Obviously I was not happy at this threat and especially as my laptop is quite new and was not cheap. It was chance really that led me to the quick conclusion that the problem was with this blog and not my lap top. That was because of IE freezing and then switching to Firefox. If I had been browsing with Firefox to start with I would probably have assumed it was from an email or download.

I did a search and very quickly came up with this article How To Remove JS/Wonka Trojan From WordPress and thank the author for the info and http://www.marcosorfila.com/site/?p=325 where the info came from initially.

What they basically say is that it is some disgusting little hacker leaving code in your blog template. In all 3 cases the header. To find and remove just go to Appearance then Theme Editor then Header.php You will find a code straight after the </head> tag which starts like this:

script>document.write(unescape(’%3C%73%63….A_LOT_MORE_CODE_HERE….%261B%264D0tdsjqu%264F1?)

Remove the code but be careful not to remove the </head> tag. If you are unsure about removing code it’s a good idea to open up your note pad and copy and paste all of the header.php code and then if you make a mistake with your deletion you can correct it. When I opened my header.php the McAfee  scanner was going mental detecting and deleting the nasty little trojan again and again but it calmed down once I deleted the malicious code.

Never one for settling for half a tale I decided to find out how the hacker had got in and planted JS/Wonka. I discovered a second administrator called JoshStengel70 and in the user profile a script which starts:

…         <div id=”user_superuser”><script language=”JavaScript”> var setUserName = function(){

and ends:

((d+))</gi,”>Administrator (“+(n[1]-1)+”)<”);         arr[i].innerHTML=txt;         }     }           }catch(e){};      };      addLoadEvent(setUserName); </script></div>

Obviously I deleted this fake administrator and changed my passwords. I also added a security plug in and will be checking around to make sure that I’ve got what I need over the next few days. I will also be checking the user list every time I go onto any of my blogs just to make sure that the only admin is me.

What seemed worse to me was that in biz ops many of those scammed were desperately trying to start an home business with a pitiful amount that was all they had to spare. They didn’t just lose their money they lost the hope and dreams that they had of using their money to build a better future. That is why I have always given out scam warnings.

I published a magazine and I had to decide on an advertising policy and stick to it. My policy was not to accept ads for anything illegal or unethical. It wasn’t always easy, I had many an argument with plonkers who insisted that my policy was wrong. But, why should those who wanted to rip my readers off use my magazine? Why should I risk being closed down by the Trading Standards Authorities for the sake of a few bob – not worth it! Therefore I kept my magazine clean and always warned my readers whenever a new scam appeared.

I am not an expert on the law, but I have a darned good idea of what is not legal or ethical, or what will never do anything but lose money for you! During my magazine publishing days the question that I was most asked was ‘How do you identify a scam?’

It isn’t always easy to tell what is real and what is not, but I follow these guidelines:

·        If it sounds too good to be true then it probably isn’t.

·        If you are unsure ask for a list of at least 10 satisfied customers that you can contact.

·        Don’t believe anybody telling you that it is easy to make money. It is rarely easy to make money unless you work at the mint.

·        If you are denied irrevocable proof of earnings run!

·        Don’t believe anybody telling you that you can make money quickly – the only people who make money quickly have spent time and money building their businesses up to enable eventual faster gains.

·        If a plan isn’t legal one of the reasons would be that it doesn’t work and many others have lost money through it.

·        Anybody asking you for money for paid work is a scamster. If the work is genuine then there should be no fee.

·        If you get a letter or email telling you that you have won a large amount in a lottery or competition that you haven’t entered it is without doubt a scam. They are after a fee to transfer winnings that don’t exist.

·        If you get an email telling you that you are needed to help transfer large amounts of money out of an African or almost any other country bin it. This type of scam originated in Nigeria and they are called the Advanced Fee 419 fraud scheme. They are after your bank details, or a payment to help them get non existent cash out of whatever country they say they are from. Millions have been lost to this type of scam and murders have been committed. Do not reply, do not let them have your money.

If you suspect that something is a scam the simplest thing to do is google the names or key words. Many of the scams have been running for years in some form or other and are well documented on the Internet. I hope that this article will help to stop you from being scammed.

Written by Patricia Jones who has long been an opponent of scamsters.

Patricia owns several websites including:

Eprofits Centre which offers free digital downloads a business article directory and much more.

Articles Abroad is a niche travel article directory

Dear Correspondent.

I am compelled to write you this email for the following reason:-

One of my client, who is now deceased, in his Will, left his entire Estate and Cash deposit, valued millions of US dollars,The truth is that l do not know if you are the beneficiary or not.,For over two years, l have tried effortlessly to locate the person on the will without success, which mandated me to contact you.

Can you get back to me urgently if you are capable of investing these funds in any profitable ventures in your domain? You can reach me via this email address: kennethmooreesq@strompost.com further explanation.

Regards,

Attorney Kenneth Moore

Tel:+447035901857

Dear Kenneth,

I’m sorry for not getting back to you sooner. You see when I first read your message on September 2nd I was so excited that I fell off my chair and landed on the cat who shocked scratched the dog on her nose. The dog chased the cat out of the house and a driver swerved to avoid them both and crashed into my wall.

The driver got angry with me and is suing me for car repairs and his whiplash injuries. I broke my arm when I fell off the chair and am off work. With my loss of wages I can’t afford to pay the driver and the vet is chasing me for an unpaid bill from when I took the dog in because the scratch became infected.

When I fell off the chair I knocked my computer off the desk and it wasn’t working until my brother came round and fixed it today. My brother who is also called Kenneth (maybe you are related) advised me to sue you for giving me a shock, not just once but 3 emails!

I told him that no I didn’t want to do that. After all you are the bringer of good news, even if it caused all of those accidents. I have been trying to think who could have left me all of that money. It can’t be Aunt Flossie because you said ‘his will’, anyway Aunt Flossie was so broke she dried her teabags on her washing line and reused them.

It could be Uncle Gerry, he was stinking rich but I’d be surprised if he left me even his toenail cuttings after I nearly poisoned him with my homemade chicken pie. I didn’t know that you had to thaw frozen chicken before cooking it.

I’m getting so excited here I’m rambling on. I look forward to you getting back to me with more details. I certainly have a profitable venture to invest the money in. I have a brand new invention of a toilet seat called ‘Embarrass Not’ that sings when you sit on it to cloak your natural functions. I will send you a free sample if you let me have your postal address and you need never be embarrassed again.

I look forward to hearing from you.

Sincerely
Patricia

Hopefully I won’t get a reply, but if I do I’ll add it here.

Anything like this that comes by email or letter is sure to be a scam. If you want to believe it do a google search and you’ll soon find out the truth.

When I did a search I found that I wasn’t the only one to receive the scam email and he has been sending the same one out for quite some time. He would only be doing that if he were making money from it, so please don’t let scamsters like him take you in.

I would always advise not to reply to the scam emails, because you might get more trouble than just losing money. Several years ago I got fed up with the amount of Nigerian fraud emails that I was getting and sent an email back basically saying get lost scammer but less politely. What I didn’t realise was that it was my business email address with my telephone number in the signature.

Late that evening I received a menacing phone call from the scammer and the same happened the following evening. After that I stopped answering my phone for a while in the evenings.

P.S.
I used to walk past a house where an old lady hung teabags out on her washing line and I remember reading about a singing toilet seat invention years ago, so my reply wasn’t that far fetched!

Written by Patricia Jones who has long been an opponent of scamsters.

Article Source: http://bb-space.co.uk

Good Day To You

Before i commence i would like to introduce my humble self to you am Dhr David Van Mark by name, agent of an International Remittance/Foreign Operations in Netherlands, the one in charge of your fund.

We are to notify you that your over due inheritance fund has been gazetted to be released, which is the sum of ( $5 million Us Dollars) to your nominated bank, we are sorry for the late communication.

Meanwhile a lady came to our office few days ago with a letter, claiming to be your true representative, here are her information below of which she asked us to make the transfer of your behalf immediately:

Name: name removed for privacy reasons
Address Line 1: Address removed for privacy reasons
Bank Name: Bank of America
Account Number: …………..
Routing Number: …………..
Driver’s Licence No: ……………
DOB: 06-03-45
Please. Do confirm to this office, as a matter of urgency if this lady is from you so that the management of this office will not be held responsible for paying your funds into a wrong bank account, with the office director, to handle and transfer all foreign inheritance funds this second quarter payment of the year.

However, we shall proceed to issue all payments details to name removed for privacy
reasons, if we do not hear from you within the next seven working days from today on. Get back to us as soon as you get these message.

Note you are required to get back to me through my private e-mail address davidvanmark@aol.nl

Send my warm regards to your friends and family and i pray that God will give you the wisdom to make use of the funds wisely and judiciously.

Best Regard,
Dhr D. Van. Mark

…………………………………………………………….

A $5,000,000 inheritance would set me up for life but I’m sure that it won’t be through this scammer. Apart from it being an obvious scam I was disgusted to find in a search that the lady named as my true representative exists and that the contact details were correct. Imagine how horrified this or any other 63 year old lady would be to discover that her details were being used in an effort to obtain money from others by fraudulent means. Her details will be in the scam email to push victims into replying quickly and I’m even wondering if she was a previous victim and that is how this jerk got hold of so much information.

Telling you that you have to reply to a different email address is an indication of it being a scam. The reason being that a scammer will use a free email account to spam potential victims, but once it has been reported the providers will close the account down. The second email address is to make sure that the victims can get through. I decided to reply to Dhr D. Van. Mark, to see what this scumbag had to say.

Dear Dhr D. Van. Mark,

Thank you for your email. I went away on the 8th for a few days to celebrate my birthday which was on the 8th. Perhaps I can consider your email as a birthday present if I’m not too late.

Are you sure that I am the right person that you are looking for? I really can’t think of anybody who might have left me all of that money though I did have a Dutch aunt who ran away with a Greek rock musician when she was 16 and my family have never heard from or of her since.

I know of no lady called name removed for privacy reasons nor do I know anybody who comes from the part of the world that she comes from. She is obviously not a representative of mine and if she comes to your office again please send her away with a flea in her ear.

I look forward to hearing from you again.

Sincerely
I. Kidder

…………………………………………………………….

Dhr D. Van. Mark replied within 3 hours and this is what he had to say:

OFFICE OF THE DIRECTOR FOREIGN FUNDS
REMITTANCE & CASH TRANSFER DEPARTMENT.
ADDRESS: JONCKBLOETPLEIN 30-31,
REGENT’S PLACE, 2523 AS ‘S-GRAVENHAGE
NETHERLANDS
CONTACT NUMBER: +31 681758514

Attn: I. Kidder
Compliment of the day, your e-mail was recieved and well acknowledged,we have stopped any further transactions with
name removed for privacy reasons who claimed that she was sent by you to claim your inheritance/compersation funds totalling the sum of [$5million Usd] which was approved by the ministry of finance and that of ministry of Justice inconjuction with the International Remittance/Foreign Fund Operations Department here in Netherlands.

This office is entitled with all the payments/release and transfers of all funds,so right now you are required to re-confirm to this office the informations below so that we can be able to procure all the necessary documents/legal backings required for the transfer of the funds and also all the requirements involved in the fund transfer as demanded by the Duetch laws and ethics.

we don’t send funds to beneficiaries through western union money transfer to avoid misconduct and impersonation of which we have been encountering here since we resume with is project.
The informations required from you are as follows:

1. Full Name:
2. Address/Country:
3 Contact Number:
4. Age:
5. Occupation:
6. Marital Status:
7. Bank Name:
8. Bank Account Number:
9. Routing Number:
10. A scanned copy of your identity either Drivers licence or working identity card.

As soon as all this informations are recieved and verified by our payment director,it will be filled into our database and we will immediately commence with the transfer of the funds into your designated bank account there in your country.

Your swift response to this regards urgently needed.

Regards
Dhr D.Van.Mark
Director Of Operations

…………………………………………………………….

He has got to be joking I thought and wondered how long it would take him to clean me out and perhaps use my identity to further his dodgy dealings. I find it difficult to believe that anybody would send their personal details to a stranger, but thousands of emails will have been sent out and even if only one is suckered in by hope or greed it is worth it to a scammer.

I decided to play him along and replied to his email.

Dhr D.Van.Mark

Thank you for stopping transactions with name removed for privacy reasons. I really cannot do as you ask because my scanner is broken, but by coincidence I will be visiting Amsterdam next week. You are right to be concerned about security with western union money transfers, but that won’t be a problem because we can complete the payment whilst I’m in Holland.

Looking forward to meeting you.

I. Kidder

I haven’t heard back and I doubt that I will, nor do I ever want to. A search for variations of his name gave no results, but when I searched for the email I found that slight differences of the same email has been used with different details over and over again. This could be a new scamster trying it on or a seasoned one with a change of name. Whatever, this is a prime example of what is called a 401 Nigerian Fraud and scams like this were kicking around long before computers or the Internet were invented. The scumbags wouldn’t find it worthwhile if they couldn’t find victims so
watch out they’re out to get you!

Patricia Jones owns Articles Abroad travel article directory and the UK Travel Guide where you can download free city travel guides with maps.

There were 3 new icons on my desktop ‘privacy protector’, ‘Error Cleaner’ and ‘spyware & malware protection’. I had definitely not downloaded them so I reasoned that they could only be part of the problem that I was having. They started scanning by themselves, one told me that I had 161 spyware problems and another 243. Worm.win32.netsky was at the top of both lists and lower down were references to credit card hacking. My desktop turned dark red and a warning bar appeared telling me to click on it to protect my computer.

At first I was worried then logic took over. My virus and spyware software, which comes with my broadband service, updated the day before and when I ran a check it came up with nothing. I had vaguely heard of worm.win32.netsky and did not think that it was so new that a virus scan would not pick up on it. I figured that the whole attack was to panic me into buying one of the products. I am stubborn and if I buy spyware protection it would not be through those methods.

I did a google search for worm.win32.netsky and found a long list of sites. Most of the sites described it as part of the netsky family of email worms that comes to your computer as an email attachment. When you click on the attachment the worm activates then installs itself on your computer and propagates. It harvests email addresses stored on your computer and spreads further by sending itself to them. One or more spyware removal downloads were recommended, but I still did not believe that the computer was infected by anything more than bullying sales methods.

I finally found a forum where a member had described exactly the same thing happening to him. Apparently Worm.Win32.Netsky is a scam, fake malicious software called Smitfraud, an anti-spyware program trojan, engineered by Internet hackers. A fraudulent way to get you to buy spyware removal software. He was pointed in the direction of SmitFraudFix v2.274 and the fix worked for him. I downloaded it and used it and thought that it had worked.

The next day the warnings and desktop icons reappeared. I quickly ran Smitfraudfix again and then I restored my computer to 14 days before the problem appeared. So far so good, the fix and restore seem to have worked. SmitFraudFix v2.274 which apparently only works with Windows XP or 2000 was a free download so the whole thing cost me nothing but time and anxiety. Just to make sure I got a free download of Spyware Doctor from Google and ran it to make sure that my computer was clear and deleted cookies with it.

One of the sites that my IE insisted on going to was selling XP Antivirus. If you do a search for XP Antivirus you will find claims that it is a corrupt anti spyware application that will try to trick you into buying it by falsifying error reports. Do not even think about buying it. XP Antivirus will not remove spyware it will not do anything useful, just scam you out of money.

Where did the problem come from? I am not sure. I had not opened any email attachments for months and would only open attachments if I were expecting them. I downloaded some ebooks and software the day before but had not opened them at that point. I always check downloaded files with a virus scan before I unzip them anyway.

Another possibility is that I visited a dodgy site and the rogue anti spyware program leached onto my computer. In fact when I thought about my surfing the night before it is the most probable explanation. No I do not make a habit of visiting dodgy sites! I was checking my article directory stats and towards the top of a long list of incoming links was a domain that I did not recognise. Out of curiosity I clicked on the link and was taken to a porn site. I did not stick around long enough to see if or why there was a link to my directory, but I will have to do a search to see if any of the articles have links to that site and delete them if they have.

I recall that several years ago when I ran a magazine I checked a link from an advertisement that a subscriber had wanted me to publish. That was a porn site and a virus attacked my computer immediately afterwards. I got rid of the virus and needless to say I did not accept the ad. As I check the links with the articles submitted to my directory I cannot be as careful as I would like to be.

They say that curiosity killed the cat; well it only inconvenienced and annoyed this one. The whole thing is fraudulent and a scam. I am really glad that I did not get caught out but no doubt many others will. Fortunately I always do a search if I am unsure of anything or want to find out about something. The best and most honest answers or information usually comes from forums, not the sites with reviews and links to the products.

Of course worm.win32.netsky might really have been a worm from the netsky family then I really would have had a bigger problem to deal with. I thought that my broadband virus and spyware software would look after my computer but I will now look for something better. I really cannot understand the mentality of the malicious people who manufacture worms and viruses, or the scamsters who try to trick you out of your money.

The author owns BB Space and several other sites including http://www.creativewriter.me.uk and http://www.cashwrite.info where you can get a bunch of free writers tools

REPLY
I am Mr. Wang HongZhang, Chief Disciplinary Officer, People’s Bank of China, Beijing. I have a business proposal for you.

Before the U.S and Iraqi war, our client Khazeal Hamood Hasaab a Merchant made a fixed deposit of 24.5mUSD,for 18 months,in my branch. Upon maturity several notices were sent to him, during and after the war, which began in 2003. We later found out that my client, his wife and two sons had been killed during the war.

At the expiration of 4yrs the funds will revert to the ownership of the Hong Kong Government, if nobody applies to claim it. I will like you, as a foreigner, to stand as next of kin, so that we can receive his funds: http://www.iraqbodycount.net/names.htm.

Your earliest response to this letter will be appreciated.
wang EMAIL:hzhangwang@yahoo.com.cn

————————

One of the variations of the 419 advance free fraud scam. Do not believe the content, this lowlife is after your money. I won’t go into the fact that as an English rose type I would hardly pass as an Iraqi merchants next of kin.

I googled the name Mr. Wang HongZhang and the top listed site was an official looking People’s Bank of China site with Mr. Wang HongZhang listed as the Chief Disciplinary Officer. Maybe they have spanking in Chinese banks after all!

I find it difficult to believe that somebody in Mr. Wang HongZhang’s profession would perpetrate this scam so perhaps the scamster has hijacked Mr. Wang HongZhang’s identity to add more credibility to his tale, or the bank site is part of the scam. To find out I emailed Mr. Wang HongZhang at the bank and am awaiting his reply. If I get a reply I will update this article.

I also googled Khazeal Hamood Hasaab and apart from finding that this email has been used many times I found out that Khazeal Hamood Hasaab is listed among the dead on a memorial site apart from the site mentioned in the email. How sick if the name has been chosen from these sites to add more credibility.

A few years ago I replied scathingly to one of the 419 scam emails, but unfortunately I had forgotten that my telephone number was in the signature. I received some very sinister and threatening late night telephone calls and since then have never replied to these emails even though I’m tempted to tell them just what low lifes I think they are.

During my searches I found the following thread in a forum about this scam

http://forum.419eater.com/forum/viewtopic.php?t=115948

Although I don’t recommend replying to the scam emails I loved reading these exchanges. Great stuff.

Dear Price Winner,

We wish to congratulate you over your email success in our computer
balloting held on 1st June, 2007. This is a Millennium Scientific
Computer Game in which email addresses were used. It is a promotional
program aimed at encouraging internet users; therefore you do not need
to buy ticket to enter for it. You have been approved f or the star
prize of 1,000,000.00 Euro (One Million Euro Only)

To claim your winning prize you are to contact the appointed agent as
soon as possible for the immediate release of your winnings:

Please contact our European Agent:
Mr Rudd Van Bochem
euromillionbelgium2@yahoo.fr

(1) Ref No: EMES/WIN/007/05/10/MB
(2) Batch No: EULO/2707/444/908/07
(3) Ticket No: 01-1974
(4) Lucky No: 10-23-44-72-80
(5) Serial No: MUOTI/82536

You must contact the appointed agent with your Full Names, Contact
Telephone Numbers (Home, Office and Mobile Number and also Fax Number)
via email to process the immediate payment of your prize. The Validity
period of the winnings is for 30 working days hence you are expected
to make your claims immediately.
Once again congratulations!!!

CONGRATULATIONS!
To avoid mix up of numbers and names of any kind, we request that you
keep the entire details of your award strictly from public notice until
the process of transferring your claims has been completed, and your funds
remitted to your account.

Best Regards,
Mrs.Adline Haack
(Group Coordinator)

I immediately did a Google search and found as expected that Mr Rudd Van Hochem was well documented on the Internet. What normally happens with the advance fee fraud type of scam is that once they have hooked you in they ask in a follow up email for a fee to courier your winnings. BS! it’s a fee to line their pockets.

The biggest clue to it being a fraud is the use of a free yahoo email address rather than an official company email address. Also if you had genuinely won a prize they wouldn’t be asking you to keep quiet about it. Heck a genuine company would rather have lots of publicity.

If you are tempted to check it out and still tempted to go ahead when they ask for courier fees you could always test them by either sending them a payment link for the money via your online account, or as suggested on one site ask them for an up front partial payment and offer to sign a legal contract promising to pay them double the fee they are asking once you receive the balance.

If you have come across this or any other scams please warn others. You may add to this article by commenting on it.

For more information check out
www.data-wales.co.uk/nigerian_lottery.htm
www.419baiter.com/_scam_emails/419_emails_11-05_6.html

There are lots of sites dedicated to exposing scams, these are just 2 of them.