Spam or Scam?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Fri Jun 17, 2011 12:17 pm

Can this be baited? Never seen this crap before.

Return-Path: <[email protected]>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mc3.midcoast.com
X-Spam-Flag: YES
X-Spam-Level: *********************
X-Spam-Status: Yes, score=21.3 required=5.0 tests=FSL_HELO_NON_FQDN_1,
HELO_LOCALHOST,HTML_IMAGE_ONLY_12,HTML_MESSAGE,KB_DATE_CONTAINS_TAB,
KB_FAKED_THE_BAT,MIME_HTML_ONLY,RCVD_IN_BRBL_LASTEXT,RCVD_IN_PBL,
RCVD_IN_RP_RNBL,RDNS_NONE,T_REMOTE_IMAGE shortcircuit=no autolearn=disabled
version=3.3.1
X-Spam-Report:
* 3.6 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
* [113.170.114.111 listed in zen.spamhaus.org]
* 1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
* https://senderscore.org/blacklistlookup/
* [113.170.114.111 listed in bl.score.senderscore.com]
* 1.6 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
* [113.170.114.111 listed in bb.barracudacentral.org]
* 0.0 FSL_HELO_NON_FQDN_1 FSL_HELO_NON_FQDN_1
* 3.6 HELO_LOCALHOST HELO_LOCALHOST
* 3.8 KB_DATE_CONTAINS_TAB KB_DATE_CONTAINS_TAB
* 1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 3.4 KB_FAKED_THE_BAT KB_FAKED_THE_BAT
* 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
* 0.0 T_REMOTE_IMAGE Message contains an external image
X-Original-To:
Received: from localhost (localhost [127.0.0.1])
by mc3.midcoast.com (Postfix) with ESMTP id 213C2F44FB
for <; Fri, 17 Jun 2011 06:46:01 -0400 (EDT)
X-Virus-Scanned: by amavisd-new at midcoast.com
Received: from mc3.midcoast.com ([127.0.0.1])
by localhost (mc3.midcoast.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id ms0+-4CPnjGQ for <>;
Fri, 17 Jun 2011 06:46:00 -0400 (EDT)
Received: from mx1.midcoast.com (mx1.midcoast.com [69.39.100.26])
by mc3.midcoast.com (Postfix) with ESMTP id 7ADF8F469C
for <>; Fri, 17 Jun 2011 06:45:43 -0400 (EDT)
Received: from localhost (unknown [113.170.114.111])
by mx1.midcoast.com (Postfix) with ESMTP id C5881E1188
for <>; Fri, 17 Jun 2011 06:45:42 -0400 (EDT)
Received: from [10.235.252.87] (helo=apqhziaxrd.ktgxhwenagqeot.ua)
by localhost with esmtpa (Exim 4.69)
(envelope-from )
id 1MMHT5-9421ec-2A
for ; Thu, 16 Jun 2011 22:45:41 -1200
Date: Thu, 16 Jun 2011 22:45:41 -1200
From: <[email protected]>
X-Mailer: The Bat! (v3.51.10) Home
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
To: <>
Subject: PJM-> Federal Tax transaction canceled
MIME-Version: 1.0
Content-Type: text/html;
charset=Windows-1252
Content-Transfer-Encoding: 7bit
X-Spam-Prev-Subject: Federal Tax transaction canceled

Quote:

Your Tax payment (ID: 8178581443885), recently from your checking account was
canceled by the your financial institution.

Canceled Tax transfer

Tax Transaction ID:
8178581443885

Return Reason
See details in the report below

FederalTax Transaction Report
tax_report_8178581443885.pdf.exe (self-extracting archive, Adobe PDF)

Internal Revenue Service,
Metro Plex 1,
8401 Corporate Drive, Suite 300,
Landover, MD 20785

Posted: Fri Jun 17, 2011 12:35 pm

It's phishing e-mail or a virus. Don't click on any links Wink

Posted: Fri Jun 17, 2011 12:58 pm

When in doubt, skip it and move on to the next mail in your box. Wink

Posted: Fri Jun 17, 2011 1:25 pm

It's a worm. Note the double extension in the file. It makes you think it's a PDF, but you click on it and it's a program and it runs. The double extension .tar.gz is common and legitimate; the double extension .pdf.exe is not.

Posted: Fri Jun 17, 2011 1:46 pm

That's the odd thing, there was no links. Not that I would click on them anyway.

Posted: Fri Jun 17, 2011 1:50 pm

Worm, Trojan, Virus, Malware ... any malicious program can be packed up in executable file.Then when run as administrative user can overwrite system/application files and change system/registry setting to even launch themseves as a service that starts on bootup.

Try typing msconfig.exe in the Run field.. and see what's starting up at boot time if you have been tempted to run this.

Posted: Fri Jun 17, 2011 9:05 pm

Better yet, run Linux or BSD. The security is tighter, and with lots of Linux distros, four BSDs, and Darwin, each with many releases, it's harder for a worm to spread widely on Unix.

Posted: Fri Jun 17, 2011 10:26 pm

wowwow wrote:

Worm, Trojan, Virus, Malware ... any malicious program can be packed up in executable file.Then when run as administrative user can overwrite system/application files and change system/registry setting to even launch themseves as a service that starts on bootup.

Try typing msconfig.exe in the Run field.. and see what's starting up at boot time if you have been tempted to run this.

I'm clean, no computer STDs here.