RonOliverClarin.com - Philippines Designer, Web Developer . Web Hosting and Real State Consultant

Here's the repost article of my facebook friend Ms. Ruth:

PLEASE REPOST THIS FOR EVERYONE'S SAFETY.

It was about 3 weeks ago, I was at the Shell station getting diesel. It was about 11:30pm .. I was approached by 2 men and 2 women in a car. The man that was driving asked me 'What kind of perfume do you wear?' I was a bit confused and I asked him 'Why?' He said 'We are selling some name brand perfumes, at cheap prices.' I said I had no money. He then reached out of the car and handed me paper that was laminated; it had many perfumes on it. I looked quickly at it and gave it back. I said, I have no money. He said it is OK, we take cheques, cash or credit cards. Then the people in the car began to laugh. I just got in my car and said no thanks. Then I received this e-mail yesterday and it sent chills up my spine. Please read this. It is not joke. Here is the e-mail I was sent: 

Warning to all: PLEASE READ FOR YOUR SAFETY AND SECURITY. 

Subject: MAG iNGAT SA GANiTONG RAKET! 

Msg from Atty. Jojo Perez

Dear Friends: I know not all of you are women that I am sending this to, but I am hoping you will share this with your wives, daughters, mother, sisters, etc.. Our world seems to be getting crazier by the day. Pipe bombs in mailboxes and sickos in parking lots with perfume. Be careful. I was approached yesterday afternoon around 3:30 pm in a car park by two males who asked what kind of perfume I was wearing. Then they asked if I'd like to sample some fabulous scent they were willing to sell me at a very reasonable rate. I probably would have agreed had I not received an e-mail some weeks ago warning of a 'Wanna smell this neat perfume?'scam. Someone walks up to you at the malls or in parking lots and asking you to SNIFF PERFUME that they are selling at a cheap price. THIS IS NOT PERFUME...IT IS ETHER! When you sniff it, you'll pass out. They'll take your wallet, your valuables and heaven knows what else. The men continued to stand between parked cars, I guess to wait for someone else to hit on. I stopped a lady going towards them, pointing at them and told her about how I was sent an e-mail at work. If it were not for this e-mail, I probably would have sniffed the 'perfume' but thanks to the generosity of an e-mailing friend, I was spared whatever might have happened to me. I wanted to do the same for you.. 

PLEASE PASS THIS ALONG TO ALL YOUR WOMEN FRIENDS AND PLEASE BE ALERT AND BE AWARE. IF YOU ARE A MAN AND RECEIVE THIS, PASS IT ON TO YOUR WIFE/WOMEN FRIEND....Hard times!

Last August 3 2011, I received an email from  This email address is being protected from spambots. You need JavaScript enabled to view it. as subject title "Nacha Security Nitification" and contain:

Dear Valued Client,

We strongly believe that your account may have been compromised. Due to this, we cancelled the last ACH transactions:

-(ID: 13552290)
-(ID: 45456774)
-(ID: 74039633)
-(ID: 89958340)

initiated from your bank account by you or any other person, who might have access to your account.

Detailed report on initiated transactions and reasons for cancellation can be found in the attachment. 

The "report" is in single extension file, with a name like: "report-8764.zip (8.03 KB) ZIP archive, Adobe PDF)" -although future variants may arrive with just a .zip or just a .pdf extension.

The From line is usually: "account manager" ( This email address is being protected from spambots. You need JavaScript enabled to view it. , or This email address is being protected from spambots. You need JavaScript enabled to view it. ). You will be getting these sent to every one of your email accounts, should you have multiple accounts, like I do. Domains with email are especially hard hit in today's spam campaigns.

The actual "sender" is a PC in a spam botnet, operating under commands from the Bot Master running this show. All reply-to and From information is forged.

The payload in the current crop of malware in attachments is the "Zeus" aka: "ZBot" keylogger Trojan. The installer may also make the victim's computer a member of the same botnet from which their scam message was sent. This perpetuates and increases the size of the botnet and steals money from victims as they log into banks and payment portals targeted by this Zeus varian

My advice to recipients of one of these, or future variations of these scams, is to phone you bank, or financial institution and ask them to check your account for problem transactions. Note, there have been some spam campaigns that include a fake contact phone number that actually leads to people hired by the criminals running particular campaigns. So, your safest bet is to look-up the number for your bank, or flip over your debit or credit card and call the number listed on it.