Strangely Perfect Crawling Across Chaos and Time Without End

For the past few weeks I suppose everyone has had a bit of email spam with this in the “From” and “Subject”:

msnbc.com: BREAKING NEWS:

There then follows a sucker headline which is obviously pants.  They all have a spoofed link for http://breakingnews.msnbc.com which points to somewhere else, quite often a html document on the main site page for a photographer or graphics company.  There is only the one duff link.  All the rest point to Microsoft sites.

A few sites I’ve contacted to let them know that they’ve been hacked – but now I don’t bother – there are too many each day with this particular format.

Agent ETH Trogan as reported by NOD32

Here are a few I’ve had today.  The links are not live.  Firefox 3 or NOD32 trap all the Trojans but copy and paste the links into a browser at your own risk!  (Initially there is a modal dialog box that cannot be cancelled except by Task Manager.  Clicking OKAY will try to download the package to your PC.  NOD32 identifies it as “a variant of Win32/Agent.ETH trojan“).

I use Mailwasher Pro from Firetrust to check through all my mail.  I’ve been using it for several years now – since version 4 I think!  It shows all mail as plain text (which I advise everyone to do anyway).  This is the substance of the last email above, viewed in plain text.

Mailwasher shows all the obfuscated links nicely.

msnbc.com: BREAKING NEWS: Bush Claims He Has Supernatural Abilities

Find out more at http://breakingnews.msnbc.com [links to eliteworkwearuk.co.uk/msn_video.html]
======================================================
See the top news of the day at MSNBC.com, and the latest from Today Show and NBC Nightly News.

=========================================
This e-mail is never sent unsolicited. You have received this MSNBC Breaking News Newsletter
newsletter because you subscribed to it or, someone forwarded it to you.
To remove yourself from the list (or to add yourself to the list if this
message was forwarded to you) simply go to
http://www.msnbc.msn.com/id/62954182 [links to www.msnbc.msn.com/id/24472415], select unsubscribe, enter the
email address receiving this message, and click the Go button.

Microsoft Corporation – One Microsoft Way – Redmond, WA 98052
MSN PRIVACY STATEMENT
http://privacy.msn.com (http://privacy.msn.com/> [links to privacy.msn.com/])

Added 17/8/8

I’ve also had quite a few emails purporting to be Greetings eCards!

The pattern is the same as the above except usually they don’t even obfuscate the link!  This one below, for example, has these properties:

Good day.
You have received an eCard

To pick up your eCard, choose from any of the following options:
Click on the following link (or copy & paste it into your web browser):

http://kkvtombeek.be/e-card.exe

Your card will be aviailable for pick-up beginning for the next 30 days.
Please be sure to view your eCard before the days are up!

We hope you enjoy you eCard.

Thank You!

http://www.greetingcard.org

NOD32 warning for Win32/TrojanDropper.Agent.NMR trojan

The payload according to NOD32 is described as “a variant of Win32/TrojanDropper.Agent.NMR trojan“.  The Belgian website looks okay with info, program of events etc.  But the exe file is dumped straight in their front door!

• Jagger, Google Analytics, And The Future Of Search & SEO Two big things have just happened in Google-land: Jagger and Google Analytics. Together, these two...
• Make Blogging Work for Your Business pt 2 Are you ready to make blogging work for your business? If you already know the...
• Link Relevance We are constantly being told by SEO experts and the Search Engines that the importance...
• Harnessing The Power Of Social Book Marking To Boost PageRank And Gather A Massive Number Of Back Links To Your Website As SEO professionals we are constantly searching for ways to get our sites ranked and...
• The Forgotten Fundamentals Of SEO Introduction: Firstly, thank you for taking the time to view my SEO hints and tips...
• The Forgotten Fundamentals Of SEO Introduction: Firstly, thank you for taking the time to view my SEO hints and tips...
• Motorola Droid X Overview Verizon Droid X Overview by Motorola Droid X Review by BoyGeniusReport www.boygeniusreport.com Motorola Droid X...

Related Posts by Tags

• Robert G Allen, Grants, and a Credit Card Slimeball (37)
• MyBookface, Google, Utah and Nevis Scamboys United (9)
• Google Treasure Chest – it’s a scam and a half! (274)