RonOliverClarin.com - Philippines Designer, Web Developer . Web Hosting and Real State Consultant

Almost an hour ago, I receive an email from Facebook:

Then I checked my facebook account for confirming this email.

I was shocked and thinking. How can I post some pornographic or related content if I just added a new blog post few hours ago regarding Shamcey Supsup with her swimwear photo in Miss Universe pageant? or my perfumes added in my wall? Please nourish my mind. I don't see any adult material in my previous post wall, photos, videos within my profile account.

Last August 3 2011, I received an email from  This email address is being protected from spambots. You need JavaScript enabled to view it. as subject title "Nacha Security Nitification" and contain:

Dear Valued Client,

We strongly believe that your account may have been compromised. Due to this, we cancelled the last ACH transactions:

-(ID: 13552290)
-(ID: 45456774)
-(ID: 74039633)
-(ID: 89958340)

initiated from your bank account by you or any other person, who might have access to your account.

Detailed report on initiated transactions and reasons for cancellation can be found in the attachment. 

The "report" is in single extension file, with a name like: "report-8764.zip (8.03 KB) ZIP archive, Adobe PDF)" -although future variants may arrive with just a .zip or just a .pdf extension.

The From line is usually: "account manager" ( This email address is being protected from spambots. You need JavaScript enabled to view it. , or This email address is being protected from spambots. You need JavaScript enabled to view it. ). You will be getting these sent to every one of your email accounts, should you have multiple accounts, like I do. Domains with email are especially hard hit in today's spam campaigns.

The actual "sender" is a PC in a spam botnet, operating under commands from the Bot Master running this show. All reply-to and From information is forged.

The payload in the current crop of malware in attachments is the "Zeus" aka: "ZBot" keylogger Trojan. The installer may also make the victim's computer a member of the same botnet from which their scam message was sent. This perpetuates and increases the size of the botnet and steals money from victims as they log into banks and payment portals targeted by this Zeus varian

My advice to recipients of one of these, or future variations of these scams, is to phone you bank, or financial institution and ask them to check your account for problem transactions. Note, there have been some spam campaigns that include a fake contact phone number that actually leads to people hired by the criminals running particular campaigns. So, your safest bet is to look-up the number for your bank, or flip over your debit or credit card and call the number listed on it.