Recently in Spam Category

Here's an extract from an odd chat I had today with someone claiming to be a "hot chick from Bulgaria". There's a fair amount of text, so read on if you fancy hearing about how I spent the afternoon being bombarded with pornography and something that reeked of "infection file"....

It seems Skype Spam promoting rogue antispyware tools is still going strong. This was sent to a colleague of mine yesterday:

soft_alarm.gif

Never visit the sites promoted by these kind of tactics. A world of popups and pushy marketing tactics will be unleashed upon your desktop if you do.

I guess the people behind this missive were too full of Xmas leftovers or something, because instead of plastering links all over the place, they're letting the forum regulars do all the hard work instead:

super_lazy_spam.jpg

That's right, YOU'RE supposed to "provide details" of XRumer (King of Spamming programs), which is sort of ironic considering the forum spammer likely used XRumer to post these messages in the first place.

http://blog.spywareguide.com/upload/2007/12/xrumakthebest-thumb.jpg
Click to Enlarge

231,000 results for the guy posting the spam message? I guess we can see XRumer really does work, though that's not exactly comforting....

Here's an interesting spam gimmick - do a search for something in Google / Yahoo / whatever:

http://blog.spywareguide.com/upload/2007/12/flickr_stock_spam_search-thumb.jpg
Click to Enlarge

.....meanwhile, the bad guy has stuffed a bunch of keywords into a Flickr screenshot page, then inserted one of those wonderful stock trading spam messages into the screenshot area. When people arrive at his Flickr page, they see this:

http://blog.spywareguide.com/upload/2007/12/stock_spam_flickr70-thumb.jpg
Click to Enlarge

....awesome. In fact, this particular profile is stuffed to bursting point with keywords galore leading to yet more trading spam...

http://blog.spywareguide.com/upload/2007/12/stock_spam_flickr_two-thumb.jpg
Click to Enlarge

......and a pile of Viagra / cheap software garbage, too:

http://blog.spywareguide.com/upload/2007/12/final_flickr-thumb.jpg
Click to Enlarge

What site will the spammers ruin next?

A while ago, I wrote about Spammers using Skype to send unsuspecting users messages that their "copy of Windows needed updating", only to be taken to a page promoting a rogue antispyware tool.

Well, it looks like they've returned, ditching their old usernames (security.monitor.noXX) in favour of

(security.monitor.njXX)

http://blog.spywareguide.com/upload/2007/09/secmonreturns-thumb.jpg
Click to Enlarge

As you can see, there are currently 21 of these accounts in Skype User Search. Do yourself a favour and ignore any messages from these accounts.

There's an interesting bit of activity taking place on the Skype network lately. In fact, it seems to have been around for a couple of months in various guises, but things really seem to have taken off recently for this particular scam if the amount of complaints on forums and blogs is anything to go by.

Want to take a look?

Sure you do. If you happen to go searching on the Skype userlist, you might happen to come across something similar to this:

http://blog.spywareguide.com/upload/2007/09/secmon0-thumb.jpg
Click to Enlarge

That's an awful lot of people with the same username - if you happen to be using Skype and minding your own business, you might be surprised to find that the following text message is sent to you:

http://blog.spywareguide.com/upload/2007/09/secmon1-thumb.jpg
Click to Enlarge

As you can see, the message reads:

"WINDOWS REQUIRES IMMEDIATE ATTENTION
============================

ATTENTION ! Security Center has detected malware on your computer !

Affected Software:

Microsoft Windows NT Workstation
Microsoft Windows NT Server 4.0
Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Win98
Microsoft Windows Server 2003

Impact of Vulnerability: Remote Code Execution / Virus Infection /
Unexpected shutdowns

Your system IS affected, download the patch from the address below NOW!"

Anyone clicking the link in the screenshot will actually be taken to a "patch" that (mysteriously) neither looks like a patch or indeed comes for free.

http://blog.spywareguide.com/upload/2007/09/secmon2-thumb.jpg
Click to Enlarge

....oh dear, that doesn't look good...

http://blog.spywareguide.com/upload/2007/09/secmon3-thumb.jpg
Click to Enlarge

That's even worse - because I have three entirely non-existent threats on my PC. However, if I decide to "remove" them....

http://blog.spywareguide.com/upload/2007/09/secmon5-thumb.jpg
Click to Enlarge

....my "patch" suddenly costs $19.95. "Scan & Repair Utilities" is on the Spywarewarrior Rogue Antispyware List. Steer clear of these messages and never download anything sent to you by random contacts, whether on Skype or anything else.

You know, if you're a spammer then sure - you can be fancy and innovative and send your PDFs and your FDFs. But sometimes, it all gets too much. What do you do? Easy, take your foot off the gas and simply send me a URL which leads to....

http://blog.spywareguide.com/upload/2007/08/yfinance-thumb.jpg
Click to Enlarge

....a page on Yahoo Finance. Guys, please - you're just not trying hard enough this week...!

I think this EMail has some identity issues it needs to resolve. The top of the mail is designed to look like it's from EBay:

http://blog.spywareguide.com/upload/2007/08/ebaymailscam1-thumb.jpg
Click to Enlarge

....though the pills (instead of TVs and MP3 Players) sort of give it away.

However, scroll down and just under the plethora of pills, we have...

http://blog.spywareguide.com/upload/2007/08/ebaymailscam2-thumb.jpg
Click to Enlarge

.....a collection of entirely genuine links to EBay, which will teach you all about "protecting yourself from spoof (fake) EMails".

There's humour in there somewhere.

About this Archive

This page is a archive of recent entries in the Spam category.

Social Networking is the previous category.

Spyware Research is the next category.

Find recent content on the main index or look in the archives to find all content.