgeable about them predators can take your money and even property.
SamplesWhat can be done?
- Send the junk mail to us
- Read Freddie Mac's "Don't Borrow Trouble" before even thinking of getting a loan
- Don't do business with junk mailers and faxers
- Use this form(fdic.gov) to check and see if is truly an FDIC insured institution(United States)
- Authorized lenders are required to disclose license information. If it's not there,
they are not a real bank.
Check with your state licensing boards to see if they are for real (CT, FL, CA, NY, MI, VA ). - Always have a real-estate professional and/or lawyer review any transaction
- Check with a service like realtor.org to see if an agent is legitimate. Contact
Resources
Help Your Clients Understand How To Avoid Predatory Lending (realtor.org)House approves bill to strengthen rules on mortgage lenders (cnn.com)
FDIC Bank Find (fdic.gov)
HUD FHEO (hud.gov)
How do I report fraud related to a HUD/FHA transaction? (hud.gov)
Town's Residents Say They Were Targets of Big Mortgage Fraud (wsj.com)
Governor signs bill to halt reverse mortgage scams (findarticles.com)
Federal Reserve Board Consumer Information (federalreserve.gov)
mortgagefraudblog.com
stopmortgagefraud.com
FINANCIAL CRIMES REPORT TO THE PUBLIC (fbi.gov)
mortgagefraud.org
Mortgage Fraud Recovery (mortgagefraud.com)
Field Guide to Mortgage Fraud (realtor.org)
Don't Be A Victim Of Loan Fraud (pueblo.gsa.gov)
HUD - Don't Be A Victim of Loan Fraud (hud.gov)
Mortgage fraud can no longer be ignored by officials (chicagotribune.com)
Featured Articles~The Many Faces of Mortgage Fraud (mortgageoriginator.com)
Find a HUD Approved Housing Counseling Agency (hud.gov)
FBI Vows to Crack Down on Mortgage Fraud (washingtonpost.com)
Mortgage fraud soars (detnews.com)
Cases
ui726.com

This is a junk mail message(with an obfuscated URL no less) that leads to the
following site:

There is no address, phone number, FDIC or Equal Housing Lender information, or
even the name of the institution. Just this fake rate-checking form. Compare this
with a site like ditech.com which discloses their state licenses clearly
on rate checking forms.
Samples


Faxes


Dear HomeOwner, Your credit doesn't matter to us! If you OWN real estate and want IMMEDIATE cash to spend ANY way you like, or simply wish to LOWER your monthly payments by a third or more, here are the deals we have TODAY (hurry, these offers will expire TONIGHT) : Low as $452,000.00 at a 3.75,% fixed-rate $363,000.00 at a 3.51,% variable-rate $459,000.00 at a 3.83,% interest-only $252,000.00 at a 3.78,% fixed-rate $159,000.00 at a 3.31,% variable-rate Hurry, when these deals are gone, they are gone! Simply fill out this one-minute form.. Don't worry about approval, your credit will not disqualify you! http://confrere Dear Home Owner, Your credit doesn't matter to us! If you OWN real estate and want IMMEDIATE cash to spend ANY way you like, or simply wish to LOWER your monthly payments by a third or more, here are the deals we have TODAY (hurry, these offers will expire TONIGHT) : Low as $401,000.00 at a 3.22,% fixed-rate $391,000.00 at a 3.62,% variable-rate $418,000.00 at a 3.63,% interest-only $221,000.00 at a 3.76,% fixed-rate $184,000.00 at a 3.02,% variable-rate Hurry, when these deals are gone, they are gone! Simply fill out this one-minute form... Don't worry about approval, your credit will not disqualify you! Sincerely, Emmit Reidelberger Approval Manager
Diploma MillsDegrees
What is it?
Why is it a problem?
How would it affect me?
Samples
What can be done?
Resources
Samples
Have you ever imagined that the main thing stopping you from a great job and better wage was a few letters behind your name and surname? Oh well now you can get them! PhD BA BSc MA MSc MBA Within 2 weeks! No Lessons Needed! 100% Verifiable! These are real, genuine qualifications that include Bachelors, Masters and Doctorate degrees. Those are 100% verifiable and student records and transcripts are available as well. This little secret has been kept quiet for such a long time. The opportunityis existant due to a legal loophole allowing some established colleges to award qualifications at their discretion. Obtain yours today. Just call the number below. You will thank me later. +ONE - 8 3 1 - THREE ZERO ZERO - DOUBLE 6 FOUR 3
Better degree - better pay Academic Qualifications available from prestigious NON-ACC REDITED uni versities. Do y ou have the knowledge and the experience bu t lack the qualifications? Are you getting turned dow n time and time again for the job of your dreams because you j ust don't have the rig ht letters after your name? Get the prestige that you deserve today! Move ahead in your career today! Bache lors, M asters and PhD' s available in your field! No examinations! No classes! No textbooks! Call to register and receive your qual ifications within days! 24 hours a day 7 days a week! Confidentiality assured! Please call: 1-206-600-68 25 Calls returned promptly The eyes are the window of the soul A fair exchange is no robbery. You have to understand, somethings you will never understand Penny wise, pound foolish All things come to those who wait Dah mouth dat man tek fuh court woman, ah de same mouth he ah tek an put she ah door. A fly will not get into a closed mouth. Patience is bitter, but it bears sweet fruit Nah every big head get sense.
Better degree - better pay Academic Qualifications available from prestigious NON-ACC REDITED uni versities. Do y ou have the knowledge and the experience bu t lack the qualifications? Are you getting turned dow n time and time again for the job of your dreams because you j ust don't have the rig ht letters after your name? Get the prestige that you deserve today! Move ahead in your career today! Bache lors, M asters and PhD' s available in your field! No examinations! No classes! No textbooks! Call to register and receive your qual ifications within days! 24 hours a day 7 days a week! Confidentiality assured! Please call: 1-206-600-68 25 Calls returned promptly The eyes are the window of the soul A fair exchange is no robbery. You have to understand, somethings you will never understand Penny wise, pound foolish All things come to those who wait Dah mouth dat man tek fuh court woman, ah de same mouth he ah tek an put she ah door. A fly will not get into a closed mouth. Patience is bitter, but it bears sweet fruit Nah every big head get sense.
![]()
Get your university diploma Do you want a prosperous future, increased earning power more money and the respect of all? Call this number: +ONE - 8 31 - THREEHUNDREDS - 66 43 There are no required tests, classes, books, or interviews! Get a Bachelors, Masters, MBA, and Doctorate (PhD) diploma! Receive the benefits and admiration that comes with a diploma! No one is turned down! Call today: +ONE - 8 31 - THREEHUNDREDS - 66 43 Confidentiality assured!
University Diplomas No required tests, classes, books, or interviews. Please call: 1-206-338-3737 fancy-blest pea blight turkey vulture gable-walled trolley maker town adjutant jute butts tool-dresser theft insurance sailor-train wages-man pocket print poetry-proof quasi judge die chaser Ultra-puritan time thrust tired-eyed sea lovage scale modulus soft patch hot-windy muscle cell induction top venerable-looking booster charge goose-pimply
Diplomas Without Exams A G enuine Unive rsity Deg ree in 4-6 weeks! Have you ever th ought that the only thing stopp ing you from a great job and better pay was a few letters behind you n ame? Well now you can get them! BA BSc MA MSc MBA PhD Within 4-6 weeks! No Study Required! 100% Verifiable! These are real, genuine deg rees that include Bache lors, Masters, MBA and Doctorate Degrees. They are fully verifiable and certified transcripts are also available. Just call the number below. You thank me later Please call: 1-20 6-600-6825 Calls returned promptly A false balance is abomination to the LORD: but a just weight is his delight. A false witness that speaketh lies, and he that soweth discord among brethren. Artificial intelligence is no match for natural stupidity A chat has nine lives.. Do as you would be done by A Good Tongue is a Good Weapon. Distance makes the heart grow fonder Life is like a drawing pin - sharp at one end, and flat at the other He travels fastest who travels alone
Masters Based on Working Experience Fas t Tr ack De gree Pro gram Obtain the degr ee you deserve, based on your present knowledge and life experience. A prosperous future, money earning power, and the Admiration of all. De grees from an Established, Prestigi ous, Leading Institution. Your de gree will show exactly what you really can do. Get the Job, Promotion, Business Opportunity and Social Advancement you Desire! Eliminates classrooms and traveling. Achieve your Bac helors, Mas ters, MB A, or Ph D in the field of your expertise. Professional and affordable! Call now - your Gradu ation is a phone call away. Please call: 1 -206-600-6825 Calls returned promptly If you lie down with dogs you will come up with fleas He That Brings Good News Knocks Hard To whom God gives, to him also the people give Live and learn They Brag Most That Can Do the Least One beats the bush, another takes the bird For the commandment is a lamp; and the law is light; and reproofs of instruction are the way of life. The King can make a knight, but not a gentleman
Masters Based on Working Experience Fas t Tr ack De gree Pro gram Obtain the degr ee you deserve, based on your present knowledge and life experience. A prosperous future, money earning power, and the Admiration of all. De grees from an Established, Prestigi ous, Leading Institution. Your de gree will show exactly what you really can do. Get the Job, Promotion, Business Opportunity and Social Advancement you Desire! Eliminates classrooms and traveling. Achieve your Bac helors, Mas ters, MB A, or Ph D in the field of your expertise. Professional and affordable! Call now - your Gradu ation is a phone call away. Please call: 1 -206-600-6825 Calls returned promptly If you lie down with dogs you will come up with fleas He That Brings Good News Knocks Hard To whom God gives, to him also the people give Live and learn They Brag Most That Can Do the Least One beats the bush, another takes the bird For the commandment is a lamp; and the law is light; and reproofs of instruction are the way of life. The King can make a knight, but not a gentleman
Hi, mate University Diplomas No required tests, classes, books, or interviews. Please call: 1-206-338-3737 resume fenugreek isotherm contraband furious prune breach cheerleader uttermost craftsperson respire hydrosphere, radio cloture gloat jogging lamellar wastrel conflict sure glisten archaic lobster boil .lome tabulate cowslip taffy thenceforth sternberg impeccable parsonage congratulatory vast! subjectivity mcconnell. peril wound rainbow nichols cordite jelly. bailey vassal petrol inaptitude. Your Emery
Hi, prostate University Diplomas No required tests, classes, books, or interviews. Please call: 1-206-338-3737 eternal jacqueline greenwich hewitt proton nightmare continental piraeus canvass intersperse euridyce pillage, companion proof technetium soccer beginner sofia thrash sudden rome bellatrix wingspan soiree .dreamlike upperclassmen incorruptible attendee quantum howl sandwich argot ulcer codeposit! insurgent parsonage. shamefaced piteous flaunt veridic churchmen penetrable. old friable gloriana lifeguard. Your Lucia
419/Deposit Scams/"Nigerian"Deposit Scams
What is it?
They are also called "Nigerian" or "419" scams. They can originate in any country, but because of the large number of cases from Nigeria and the frequent mention of Nigerian banks in the junk mail people use this terminology to describe them. They are called "419" because this is the number of the Nigerian criminal act that was written to combat them. It is important to note that this scam is not particular to the Internet and pre-dates the modern era. Email, however, has become the frequent starting point for them. We generally refer to them as "Deposit" Scams since they often require the victims to deposit money AND/OR promise the transfer of funds into the victim's account.
Why is it a problem?
The context and scheme vary(thousands upon thousands of variations) but they all have the crux the same scenario. A stranger contacts the victim explaining they need to move a large amount of money but because of some strange legal or political situation they need the victim's help to move it. In return for the victim's assistance the stranger is willing to part with a percentage of the money. The stranger usually asks the victim to pay a tax, fee, bribe or some other charge so the money can be released. Example: Someone emails you explaining that they have $400,000 in an African bank, but the government wont allow them to access it or move it out of the country. If you supply a bribe of $1000 the government will release the money into your account temporarily until the person can come the U.S.(or wherever) and claim it. When all is said and done you can keep 10%($40,000). Just based on the numbers it is a great deal for you, a $1000 investment earns you $40,000! But there is no $400,000 trapped in an African bank, and no real person conducting business with you. This is an age old scam escalated to a grand scale. Simply, someone dangles a large treasure in your face that you can have a percentage of for a small investment. You pay and never collect. The person disappears with your money, or worse says that there are "complications" that require more funds.
These scams also often play on sympathy as well as greed. Emails also claim that bribes are needed to "release medicine for sick children" or "supply arms to freedom fighters."
Why Nigeria? Political instability and economic disparity have created an environment where corruption and criminal enterprise are commonplace. Nigerian criminal enterprises are some of the most complex and widespread on the planet.
Previous to the Internet the letters will faxed or mailed directly.
People fall for these scams all the time and are often unlikely to report it. The profits from these operations fund criminal operations, narcotics, weapons deals, terror groups, and human smuggling in addition to eroding the stability of developing countries. Private bank accounts are often compromised which exposes everyone to possible fraud. The amount of money lost by victims is in the billions.
How would it effect me?
This depends on how deep you are willing to go. There are many "levels" to these scams. In addition to the original deposit fraud, victims are often enticed to hand over more and more money believing their payout is just around the corner. Victims have often traveled to foreign countries to get their money back and found themselves kidnapped and held for ransom. Many people have been murdered trying to collect their money. This may all sound like an urban legend, but it is not.
Samples
Examples at crimes-of-persuasion.com
What can be done?
"Pining for the frauds: scammers act up", Video shows a prank played on some scammers.
View Samples
Forward the junk mail to depositscams@coldrain.net (Deposit scams only!)
If you have fallen victim(not for junk reporting)
Federal Trade Commission (U.S.)
Secret Service (U.S.)
Internet Crime Complaint Center
Serious Fraud Office (U.K.)
uk-fraud.info (U.K.)
Economic Crime - Reporting fraud (U.K.)
Metropolitan Police (U.K.)
RCMP (Canada)
Western Australia Police (Australia)
Resources and Information
Website Owners - The Next Target of 419 Scammers? (cybertopcops.blogspot.com)
419 Scammers Using Google Search to Find New Victims (cybertopcops.blogspot.com)
Postal Service Declares War on Nigerian Scam (foxnews.com)
419eater.com: "scambaiting", they scam the scammers.
Fakes, phishing and fraud as Nigerian gangs target Britain (timesonline.co.uk)
Victims Still Falling Prey to Nigerian E-Mail Scam (foxnews.com)
Nigerian Slain Over E-Mail Scam (wired.com)
Nigerian scam continues to thrive (msnbc.msn.com)
Over 3m UK adults fall victim to a scam every year (direct.gov.uk)
Financial scams - how to protect yourself (direct.gov.uk)
The con remains the same: The Nigerian email scam continues to rope in unsuspecting victims, writes Nick Galvin. (smh.com.au)
"Nigerian" Scam Summary <- This one is probably the most detailed and comprehensive (crimes-of-persuasion.com)
Nigeria - The 419 Coalition Website (rica.net)
419 Nigerian Advanced Fee Fraud Scam Lifecycle (nextwebsecurity.com)
Nigeria - The 419 Coalition Website (rica.net)
Websites Fighting the Nigerian Scam/419 (rica.net)
Internet Crime Schemes (ic3.gov)
Nigeria Hoax Spawns Copycats (wired.com)
What is the 419 Scam? (419eater.com)
An Offer You Can't Refuse (breakthechain.org)
Law Enforcement Weighs In Against Nigerian Criminal Gangs (usps.com)
PUBLIC AWARENESS ADVISORY REGARDING "4-1-9" OR "ADVANCE FEE FRAUD" SCHEMES (secretservice.gov)
US Secret Service Financial Crimes Division (secretservice.gov)
Advance fee fraud (wikipedia.org)
U.S State Department "Book" on Nigerian Fraud Schemes (state.gov)
Nigerian Scam collection (internet-fraud.com)
Nigerian Scam (snopes.com)
Japanese man flees kidnappers (dispatch.co.za)
Nigerian Fraud Syndicates Set Up Shop in South Africa (nytimes.com)
Samples
FROM THE DESK OF Mr IBRAHIM
BILL AND EXCHANGE MANAGER,
AFRICAN DEVELOPMENT BANK(ADB)
OUAGADOUGOU,BURKINA FASO.WEST AFRICA.
With Due Respect
I am the manager of bill and exchange at the foreign remittance department of african development bank (ADB). I crave your indulgence as i contact you in such a surprising manner. But I respectfully insist you read this letter carefully as I am optimistic it will open doors for unimaginable financial rewards for both of us.
In my department we discovered an abandoned sum of Ten Million,Five Hundred Thousand US dollars (US$10.5m) only , in an account that belongs to one of our foreign customer who died along with his entire family in November 2002 in a plan crash. Since we got information about his death, we have been expecting his next of kin to come over and claim his money because we cannot release it unless somebody applies for it as next of kin or relation to the deceased as indicated in our banking guidelines but unfortunately we learnt that all his supposed next of kin or relation died along with him at the plan crash leaving nobody behind for the claim.
It is therefore upon this discovery that I now decided to make this business proposal to you so that the money could be released to you as the next of kin or relation to the deceased for safety and subsequent disbursement since nobody is coming for it and i dont want this money to go into the bank treasury as unclaimed Bill.
The Banking law and guideline here stipulates that if such money remained unclaimed after five years, the money will be transferred into the Bank treasury as "unclaimed fund". The request for a foreigner as next of kin in this business is occasioned by the fact that the customer was a foreigner and a Burkinabe cannot stand as next of kin to a foreigner. We agree that 30% of this money will be for you as a foreign partner, in respect to the provision of a foreign account , 10% will be set aside for expenses incurred during the business and 60% would be for me.
There after I will visit your country for disbursement according to the percentages indicated. Therefore to enable the immediate transfer of this fund to you as arranged, you must apply first to the bank as relation or next of kin of the deceased indicating your bank name,your bank account number, your private telephone and fax number for easy and effective communication and location wherein the money will be remitted. Upon receipt of your reply,I will send to you by fax or email the text of the application.I will not fail to bring to your notice that this transaction is hitch free and that you should not entertain any atom of fear as all required arrangements have been made for the transfer. You should contact me immediately as soon as you receive this letter.
Trusting to hear from you immediately.
Yours faithfully,
Mr IBRAHIM
Bill and exchange manager,
African Development bank ADB
"MY GOOD WILL" Good day and God bless, Greetings to you in the name of God Almighty. I am former Mrs. Memunat Farouk Hassan, now I am Mrs. Rebecca Farouk Hassan a widow to Late Farouk Hassan Muhammad. I am an old woman; suffering from cancer. From all indications, my condition is really deteriorating and is quite obvious that I may not live long, because the cancer stage has gotten to a very severe stage. My late husband died in an air crash on the 31st October 1999 in an Egyptian airline Boeing 990 with other passengers on board. You can confirm this fact from the website which was aired by the BBC WORLD NEWS:(http://news.bbc.co.uk/1/hi/world/americas/502503.stm) and my only daughter died in LONDON BOMB ATTACK . My late husband was very wealthy and after his death, I inherited all his business and wealth. My personal physician told me that I may not live for so long and I am so scared about this. So, I now decided to divide part of this wealth, by contributing to the well being of less privileged people and handicapped in the society of world America, Canada, Africa, Europe and Asian Countries. This mission, which will no doubt be tasking had made me to recently relocate to Africa where I live presently. I selected you for this Purpose and prayed over it, I am willing to donate the sum of $1,700,000,000.00 Million US Dollars to you for the development of the well being of handicapped in the society and also as aids for the less privileged around your country, and i have map out $700.000.00 for your own personal use to help me for this work. Please note that, this fund is lying in a Security Bank. Therefore immediate application for the transfer of the money in your name or your home is required. Please, do not reply me if you have the intention of using this fund for personal use, than enhancement of the comfort of the Handicapped. Lastly, I want you/your home to be praying for me as regards my entire life and my health because I have come to find out since my spiritual birth lately that wealth acquisition without God, one's life is vanity upon vanity. I await your reply. MRS REBECCA HASSAN 13:07:06 GOOD NEWS! SINCERE COMPENSATION Dear Friend, I'm happy to inform you about my success in getting the fund transferred to a Swiss Account with the cooperation of a new partner from Paraguay who is an international businessman. Presently I'm in Paraguay for investment projects with my own share of the total sum. Meanwhile, I did not forget you’re past efforts and attempts to assist in transferring those funds despite that it failed us some how. Now contact my Friend, Mr. Desmond Patrick, who is a diplomat and I have instructed him to fly to America to give you your own share of US$7.5Million, his contact is: Name: MR. DESMOND PATRICK Email: diplomatdesmond@myway.com Please, I have provided his Air Ticket and promised to compensate him for his assistance after delivering consignment to you. Therefore send to him your contact address where he will meet you immediately he arrives to deliver the USD$7.5M which I kept for your compensation for all the past efforts and attempts to assist me in this matter. I appreciated your efforts at that time very much. So feel free and get in touched with the Diplomat Mr. Desmond Patrick and advice him where to meet with you once he arrive United State.Endeavour to assist him secure clearance on the port of entry to avoid him having any problem with your homeland Securities. Please do let me know immediately you receive it so that we can share the joy after all the suffering at that time. In the moment, I am very busy here because of the investment projects, which the new partner and I are having at hand. Finally, remember that I had forwarded instruction to the Diplomat to deliver the cash to you only to avoid impostor, so feel free to get in touch with Mr. Desmond Patrick and he will fly to meet you without any delay. Please, bear in mind that I have assured him that you will take good care of everything in United State when he arrived, so when he arrived make sure you give to him all the assistance over to avoid him getting stranded as I have only provided his air ticket. I will give to you the key code to open the consignment as soon as he is with you to avoid any alteration of content. With best regards Chief Joseph Sanusi Former Governor (CBN) Dear Sir/Madam, I regret this informal way of contacting you which I believe would be most effective with regards to the message I intend to bring to your notice. It is imperative that I adopt this means of communication to safeguard my interest and guarantee that secrecy is not compromised. I am one of the wives of Nikola Sainovic one of the gentlemen that was indicted at the Hague war crimes tribunal in Hague. I have been thrown into a state of utter confusion, frustration and hopelessness by the present civilian administration. The security agents in the country have subjected me to physical and psychological torture. First of all, I would want you to know that the indictment was politically motivated as a package the western world has provided Yugoslavia at a closer look you will find that my husband is completely innocent of what he has been accused of. The government has been after my family ever since. Everything owned by my husband was destroyed and assets confiscated. My life and that of my three children are not spared and we have to run away into Madrid for the safety of our life where we presently live as refugees in a camp called Neprosteno camp, northern part of Spain under an assumed name. The situation in the camp right now is very terrible and my children are falling sick everyday this has made come to this desperate decision to act now. I have in my possession documents containing details of my husband?s transactions on behalf of the Yugoslavian government, Slobodan and my husband had kept some funds in cash to enable them take care of rebel problems. However, now the country they protected has turned against them. These funds were deposited by my husband in the vault of a Security Company here in Spain hence the Certificate of Deposit and Contractual Agreement covering the deposit is with us. The knowledge of these funds is only known to me and my husband because I was with him when the funds were deposited he now left the documents in my care in case of an emergency or anything should happen to him. I believe the time is now right to make this move. Can you help? Are you capable of handling large funds totaling $8.6 MILLION DOLLARS? Are you trustworthy? If you are capable of assisting us in realizing this transaction, write me for more information. I am also ready to offer a reasonable commission of 25% ($8.6Million) and 5% will go for expenses as will be agreed upon hence I do not want my children to die like this. I do not need to remind you of the absolute confidentiality and secrecy required in this transaction. You can contact my brother (Herum Ahmed) on this number + 34 659272606 for more oral briefings since I am residing inside the refugee camp and does not have a telephone of my own for discussions. Best regards. Hajia Mariam Sainovic. My alternative email is: hajiamariam_005@myway.com Director, Project Implementation, Federal Ministry of Health and Social Services, Abuja Nigeria. Strictly Confidential Atte: Ceo/ Director ATT, IMMEDIATE CONTRACT PAYMENT Transfer Of $7.5M (Seven million five hundred thousand United States dollars). May I crave your indulgence to this business discussion by a formal letter of this sort, its is pertinent that business of this magnitude should have commenced properly with a formal meeting of you and us to enable us know ourselves, have a fore knowledge of the nature of the business, discuss and acquaint our selves with the responsibilities and functions of parties concerned, However, for the time factor and personalities involve we have chosen this means of communication to start, I am Dr. Kalmali Musa the Director for Project Implementation for Federal Ministry of Health and Social Services Abuja Nigeria Based on the approval of the above stated amount for contracts awarded to an offshore company for the supply of health equipments in my ministry, we intend to transfer this amount to an offshore account and we solicit your assistance and cooperation on the assumption that you will not disappoint us because as civil servant workers we are not allowed to operate an offshore bank. This amount arose as a result of over invoiced and over inflated contracts in my ministry. We therefore seek your permission to remit this amount into your account or any other nominated account you can provide for us. Your commission will be 40% of the total sum, 10% for expenses and the remaining 50% is for my colleagues and me. Could you please acknowledge the receipt of this letter and state your willingness to assist and give us your private telephone number and fax number for easy contact. I shall inturn inform you of the modalities to secure the immediate transfer of the fund into your account, here is my Private e-mail you can reach me for more details; drkalmalimusa_22@myway.com OR drkalmalimusa_11@yahoo.com Thanks for your anticipated cooperation. Yours sincerely, Dr.KALMALI MUSA. FROM THE DESK OF: MR,JOHN ABACHI DIRECTOR, INTERNATIONAL REMITTANCE FOREIGN OPERATIONS DEPT, UNITED BANK FOR AFRICA PLC, LAGOS-NIGERIA. ATTENTION:BEBEFICIARY. Following the protest of the International Community, The World Bank, IMF and the instruction by the President and Commander in Chief of the armed forces(Chief General Olusegun Obasanjo) that all outstanding foriegn debts especially Contract payment should be released to the benefeciaries forthwith unconditionally. YOUR INHERITANCE FUNDS OF $15.5M THIS IS TO NOTIFY YOU THAT YOUR OVER DUE INHERITANCE FUNDS HAS BEENGAZZETED TO BE RELEASED, VIA KEY TELEX TRANSFER (KTT )-DIRECT WIRE TRANSFER TO YOU BY THE SENATE COMMITTEE FOR FOREIGN OVER DUE FUND TRANSFER. MEANWHILE,A WOMAN CAME TO MY OFFICE FEW DAYS AGO WITH A LETTER,CLAIMING TO BE YOUR TRUE REPRESENTATIVE. HERE ARE HER INFORMATIONS: NAME JANET DURA BANK NAME: CITI BANK,YORK. BANK ADDRESS:NEW YORK, USA. ACCOUNT Number: 6503809428. PLEASE,DO RECONFIRM TO THIS OFFICE ,AS A MATTER OF URGENCY IF THIS WOMAN IS FROM YOU SO THAT THE FEDERAL GOVERNMENT WILL NOT BEHELD RESPONSIBLE FOR PAYING INTO THE WRONG ACCOUNT NAME.THE RESERVE BANK GOVERNOR,EXECUTIVE, BOARD OF DIRECTORS AND THE SENATE COMMITTEE FOR FOREIGN OVER DUE INHERITTANCE FUND HAVE APPROVED AND ACCREDITED THIS REPUTABLE BANK WITH THE OFFICE OF THE DIRECTOR,INTERNATIONAL REMITTANCE / FOREIGN OPERATIONS,TO HANDLE AND TRANSFER ALL FOREIGN INHERITTANCE FUNDS THIS FIRST QUARTER PAYMENT OF THE YEAR. HOWEVER,WE SHALL PROCEED TO ISSUE ALL PAYMENTS DETAILS TO THE SAID JANET DURA,IF WE DO NOT HEAR FROM YOU WITHIN THE NEXT SEVEN WORKING DAYS FROM TODAY. CONGRATULATIONS IN ADVANCE. BEST REGARDS, MR,JOHN ABACHI DIRECTOR, INTERNATIONAL REMITTANCE FOREIGN OPERATIONS DEPT, UNITED BANK FOR AFRICA PLC, Dear friend, It has been long we communicate last, am so sorry for the delay, i mean your cheque that my boss asked me to mail to you as soon as you request for, but due to some minure issue you fails to respond at the aproprate time, and presently the cheque is with me here in BENIN REPUBLIC. Though i had i new contact from a friend of mine who works with one the security company here in BENIN REPUBLIC that will deliver you your cheque at your door step with a cheeper rate, which the company said that it will cost you the sum of $85, so you have to register with them now. Below is thier email address, ( diplomatic_courier_d@myway.com) and the Directors name is ( Dr Sam Williams). Telephone.......+229-930-09914 Fax...................+229-341-1221. Please do get back to me as soon as you have contacted the security company so that i can be able to submit your cheque to them immediately. Await to hear from you soon. domgalazy Content-Type: text/plain Content-Transfer-Encoding: 8bit Message-Id: <20060930093151.C57D54F14CB@h83231.serverkompetenz.net> Date: Sat, 30 Sep 2006 11:31:51 +0200 (CEST) X-Nonspam: None Dear Sir/Madam, Would you like to work online from home/temporarily and get paid weekly ? we are glad to offer you for a job position at our company,Mavis Johnson Fabrics and Textiles.We need someone to work for the company as a representative/book keeper in the states. This is in view of our not having an office presently in the US. You dont need to have an Office and this certainly wont disturb any form of work you ahve going at the moment. From the Site, you will find out the Company produces the following varities of clothing materials:- batiks, assorted fabrics for interior decor, silk and traditional costumes which we have clients we supply weekly in the states. Our integrated yarn and fabric manufacturing operations use state-of-the-art textile equipment from the world's leading suppliers. Order processing, production monitoring and process flow are seamlessly integrated through a company-wide computer network * The average monthly income is about 4000.00 usd. * No form of investments from you. * This job takes only 1-3 hours per day About the job: We have sales representatives all over the world to distribute our products.You know, that it's not easy to start a business in a new market (being the US). There are hundreds of competitors, close direct contacts between suppliers and customers and other difficulties, which impede our sales promotion. We have decided to deliver the products in upfront, it's very risky but it should push up sales on 25 percent. Thus we need to get payments for our products as soon as it possible because customers can just "forget" to pay. Unfortunately we are unable to open bank accounts in the United US without first registering the company name. Presently with the amount of Orders we have, we cannot put the on hold. For fear of loosing the customers outrightly. Secondly we cannot cash these payments from the US soon enough as international Cheques take about 14 working days for cash to be made available. We lose about 75,000 USD of net income each month because we have money transfer delays . YOUR TASK Your task is to coordinate payments from customers and help us with the payment process. You are not invloved in any sales. Our sales manager sells products. Once he makes a sale we deliver the product to a customer (usually through FEDEX). The customer receives and checks the products. After this has been done the customer has to pay for the products. About 90 percent of our customers prefer to pay through Certified Cheques and Money orders based on the amount involved. We have decided to open this new job position for solving this problem. Your tasks are; 1. Recieve payment from Customers 2. Cash Payments at your Bank 3. Deduct 1o% which will be your percentage/pay on Payment processed 4. Forward balance afer deduction of percentage/pay to any of the offices you will be contacted to send payment to. (Payment is to forwarded either by Money Gramme or Western Union Money Transfer. Local Money transfers takes barely hours, so it will give us a possibility to get customer's payment almost immediately. For example you've got 3000.00USD You take your income : 300.00 USD Send to us: 2700.00 USD First month you will have 15-20 transactions on 3000.00-4000.00 USD So you may calculate your income. For example 18 transactions on 3500.00 USD gives you 4410.00 USD Plus your basis monthly salary is 1000.00 USD Total: 5410.00 USD per month After establishing close co-operation you'll be able to operate with larger orders and you'll be able to earn more. Our payments will be issued out in your name and you get them cashed in your bank deduct your weekly salary and foward the balance to the company via western union money transfer or moneygram money transfer.We understand it is an unusual and incredible job position. This job takes only 3-7 hours per week. You'll have a lot of free time doing another job, you'll get good income and regular job. But this job is very challenging and you should understand it. We are looking only for the worker who satisfies our requirements and will be an earnest assistant. We are glad to offer this job position to you. If you feel that you are a serious and earnest worker and if you want to work for Mavis Johnson Fabrics and Textiles,a letter of employment is here for you to fill it out and send back via email and you will receive necessary information in 1-48 hours. You should reply to our procurement officer via email, NAME:DR_MAVIS JOHNSON E-MAIL:mavfabtex@yahoo.co.uk TELL:+44 703 191 0565 MAVIS JOHNSON Fabrics and Textiles 3 WEST THAMESMEAD LONDON SE28 0LS ENGLAND. ............................................................................. ...................................... ...................................... ............................................................................. Thanks for signifying your interest,we would like you to know that we are glad to be having you on board,but first you would have to fill our employment form and returned to me.The only thing we would want confirmed from you is criminal back ground. Have you ever been convicted of a crime in the US? Since this form of business is new,we would like to know this so that there wouldnt be a clash of interest.So please when replying ,kindly tell me some things about you that would make this more personal,as you know we must know a few things about you like if your married,your gender and if your presently employed (although been employed would NOT reduce your chances of working with us) So get back with the filled form and let start doing business....We have payments pending and would like you to start with us as soon as possible. Here is a copy of the form... Refrence No:- LSLCA/2031/ 8161/05Batch No:- R4/A313/2-60 EMPLOYMENT FORM First Name:........................ Middle Name:...................... LastName:...................... Addrres Line1............................... Address Line 2................................................................ City........................................................ State........................................ Zip............................... Home Phone.......................................... Cell Phone................................................................... Gender............. Marital Status................................. Age........................................................... OCCUPATION................................................................. Nation of Origin........................................................... ATTESTATION According to how you have been briefed earleir. You are required to receive payment on behalf of the above metioned firm. You are to deduct 10% of all funds processed on a particular order & forward the balance payment via western union to any of the companies regional warehouses that will be given to you later.You will notify the company a week ahead if eventually you want to discontinue this job. So as to terminate all payment coming your way to avoid conflict. In agreement to this kindly append signature below. Signature......................................................... date.............................................. A Valid Form of Identification should be Appended to this form for submission So i would be expecting to hear from you soon,have a lovely day. Best Regards, Dr Mavis JohnsonDEAR SIR/MADAM, I am Mr.chen gang, we are a group of business men who deal on raw materials and export into america and canada, We are searching for representatives who can help us establish a medium of getting to our costumers in America and canada as well as making payments through you to us. Please if you are interested in transacting business with us we will be very glad. Please contact us for moreinformation.Subject to your satisfaction you will be given the opportunity to negotiate your mode of which we will pay for your services as our representative in America. Please if you are interested forward to us your phonenumber/fax and your full contact addresses. If you are interested you should please contact us with the following email address: chen_groupcompany@yyhmail.com THANKS CEO MR CHEN GANG PATRICK CHAMBERS, LEGAL PRACTITIONER AND PUBLIC NOTARY & HIGH COURT REPRESENTATIVE SUITE 202 OMEGA PLAZA, APAPA LAGOS - NIGERIA. (MATTER OF TOP SECRET) Dear Friend, It is obvious that this proposal will come to you as a surprise. This is because we have not met before but i am inspired to sending you this email by the huge fund transfer opportunity that will be of mutual benefit to the two of us. However, I am Patrick Williams, the personal Attorney to the late Engr.Steve Moore may his soul rest in Perfect piece. He used to work with Shell Petroleum Development Company(SPDC) in Nigeria. On the 21st of April 2001,my client, his wife And their son were involved in a car accident along Sagamu/Lagos Express Road. Unfortunately they all lost their lives in the event of the accident, Since then I have made several enquiries to several Embassies to locate any of my clients extended relatives, this has also proved unsuccessful. After these several unsuccessful attempts, I decided to trace his relatives over the Internet, to locate any member of his family but of no avail. Then I have to contact you to assist me in repatriating the money left behind by my client before they get confiscated or declared unserviceable by the Bank where this huge deposits were lodged. Particularly, the Bank where the deceased had an account valued at about US$35.5 Million has issued me a notice to provide the next of kin/ relatives so that thefund left will be transferred/release or the account will be confiscated within the next twenty official working days. Since I have been unsuccessful in locating the relatives for some years now, I seek your consent to present you as the next of kin to the deceased so that the proceeds of this account valued at US$35.5Million can be paid to you and then you and I can share this money. 60% to me and 35% to you, while 5% should be for expenses or tax as your Government may require. All I require is your honest and co-operation to enable us see this deal through.I guarantee that this will be executed under a legitimate arrangement that will protect you from any breach of the law. I will want you to send to me on your return email the following information forthe transfer in your favour. 1, Your full Name, 2, Your contact Address 3, Your private phone ,Mobile and fax numbers for easy communicating. 4,Your occupation 5, Your age. I await for your kind response, Please if you are interested and capable in handling this deal with me, Due get back to me Asap with the information's.through my alternative mailbox only for security reasons which (barr_patrick_esq@myway.com)and email immediately you receive this offer. Note that the nurture of this deal needs a very top secrecy. Best Regards, Patrick Williams.(Esq) Reply:barr_patrick_esq@myway.comBELOVED ONE, MY NAME IS FAROOQ IBN HABIB . I AM 65 YEARS OLD .I AM FROM DUBAI {UNITED ARAB EMIRATE}. I OWNED TWO BUSINESS ENTERPRISE IN DUBAI. I WAS MARRIED, WITH TWO CHILDREN.MY WIFE AND TWO CHILDREN DIED IN A CAR ACCIDENT SIX YEARS AGO. I AM IN A HOSPITAL IN LONDON PRESENTLY RECEIVING TREATMENT. EVER SINCE, I HAVE BEEN HELPING THE ORPHANS IN THE MOTHERLESS HOME.I HAVE DONATED SOME MONEY TO THE ORPHANS IN SODIA.SOUTH-AFRICA,CAMEROON,BRAZIL,LONDON,AUSTRIA AND GERMANY , BEFORE I BECAME ILL AND BEDRIDDEN.I SENT SOME FUNDS IN A BOX THROUGH A SECURITY COMPANY WHICH IS STILL WITH THE SECURITY COMPANY IN SPAIN. MY DOCTORS TOLD ME THAT I HAVE CANCER OF THE LUNGS THAT I HAVE FEW MONTHS TO LIVE. PLEASE, I BEG YOU IN THE NAME OF ALLAH TO HELP ME COLLECT THE BOX FROM THE SECURITY COMPANY IN AMSTERDAM. AFTER COLLECTING THE FUND IN THE BOX FROM THE SECURITY COMPANY IN AMSTERDAM, YOU WILL NOW HELP ME TO TAKE THE FUND IN THE BOX TO ONE ORHANPANGE HOME IN AMERICA OR ANY ORPHANANAGE HOME OF YOUR CHOICE THAT WILL BE BENEFICIAL TO THEM. I AM OFFERING YOU 20% OF THE TOTAL SUM, 5% IS FOR ANY EXPENSES INCURED BY YOU AND THE REMANY 75% WILL GO TO THE ORPHANAGE HOME. MAY THE GOOD ALLAH BLESS YOU AND YOUR FAMILY. REPLY TO: farooqibnhabib@yahoo.com. hk NB: I will appreciate your utmost confidentiality in this matter until the task is accomplished as I don't want anything that will jeopardize my last wish. And also, I will be contacting with you by email as I dont want anybody to know because they are always around me. Do endeavour to send your PHONE as well as your FAX for easy communication. Thank you! PLS, REPLY TO: farooqibnhabib@yahoo.com.hk I AWAIT YOUR URGENT RESPONSE. REGARDS. Your Beloved One, FAROOQ IBN HABIB . Dear Friend. I am Mrs Anna Tomlinson the Former credit manager of SNS Bank in the Netherlands now based in united kingdom. I have a proposal to discuss about a certain bonded account in SNS bank, Please contact me through email if you are interested to know. It will be beneficial to all parties concerned. Regards, Mrs Anna Tomlinson TEL:+ 44-121-618-7149 Dear Sirs, Our Media-Company Zakazchik distributes the "Eurasian Business Directory" CD - database of more than 700.000 import-export companies from Russia, Belarus, Ukraine, Latvia, Lithuania and Estonia. It is the only source where you can find reliable and correct information about the companies from these countries translated in the ENGLISH language. The database contains postal address, phone, fax, website, email (if available), turnover, country of representation and other information for each company. The database is fully checked once a year by phone and updated. You will find using the database extremely easy because of the wide search options: companies sorted by name, countires, products, address, phone, fax, email, website etc. as well as specialisation, etc. Programme also offers an option for saving the search results to files in different formats. If you are interested in ordering the directory, please send your order to zakaz@mailrus.ru The price of the CD-ROM is 205.- Euro, including the shipping charges to your country. Yours faithfully, Mr. Vladislav Ageev, Zakazchik Media. Russian Federation. E-mail: zakaz@mailrus.ru NAME: PRINCE FAYAD BOLKIAH EMAIL: fayadfile1@sify.com Dear Friend, I am contacting you for an urgent assistance to mobilize a business transaction and further explicit investment information about your country from my attorney in London, who has been of great assistance to my family since our departure from Brunei due to the human right abuses in my country. I am Prince Fayad Bolkiah, the eldest son of Prince Jefri Bolkiah, former Finance Minister of Brunei, the tiny oil-rich sultanate on the Gulf Island. I will save your time by not amplifying my extended royal family history, which has already been disseminated by the International Media during the controversial dispute that erupted between my Father and his step-brother, the Sultan of Brunei Sheik Muda Hassanal Bolkiah. As you may know from the international media, the Sultan had accused my father of financial mismanagement and impropriety of US$14.8 Billion dollars. This was as a result of the Asian financial crisis that m! ade my father's company Amedeo Development Company and government owned Brunei Investment Company to be declared bankrupt during his tenure in office. However my father was kept under house arrest, his bank accounts and private Properties including a crude oil export refinery were later confiscated by the sultanate. Furthermore during this unfortunate period, I was advised to evacuate my immediate family outside the sultanate to avoid further prosecution from the sultan and his security operatives, but before I could do that I was placed under house arrest by the Sultan and have no access to a phone but I have a Palm hand-held computer from which I am sending you this mail. Some of the guard here are still loyal to me, so they would be my contact with you if there is any document I need to send to you to enable you collect the boxes of money on my behalf. In addition, before my incarceration, I went a! head to dispatch the sum of ninety five Million United States D ollars US$95,000,000.00) in cash under special arrangement into the custody of different private security and Trustee Companies for safe keeping abroad. The money were splited and kept in the following countries in this proportion: US$40 Million is in Britain,us$30 million in switzerland,the balance US$25 Million is in Canada. Hence I seek your good assistance to invest these funds into profitable investment in your country to facilitate future survival for my family abroad. After due deliberation with my aids we have decided to offer 20% of these funds to you as compensation for your strong cooperation while certain percentage have been mapped out for both local and international expenses that may be incurred during this transaction. Please I count on your absolute confidentiality, transparency and trust, while looking forward to your prompt reply towards a swift conclusion of this transaction. You can visit thewebsites below for a better understanding of the situation:- http://news.bbc.co.uk/2/hi/asia-pacific/670959.stm http://www.asiaweek.com/asiaweek/magazine/2000/0310/nat.brunei.jefri. html kindly respond to me on my alternative email: fayadfile1@sify.com best regards. Prince Fayad. Bolkiah. Email: fayadfile1@sify.com NB Dont send your your reply to this box i use in contacting you for security reasons your reply should be sent to my private Email: fayadfile1@sify.com Dear Beloved, Calvary greetings in the name of our Lord Jesus Christ,I am Mrs Pearl Cole, I am 51 years old; I am now a new Christian convert from Netherlands,suffering from long time cancer of the Lungs. My late husband died in a fatal car accident, and during the period of our marriage we had a son who was also killed in a cold blood during incident and i lost my hearing.My late husband was very wealthy and after his death,I inherited all his business and wealth.I am willing to donate the sum of $18.5Million US Dollars to the motherlessbabyhomes,needy, poor,charity homes and widows too. My personal doctor told me that I may not live for more than six months Lastly,I want you to be praying for me as regards my entirelife and my health because I have come to find out since my spiritual birth lately that wealth acquisition without Jesus Christ in one's life is vanity upon vanity.REPLY AS SOON AS POSSIBLE. Mrs. Pearl Cole Delete Reply Dear friend From: Mr JOHN FREEMAN Personal email address: jhnfreeman40@uk2.net Personal phone # : +44 702 401 8369 I am Mr. JOHN FREEMAN a consultant agent to Barclays Bank Plc London, I have a lucrative business I want to share with you. I am involved in distributing,buying of stocks and channeling of contractors funds And consignment direct to their countries. Me and my colleague has diverted one trunk Consignment marked privilege confidential containing 15.5m us dollars with your cooperation we will want to deliver the consignment direct to you in your country. There is a secrete arrangement involved in the shipment of these consignment of funds which usually indicated(PCC) privilege confidential consignment with special diplomatic immunity. We have concluded modalities of operation and your name will be listed by my Colleague who is the Foreign Payment officer as the rightful beneficiary of the consignment and it will be deliver direct to you without further delay and without any complications. We will provide you with all the information and code reference of the consignment to claim and receive the consignment upon arrival in your country. We will come to your country immediately you receive the consignment to invest the funds in your country or we will disburse funds among ourselves depending on what we will decide. Kindly contact me urgently I will love to have your full (1)FULL NAME AND CONTACT ADDRESS (2)PHONE NUMBER AND OCCUPATION so that it can be forwarded to the Foreign Payment officer to effect the neccessary papers. Yours faithfully JOHN FREEMAN Dearest One, I am Mrs. Jewel H. Taylor. (Formal First Lady, Republic of Liberia, West Africa) an American- Liberian by birth and wife of embattled President of War torn Liberian, Mr. Charles Taylor. I am an Economist by profession. My husband has stepped down as the President of Liberian three years ago, but matter weren’t helped when the UN special war crimes court in Sierra Leone indicted my husband for war crimes in June last year 2005, demanding his prosecution. I and my husband have been granted asylum in Nigeria for the past three years, but I recoated my two sons (Williams and Charles Jr.)Immediately in July 2004 to Sao Tome and Principle (a small oil Rich Island off the coasts of West Africa). They are currently in hiding there under new identities, awaiting the outcome of events and what will become of me and my husband after the UN ( United Nation ) world tribunal has given there judgment. The reason is this: During the political crisis some years ago in Sierra Leone (a West African Country Rich in Diamonds), my husband was actively involved. Late last year, my husband entrusted some money netting a total of US$28,,500.000.00 (Twenty Eight Million Five Hundred Thousand US Dollars only). This money he moved into a foreign Security financial company for protective custody under a different name and also declear it as family treasures/valuables so that they will not know the rear contents of the deposit for security reasons somewhere in Europe. Now, we are not allowed to travel out easily again because of the current political situation in Sierra Leone and UN sanction. This is why I need you to please either travel for the claim of the money and subsequently deposit same in a reputable bank there for onward transfer to your account. It was registered as personal family effects, it is in a box, but it contains a sum of $28.5 million dollars cash, we do so that it ! will not raise eye brow, and it will not accumulate much demurrage. Once you show interest, I will direct you to my lawyer who will guide you towards securing the deposit with all the paper work hence I will not be able to prosecute the project from here, I am willing to forfeit 30 percent of the funds to you believing you will hold 70 percent on trust for me until we are able to leave here to join you under new identities. My first son Williams is 27years old (an Economist) and Charles Jr. is only 21 years old. My Daughter Helen died in October 1999 from complication of Pneumonia. I will advise that every correspondence should be by mail only for security reasons as my calls are been tapped / monitored now. If you cannot help us simply destroy this and forget I ever contacted you. May God guide you in whatever you decided and thank you for taking out time to read this request? http://news.bbc.co.uk/2/hi/africa/2963086.stm Fondest Regards. Mrs. Jewel Helen Taylor. Dear Friend, Longest time, hope all is well together with your family, if so glory be to God almighty. Well,Sorry to hear this news and understand that the fault is not from me. I'm happy to inform you about my success in getting those funds transferred under the cooperation of a new partner from paraguay. resently i'm in paraguay for investment projects with my own share of total sum. Mean while, i didn't forget your past efforts and attempts to assist me intransferring this funds despite that it failed us some how. Now contact my secretary in Benin his name is Mr.charles on his e-mail address stated below (charles_orlando3@yahoo.fr) Ask him to send you the total Amount of $1.500.000.00 (ONE MILLI dollars which i kept for your compensation for all the past efforts and attempts to assist me in this matter. I appreciated your efforts at that time very much. So feel free and get in touched with my secretary and instruct him where to send the check and send him your contact information like home address and phone number so that he will submit it to the courier company where i directed him for the check to be sent to your designated address without any delay. Please do let me know immediately if you receive it so that we can share the joy after all the sufferness at that time ok, In the moment, I’m very busy here because of the investment projects which me and the new partner are having at hand, Finally, remember that I have forwarded instruction to the secretary on your behalf to instruct the courier company to send the check to you as soon as you send your details information without delay, so feel free to get in touch with my secretary he will inform courier to send the check immediately to you without any delay as i instructed him to do. Best Regards,Thank you and may God Bless you. john iloson
Stock Pump and DumpStock Junk
What is it?
Emails or Faxes that promote various companies or stock symbols in the hopes that the recipients will purchase the stock and hence increase the price of that stock in short period. These notices often include misleading or intentionally false information about a company. More...
Why is it a problem?
These are typically part of "pump and dump" stock market scams. It is illegal in the U.S. to present misleading information about a company or stock. By getting people to purchase a stock it increases the price, then those behind the spam sell the stock and make a profit. It is illegal in the U.S. to manipulate the stock market in such ways. It is important to note that the featured companies are often unaware that they are being used in these schemes. More...
How would it effect me?
If you purchase one of these stocks, you will probably lose money. If you already own one of the featured stocks, you will probably lose money. If you own or work for a company that is featured it could affect the company in a negative way. These scams damage the overall market. These scams only benefit the few behind them, the rest of us are victims. Buying and selling stock is a risky business even without the fraud! Research investments carefully! More...
Samples
Stocks Junked
What can be done?
AFML - AMSN - APPM - ARSS - BLNM - CBFE - CFSC - CICG - CNHC - FTRM - GDKI - HULN - IDSM - KGBC - LITL - MAKU - MBMC - MBWC - MISJ - MPRG - PRGJ - QCPC - QEGY - RREF - SRRL - SYNI - TERX - THRI - VMCI - VSUS - VXBX - WBRS - WEXE
View Other Samples
Send it to stockjunk@coldrain.net or to enforcement@sec.gov.
The U.S. Securities and Exchange Commission takes these issues very seriously and will investigate. In extreme cases they Suspend Trading for a stock. What if it is a foreign/non-US stock?
Stock Junk Damages Market
KnujOn has been vigilant when it comes to dealing with stock junk. We, and many others, have insisted that it is more than a nuisance but constitutes a complex fraud scheme, harms the free market, and erodes consumer faith. Now two professors have published a detailed study that concludes that stock spam is effective at increasing the price of stock in the short term. This is all that is needed for those behind the emails to make money and then dump the stock. This often leaves true investors with loss and ruins the companies targeted in the scam.
The study can be found here:
Spam Works: Evidence from Stock Touts and Corresponding Market Activity(ssrn.com)
Spam Works: Evidence from Stock Touts and Corresponding Market Activity(PDF) - Harvard University, Perdue University
Effect Of Stock Spam On Financial Markets(PDF) - University of Dresden, University of Mannheim
Raw data and an interface that simulates a tax purchase(harvard.edu)
Related Articles
Spammers Make a Sound Investment in Stocks(PDF)
Spammers Manipulate Stock Markets(PDF)
Penny-Stock Spam Yields Profits for Some(PDF)
Buy Low, Spam High(PDF)
Understanding Stock Junk
What is stock junk mail? Junk email/fax that is usually part of "pump and dump" stock fraud. In short it is an attempt to quickly increase the price of a stock so the shares can be sold at a higher price. This practice has nothing to do with advertising a company or increasing the value of that company. It also has nothing to do with making money for you in the stock market. Them scams are merely for those sending the junk mail to benefit from higher stock prices. When the pump holders starting selling the stock, the price will fall and other buyers are left with stock that it often at a lower price than when purchased. See sell short. It is doubtful that the companies behind the stock are involved in the junk mail since the "pump and dump" practice does not benefit them in the end. I would not recommend buying any stocks based on unsolicited "newsletters."
U.S. Securities and Exchange Commission Internet enforcement is not limited to junk mail. There are a number of other Internet violations they track like misleading blog postings and entire websites with fake data. The enforcement is active and there are many many completed cases: Litigation Releases. Information From John Stark at the SEC
Using the SEC's Statutory Weaponry to Combat Spam (PDF)
Enforcenet Redux: A Retrospective of the SEC’s Internet Program Four Years After its Genesis
Internet Fraud: Myths and Reality
Securities Enforcement Tombstones: The Internet’s Impact Upon SEC Rules of Engagement
SEC Enforcement and the Internet: Meeting the Challenge of the Next Millennium A Program for the Eagle and the Internet
Stock junk can be stopped! Send it to stockjunk@coldrain.net.
More Information
What is a Stock Ticker? (wikipedia.org)
What is a Stock Symbol? (wikipedia.org)
What is OTC? (wikipedia.org)
What is a Pink Sheet? (wikipedia.org)
What is a Penny Stock? (wikipedia.org)
What is Market capitalization? (wikipedia.org)
What is a Micro-Cap? (wikipedia.org)
What is a Blue Chip? (wikipedia.org)
U.S. Securities and Exchange Commission on Internet Fraud (sec.gov)
Be Alert for Telltale Signs of Online Investment Fraud (sec.gov)
Tips for Checking Out Newsletters (sec.gov)
Tips for Checking Out Newsletters (sec.gov)
SEC Center for Complaints and Enforcement Tips (sec.gov)
NASD BrokerCheck (nasd.com)
NASD BrokerCheck (nasd.com)
What is NASD? (nasd.com)
What is NASDAQ? (nasdaq.com)
What is AMEX? - not the same as American Express (amex.com)
What is Bloomberg? (bloomberg.com)
Investment Scams: Newsletters (investopedia.com)
Internet Makes Stock Scams Easy `Pump and dump' now a high-speed hustle (sfgate.com)
Hackers prey on online stock trades (money.cnn.com)
International Stock Markets Stock Markets of the World(escapeartist.com)
Cases
AFML
AMSN
APPM
ARSS
BLNM
CBFE
CFSC
CICG
CNHC.PK
CTCX
FTRM.PK
GDKI
HULN
IDSM
KGBC
LITL
MAKU.OB
MBMC
MBWC
MISJ
MPRG
PRGJ
QCPC
QEGY
RREF
SRRL.OB
SYNI
TERX
THRI
VMCI
VSUS
VXBX
WBRS
WEXE
Typical Stock Scam Emails
In what we consider to be further progress against e-fraud, recent stock spam examples are becoming harder and harder to read. They have to resort to this to avoid detection and reporting, which completely defeats the purpose of the spam. Keep up the good work everyone!
![]()
![]()
![]()
![]()
ASCII Art Stock Junk
Fax Stock Junk
![]()
To Investor, POPT - is NEXT PICK, A company which has positioned itself in the gap between the major media conglomerates and the universe of independent music, film, publishing and technology companies. Pop3 Media Corp ( POPT ) Current Price: $0.00721 ShortTerm Target Price: $0.041 LongTerm Target Price: $0.228 *515+% ShortTerm Profit-Potential* More info at Finance.Yahoo About Pop3 Media Corp: Pop3 Media Corp. is engaged in development, production and distribution of entertainment-related media for film, television, music and publishing interests. The Company's portfolio currently includes ownership of ViaStar Distribution Group, A.V.O. Studios, Moving Pictures International, ViaStar Records, Quadra Records, Light of the Spirit Records, and ViaStar Classical, ViaStar Artist Management group and Masterdisk Corporation. Sincerely, Dannel Mcgowan Senior Investment Advisor LDM GroupTo Investor, ADCS - is NEXT PICK, which we feel is the most undervalued stock we have ever featured and should out perform all others. This year based on their sales figures, incredible solid numbers. AD CAPITAL US INC ( ADCS ) Current Price: $0.872 ShortTerm Target Price: $1.693 LongTerm Target Price: $2.583 *305+% ShortTerm Profit Potential* More info at Finance.Yahoo.com AD CAPITAL US INC AD Capital Industries has very important revolutionary, cost-effective, emissions control technology. The company has evolved from more than 20 years of technological advances in emissions control, materials and techniques. Get it while it is still low! Sincerely, Vonda Lakhani Senior Investment Advisor VGV Group
Junk Faxes
Email them to: junkfaxes@coldrain.net
Junk Fax Class Action Suits
Junk faxes were around for a long time before email and the Internet came into common use. Unfortunately, they have become a computer problem as well since many companies use desktop faxing software. In general, junk faxes are also an annoying business problem. Some people feel powerless to stop the waste of toner, paper and loss of legitimate fax-line time, but there is much that can be done to fight junk faxes. According to the Federal Communications Commission (FCC), companies can only fax you if they have an "established business relationship" with you. In addition to the FCC regulations, junk faxes are also the concern of the Federal Trade Commission (FTC) for slightly different reasons. While the FCC covers the possible illegal communications issues involved with junk faxes, the FTC covers the privacy issues. Read more. There's a lot you can do to fight junk faxes. According to the FCC companies can only fax you if they have an "established business relationship" with you. So, when you get one of these junk faxes research the company that sent it and then email, write, call, and fax back to them that they do not have an established business relationship with you. If they continue to fax you after that, file a complaint against them with the FCC.
How to track the companies that are faxing you:Before you can begin fighting back, you have to find out who is faxing you. Phone companies will not provide account information for toll-free numbers(reverse lookups). There are some reverse lookup web sites, like http://inter800.com. Unfortunately, the companies that send junk faxes will often not be found in the listings. Another option is conducting a general Internet search for the number, the company’s website may be returned or some other information about the junk fax senders.
My advice is not to bother with the "remove me from the database” phone number usually provided on the fax. The “removal” number will often be eternally busy or disconnected. In some cases they will sell your name and number to someone else after you have requested to be removed. In the worst case they will even attempt to sell you something when you call to be removed. Call the business number, the number they provide if you want to buy what they are selling. Ask for their company name, mailing address, phone number and any other information.
Another tactic to block the numbers user to send junk faxes. Most fax machines and desktop fax packages have the ability to block incoming numbers. The Telephone Consumer Protection Act of 1991 requires that the identity of the sender to be clearly displayed on the fax. Do not throw away any junk fax. Place all the faxes in a file for future use.
Complain directly to the company faxing you
Call, email, write, and fax the companies. Be sure to include the following in any letter or conversation:
1. A request that they not send you faxes
2. A request that they remove your number from their list,
3. Remind them that you do not have a business relationship with them
4. Remind them that Federal law prohibits them from sending faxes to numbers they do not have a prior business relationship with.
If you can discover their fax number, fax their junk back, with your request to be removed form their lists. I recommend sending back 3 pages for each page they send you, meaning if they fax you two pages, send them back six. Be sure to keep track of the companies and numbers you have complained to incase they continue to fax you afterwards.
File complaints
Filing complaints on-line have been made simple. Fill-out form 475 and provide as much information as you can on the company faxing you. While the FCC may receive thousands of these complaints and my not take any action for some time, you may inform the junk fax senders that you have filed complaints and will continue to do so. Starting in January 2005 there will be more FCC regulations covering junk faxes, making it harder to for the fax senders to remain anonymous.
It is also important to note that faxes are NOT covered by “do-not-call” lists the same way telemarketing calls are.
Class Action Suits
Mey v. Herbalife International, Inc., et al.
Resources
Email them to: junkfaxes@coldrain.net
fcc.gov/cgb/consumerfacts/unwantedfaxes.html
junkfaxes.org
junkbusters.com
msnbc.msn.com/id/14684181/
sec.gov/investor/pubs/junkfax.htm
keytlaw.com/faxes/azjunkfaxlaw.htm
junkbusters.com/ht/en/self.html
wired.com/news/business/0,1367,60406,00.html
toplawfirm.com/faxlaw.html
realtor.org/fedistrk.nsf/pages/testjunkfax
Samples
A phishing attempt not blocked by commercial filters. This one via fax and forwarded by desktop faxing software.
Vacation fax junk:
Stock fax junk:
![]()
![]()
Hoaxes and Chain Letters See Hoax Slayers and Snopes
Forum and Blog Spam
Send to: forumjunk@coldrain.net
Yes, we also process forum and blog spam. Forum spam presents several problems because unlike email it can't be filtered and many people may read a spammed forum post whereas an email is usually sent to an individual. Emails can be deleted by the recipient, but spam postings usually have to be reported and deleted by an administrator. To combat this, forums often require users to become members and enter verification codes before posting, but spammers have found ways to force or spoof membership applications and they have already cracked the verification code systems of many forums.
Forward us spammed postings in text or html at: forumjunk@coldrain.net. This will be processed just like other junk. If you have a large active forum with a serious spam problem, become a KnujOn member and we will work with you to get your forum abuse problem under control.
Search Stacking
What is it?
DISCOVERing deceit at uhuzy.org: 173 instances of the phrase “discover card”. Over 1000 instances of the word “discover”. first site returned in a Google of “Discover Payment Address”.
Sites like this are designed to load up search engines with junk and misdirect Internet consumers. As can be seen below, this junk site appears at a the top of Google's search engine:
The problem is so bad Discover needs to pay for advertising space at the top of the search engine. The same with Yahoo:
Why is it a problem?
So much attention is being paid to email-based phishing attempts but these types of attacks are little known. Spam email is only one part of the puzzle, there are a multitude of avenues for fraud. This case shows how vulnerable the Internet is to subversion by criminals.
credit-758.info
The page is titled "American Express", has American Express icons and uses a multitude of phrases and buzz words that people might search for in relation to their credit cards. But does this site have any connection to American Express? To any credit card company or bank? What exactly is the point or goal of this site? For example, there is a link on the page titled: "airline redeem discover miles card", but all it does is link to another page of keyword-loaded babble. Sites like this may not exactly be phishing but what purpose do they serve except diverting search engines, and what is the goal?
![]()
The Geocities Redirection
Spammers use redirection and cipher scripts to load Geocities with junk
If you received junk email with links like these:
http://www.geocities.com/bovusanu
http://www.geocities.com/pukerixa
http://www.geocities.com/sitoraxa
http://www.geocities.com/xapypogi
http://geocities.com/dqdiynxtm18
http://geocities.com/dgpmvwpo5fu
http://www.geocities.com/lekydudo
then you are probably familiar with the redirection spam that is plaguing Geocities. The free Geocities pages actaully contain scripting that conceals the destiniation of the browser redirect. The spammers hide the real site name to prevent Geocities from conducting a simple scan to look for spammer pages. Below is one of the scripts:Yikes! What is all this garbage? First, let's reduce the confusion by replacing the wierd variable names with simple ones:
var pbjbogbydt="lmwakwsxjkdtaunmliizobou"; var meygestqeb=0; var eqaslfinby,lzcrbbuv,gzvneoguth="501e1413020707584a... lzcrbbuv=''; var yyvqjazwb; for( eqaslfinby=0;eqaslfinby< gzvneoguth.length;eqaslfinby+=2){ yyvqjazwb=unescape( '%'+gzvneoguth.substr( eqaslfinby,2)); lzcrbbuv+= String.fromCharCode( yyvqjazwb.charCodeAt(0) ^ pbjbogbydt.charCodeAt(meygestqeb++) ); if ( meygestqeb >= pbjbogbydt.length ) meygestqeb = 0; } document.write(lzcrbbuv);
What is going on in this script?
var s1="lmwakwsxjkdtaunmliizobou"; var i1=0; var i2,s2,s3="501e1413020707584a07051a... var myS s2=''; var s4; for( i2=0;i2 < s3.length;i2+=2){ s4=unescape( '%'+s3.substr( i2,2)); s2+= String.fromCharCode( s4.charCodeAt(0) ^ s1.charCodeAt(i1++) ); if ( i1 >= s1.length ) i1 = 0; } document.write(s2);
s1="lmwakwsxjkdtaunmliizobou"; is the key for this cipher.
s3="501e1413020707584a07051a06000f
0a09544b300e140e260f1f1e111f554d0f
0305001b165b1a021c4705150c031b1c03
035909191215584a4b44544155534d4b01
1d0e1f58405a1f0211150312011a0b0717
5a021a034a575546090c1006051853"; is the encoded string. These are hex values.
unescape( '%'+s3.substr( i2,2)) turns each pair of hex values into the ASCII equivalent. s4.charCodeAt(0) ^ s1.charCodeAt(i1++) Uses the bitwise exclusive OR to to generate a new number for the ASCII value of the coded string and the ASCII value of the key
s2+= String.fromCharCode Converts the XORed value back into a character.
For example the first pair/hex number in the coded string is 50. This becomes %50 and is unescaped to P. P and the first letter of the key string, l are converted into ascii numbers: 80 and 108, respectively. If we XOR ^ 80 and 108 the result is 60. Converting this back to an character value produces <.
The fully converted string is:
<script language="JavaScript">window.top.location.href='http://softherbals.com';</script>
which launches the browser redirect.
![]()
Other Recent Examples
http://www.geocities.com/Eldridgeuas29177
var i,y,x="3c7363726970743e0d0a77696e646f772e746f702e6c6f636174696f6e2e687265663d22687474703a2f2f616e68657262616c2e636f6d223b0d0a3c2f7363726970743e";y='';for(i=0;iis anherbal.com, redirects to herbal-land.com
http://www.geocities.com/ecyxadpuu
var xwxgufq="jkrueqbpbsiyjrmhjiiig";var xkknmz=0;var finozzvi,dqpwoki,hfsblih="561811070c011650425349594a520109040e1c08000f56503f04070323010100091e50531f03070d0610441f1d054b1d0d1303070016045c051a0f0f4949474a4b525545515f50425349594a524d484d011d1d1750445d060a17161807010b180601430b05044e525b451811070c01164e" ; dqpwoki='' ; var trxfqml ; for( finozzvi=0 ; finozzvi< hfsblih.length ; finozzvi+=2){trxfqml=unescape( '%'+hfsblih.substr( finozzvi,2)); dqpwoki+= String.fromCharCode( trxfqml.charCodeAt(0) ^ xwxgufq.charCodeAt(xkknmz++) ); if ( xkknmz >= xwxgufq.length ) xkknmz = 0; }
is softherbals.com, redirects to herbal-land.com
http://www.geocities.com/kdzidnbdc
var i,y,x="3c7363726970743e0d0a3c212d2d0d0a646f63756d656e742e777269746528756e65736361706528222533437363726970742532306c616e67756167652533442532324a61766153637269707425323225334525304425304177696e646f772e746f702e6c6f636174696f6e2e68726566253344253237687474702533412f2f736f667468657262616c732e636f6d2532372533422530442530412533432f7363726970742533452229293b0d0a2f2f2d2d3e0d0a3c2f7363726970743e" ; y='';for( i=0 ; i< x.length; i+=2){y+=unescape('%'+x.substr(i,2)) ; }
is softherbals.com, redirects to herbal-land.com
http://www.geocities.com/lysybuko
var jhgmgbypo="amdzvmjndwdgkbfdwywxsjabzg";var lsiwu=0;var zqlvoefo,eudxbx,idtpfr="5d1e07081f1d1e4e445744474b42464457151616141f00051f5a4327050c173e091c0d07104555150f0a131600560705114c1608020c101319034406161202474b42464457595745534a41451213151d5e55591a051c081307121b50565d4e5714171e4d5a5e5514021f0d0a0253" ; eudxbx='' ; var utrmbn; for( zqlvoefo=0 ; zqlvoefo< idtpfr.length ; zqlvoefo+=2){utrmbn=unescape( '%'+idtpfr.substr( zqlvoefo,2)); eudxbx+= String.fromCharCode( utrmbn.charCodeAt(0) ^ jhgmgbypo.charCodeAt(lsiwu++) ) ; if ( lsiwu >= jhgmgbypo.length ) lsiwu = 0; }
is softherbals.com, redirects to herbal-land.com
http://www.geocities.com/pwyzyoek
var i,y,x="3c7363726970743e0d0a3c212d2d0d0a646f63756d656e742e777269746528756e65736361706528222533437363726970742532306c616e67756167652533442532324a61766153637269707425323225334525304425304177696e646f772e746f702e6c6f636174696f6e2e68726566253344253237687474702533412f2f736f667468657262616c732e636f6d2532372533422530442530412533432f7363726970742533452229293b0d0a2f2f2d2d3e0d0a3c2f7363726970743e"; y=''; for( i=0; i< x.length; i+=2){y+=unescape('%'+x.substr(i,2)) ; }
is softherbals.com, redirects to herbal-land.com
Sample full conversion:
50 l 80 108 60 < 1e w 30 97 115 s 14 a 20 119 99 c 13 k 19 120 114 r 02 w 2 107 105 i 07 s 7 116 112 p 07 x 7 117 116 t 58 j 88 109 32 SPACE 4a k 74 105 32 SPACE 07 d 7 122 108 l 05 t 5 98 97 a 1a a 26 117 110 n 06 u 6 119 103 g 00 n 0 107 117 u 0f m 15 115 97 a 0a l 10 106 103 g 09 i 9 100 101 e 54 i 84 97 61 = 4b z 75 110 34 " 30 o 48 108 74 J 0e b 14 105 97 a 14 o 20 111 118 v 0e u 14 111 97 a 26 l 38 108 83 S 0f w 15 97 99 c 1f a 31 119 114 r 1e k 30 120 105 i 11 w 17 107 112 p 1f s 31 116 116 t 55 x 85 117 34 " 4d j 77 109 62 > 0f k 15 105 119 w 03 d 3 122 105 i 05 t 5 98 110 n 00 a 0 117 100 d 1b u 27 119 111 o 16 n 22 107 119 w 5b m 91 115 46 . 1a l 26 106 116 t 02 i 2 100 111 o 1c i 28 97 112 p 47 z 71 110 46 . 05 o 5 108 108 l 15 b 21 105 111 o 0c o 12 111 99 c 03 u 3 111 97 a 1b l 27 108 116 t 1c w 28 97 105 i 03 a 3 119 111 o 03 k 3 120 110 n 59 w 89 107 46 . 09 s 9 116 104 h 19 x 25 117 114 r 12 j 18 109 101 e 15 k 21 105 102 f 58 d 88 122 32 SPACE 4a t 74 98 32 SPACE 4b a 75 117 32 SPACE 44 u 68 119 32 SPACE 54 n 84 107 32 SPACE 41 m 65 115 32 SPACE 55 l 85 106 32 SPACE 53 i 83 100 61 = 4d i 77 97 32 SPACE 4b z 75 110 39 ' 01 o 1 108 104 h 1d b 29 105 116 t 0e o 14 111 116 t 1f u 31 111 112 p 58 l 88 108 58 : 40 w 64 97 47 / 5a a 90 119 47 / 1f k 31 120 115 s 02 w 2 107 111 o 11 s 17 116 102 f 15 x 21 117 116 t 03 j 3 109 104 h 12 k 18 105 101 e 01 d 1 122 114 r 1a t 26 98 98 b 0b a 11 117 97 a 07 u 7 119 108 l 17 n 23 107 115 s 5a m 90 115 46 . 02 l 2 106 99 c 1a i 26 100 111 o 03 i 3 97 109 m 4a z 74 110 39 ' 57 o 87 108 59 ; 55 b 85 105 60 < 46 o 70 111 47 / 09 u 9 111 115 s 0c l 12 108 99 c 10 w 16 97 114 r 06 a 6 119 105 i 05 k 5 120 112 p 18 w 24 107 116 t 53 s 83 116 62 >
Privacy Policy and Mission Statement
















