ZYRA FRONT PAGE //// INTERNET //// e-mails //// scams //// site indexSite Index

Also see Rogues Gallery page1

Rogues Gallery

of suspicious e-mails

This is PAGE2 of the Rogues Gallery.

Don't open an e-mail attachment that has a hidden extension! See anti-virus measures. Here are a few suspicious e-mails which are typical of the sort of thing to look out for: (This is a continuation of ROGUES GALLERY PAGE 1)

Friendship Screen saver:

"Don't accept sweets from strangers" is what you tell children. So, now you receive an EXECUTABLE in an e-mail, do you follow your own good advice? The fact that it's got words like FRIENDSHIP in it doesn't actually mean it's friendly! If you opened the attachment it could do ANYTHING to your computer. The text varies a bit, and sometimes pretends to be from yourself. Don't run it! The file is a .scr which is executable. If you run things like this, you will sooner or later be wiped-out! I have never run this file, but I can surmise that it is a VIRUS! (the "remove" instructions are of course bogus)

----- Original Message -----
To: <
your address here>
Sent: Wednesday, March 12, 2003 1:55 PM
Subject: Fw: Friendship Screen saver

Check the Attachement ..

[your name]

----- Original Message -----
From: "f**ker" <address here >
To: < your address>
Sent: Wed,12 Mar 2003 13:55:56 PM
Subject: Friendship Screen saver

This e-mail is never sent unsolicited. If you need to unsubscribe,
follow the instructions at the bottom of the message.

Enjoy this friendship Screen Saver and Check ur friends circle...

Send this screensaver from www.passion.net to everyone you
consider a FRIEND, even if it means sending it back to the person
who sent it to you. If it comes back to you, then you'll know you
have a circle of friends.

* To remove yourself from this mailing list, point your browser to:
* Enter your email address ([whatever]) in the field provided and click "Unsubscribe".


* Reply to this message with the word "REMOVE" in the subject line.

This message was sent to address [your address]
X-PMG-Recipient: [your address]
<<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>>

I expect you would like it?:

This type of virus messages are very common. They claim to be "a special funny game" or "a Excite game" or "a XP Patch" or "A IE6 patch" and a few other English-isn't-my-first-language turns of phrase. Some of the messages have an ActiveX control in the e-mail (very bad, but a dead giveaway!), and some don't. Remember, the message is trying to get you to open the attachment, which will then infect your computer with a virus. It's not funny; it's not a game; you're not the first person to get it; And most importantly, there is a strong suspicion that you WILL NOT LIKE IT!

<attachment: play.exe>

----- Original Message -----
your harvested address here
Sent: Tuesday, March 11, 2003 5:57 PM
Subject: A special funny game

Hi,This is a funny game
This game is my first work.
You're the first player.
I expect you would like it.


Some titles immediately show the message to be a virus. (Or someone being unknowing or foolish in choosing a title which happens to be an alarm-bell type subject). For example...

spice girls' vocal concert

A IE 6.0 patch

Hello, [your name here], the Garden of Eden

Welcome to my Hometown

Noresize Frameborder

A very humour game

Re: [your name], look, my beautiful girlfriend

Shaking relations to share

Japanese girl VS playboy


Fw: Great friendship to ur lovers :-)

A very excite game

...and loads of others. But you can't rely on the titles. It's just a matter of saving time by knowing the obvious ones.


This virus is a bit unusual in that it is being sent by SPAM. Someone is using an e-mail list containing a huge number of harvested e-mail addresses and is sending the virus to as many people as possible. This has been going on for weeks now, so evidently it's not easy to track down whoever is doing this. Normally when you receive a virus, the sender is unwittingly sending it because their computer has caught a virus. In the case of the big@boss.com virus, it appears to be a campaign of virus-sending.

<attachment: untitled1.pif >

----- Original Message -----
From: <
To: <
harvested address>
Sent: Monday, February 10, 2003 12:28 AM
Subject: Re: Here is that sample

Attached file:

Another "funny" screensaver:

Well, no-one's laughing here, except perhaps at the futile attacks, which strangely seem to be concentrated against the INTERESTING HAIR COLOUR page. Dozens of messages were sent to the same address. Evidently the viruses were sent by someone who has some very stuffy oldfashioned beliefs about personal appearance and expects us all to conform to some kind of "normality".

<attachment: life.scr>

----- Original Message -----
hairdye page at zyra.org.uk
Sent: Wednesday, February 12, 2003 8:16 AM
Subject: hey check it yaar

I just came across this funny screensaver..
sending it to u.. hope u like it..
check out and die laughing.. :)

Official Campaign:

These "official campaign" products are of various types, sometimes quite convincing and sometimes rather contrived. However, all require you to run an executable attachment, and many of the e-mails contain ActiveX. Because of the similarity of the messages, and the fact that no-one ever signs a message "Admin", it is certain that this is all entirely bogus and most likely a virus.

<attachment: Various / and by ActiveX >

----- Original Message -----
advertising-contractors/ zyra.org.uk
Sent: Saturday, March 15, 2003 11:23 AM
Subject: Free Screensavers

The attached product is send as a part of our official campaign
for the popularity of our product.
You have been chosen to try a free fully functional sample of our
product.If you are satified then you can send it to your friends.
All you have to do is to install the software and register an account
with us using the links provided in the software. Then send this software
to your friends using your account ID and for each person who registers
with us through your account, we will pay you $1.5.Once your account reaches
the limit of $50, your payment will be send to your registration address by
check or draft.

Please note that the registration process is completely free which means
by participating in this program you will only gain without loosing anything.

Best Regards,


You've won the Lottery! But you're not alone. Everyone gets these messages. I bet they haven't ALL won! I have even heard it said these are a similar thing to the Nigeria 419 Scam where it's just a ploy to get your personal details!

Datum: Sam, 16. Aug 2003 09:03:39 Europe/Zurich
An: <address>
Antwort an: <e-mail>

Ref. Nnumbe: 000/000/0000
Batch Number: 000000000-nn00
We are pleased to inform you of the result of the Lottery Winners International programs held on the 10th of August, 2003. Your e-mail address attached to ticket number nnnnnnnnnn-nnnn with serial number xxxxx-xxx drew lucky numbers 7-14-18-23-31-45 which consequently won in the 2ND category, you have therefore been approved for a lump sum pay out of US$ 1,000,000 (One Million United States Dollars) CONGRATULATIONS!!!

Due to mix up of some numbers and names, we ask that you keep your winning information confidential until your claims has been processed and your money Remitted to you. This is part of our security protocol to avoid double claiming and unwarranted abuse of this program by some participants.

All participants were selected through a computer ballot system drawn from over 20,000 company and 30,000,000 individual email addresses and names from all over the world.

This promotional program takes place every three year. This lottery was promoted and sponsored by eminent personalities like Bill Gates and the Sultan of Brunei, we hope with part of your winning you will take part in our next year USD50 million international lottery.

To file for your claim, please contact our fiducial agent Mr.CHISTOPER Weeks AND ASSOCIATES NETHERLAND. TELEPHONE :+0031-nnnnnnnnn HOLLAND.

Reply Email: <e-mail address>
Remember, all winning must be claimed not later than 30th of August 2003. After this date all unclaimed funds will be included in the next stake.

Please note in order to avoid unnecessary delays and complications, remember to quote your reference number and batch numbers in all correspondence.

Furthermore, should there be any change of address do inform our agent as soon as possible. Congratulations once more from our members of staff and thank you for being part of our promotional program. Note: Anybody under the age of 18 is automatically disqualified.

Sincerely yours,
MR Chistoper Weeks.
Lottery Coordinator

Also see Congratulations You Have Won The UK National Lottery SCAM. In the e-mails, there are loads of things to beware of. See some more of these at the Rogues Gallery page1

Also see Microsoft letter hoax , Coca-Cola Award Scam , free Klez E immunity tool , Yahoo Games Screensaver message , Lottery Scam , Mail Returned virus messages , Chain Letters , Pyramid Schemes , Qualifications on Qualifications , Crime-fighting links and anti-virus measures and now also the Bank Security server update hoax + PayPal account expires virus