Ihr Geld ist da !

[Gool]

Juchu! Aber irgendwie ist statt Geld doch nur ne EXE-Datei da :(

Return-Path: <bankssnsiig [at] t-online.de>
Delivered-To: falle#
Received: (qmail 14405 invoked from network); 20 Aug 2005 xx:xx:xx -0000
Received: from unknown ([80.67.18.10])
by xaroco.ispgateway.de (qmail-ldap-1.03) with QMQP; 20 Aug 2005 xx:xx:xx -0000
Delivered-To: CLUSTERHOST mx10.ispgateway.de falle#
Received: (qmail 5803 invoked by UID: [UID filtered]
Delivered-To: falle-default-2005-02-12-um-23-23-48-82.165.27.159#
X-Envelope-To: falle-default-2005-02-12-um-23-23-48-82.165.27.159#
Received: (qmail 5771 invoked from network); 20 Aug 2005 xx:xx:xx -0000
Received: from unknown (HELO t-online.de) ([200.13.211.122])
(envelope-sender <poor [at] spamvictim.tld>)
by mx10.ispgateway.de (qmail-ldap-1.03) with SMTP
for <falle-default-2005-02-12-um-23-23-48-82.165.27.159#>; 20 Aug 2005 xx:xx:xx -0000
Received: from unknown (HELO mmx09.tilkbans.com) (202.87.46.159)
by public.micromail.com.au with SMTP; Sat, 20 Aug 2005 xx:xx:xx +0600
Received: from [198.91.97.22] by m1.gns.snv.thisdomainl.com with ASMTP; Sat, 20 Aug 2005 xx:xx:xx +0500
Received: from asx121.turbo-inline.com ([202.97.221.19])
by external.newsubdomain.com with ASMTP; Sun, 21 Aug 2005 xx:xx:xx -0900
Received: from 59.32.120.46 ([59.32.120.46]) by rly04.hottestmile.com with QMQP; Sat, 20 Aug 2005 xx:xx:xx +0600
Received: from smtp.endend.nl ([213.166.219.164])
by mail.webhostings4u.com with QMQP; Sun, 21 Aug 2005 xx:xx:xx -1100
Message-ID: [ID filtered]
From: "Wichtig" <bankssnsiig [at] t-online.de>
To: "Administrator" <falle-default-2005-02-12-um-23-23-48-82.165.27.159#>
Subject: Ihr Geld ist da !
Date: Sat, 20 Aug 2005 xx:xx:xx +1100
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: base64
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1123
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1123

Return-Path: <bankssrtfh [at] t-online.de>
Delivered-To: falle#
Received: (qmail 31994 invoked from network); 21 Aug 2005 xx:xx:xx -0000
Received: from unknown ([80.67.18.9])
by xaroco.ispgateway.de (qmail-ldap-1.03) with QMQP; 21 Aug 2005 xx:xx:xx -0000
Delivered-To: CLUSTERHOST mx09.ispgateway.de falle#
Received: (qmail 9063 invoked by UID: [UID filtered]
Delivered-To: falle-default-2005-01-27-um-22-00-12-82.165.27.152#
X-Envelope-To: falle-default-2005-01-27-um-22-00-12-82.165.27.152#
Received: (qmail 8915 invoked from network); 21 Aug 2005 xx:xx:xx -0000
Received: from unknown (HELO t-online.de) ([219.83.36.132])
(envelope-sender <poor [at] spamvictim.tld>)
by mx09.ispgateway.de (qmail-ldap-1.03) with SMTP
for <falle-default-2005-01-27-um-22-00-12-82.165.27.152#>; 21 Aug 2005 xx:xx:xx -0000
Received: from [74.99.49.28] by rsmail.alkoholic.net with NNFMP; Sun, 21 Aug 2005 xx:xx:xx -0900
Received: from unknown (126.54.163.177)
by rsmail.alkoholic.net with SMTP; Sat, 20 Aug 2005 xx:xx:xx +0800
Received: from unknown (164.233.164.160)
by public.micromail.com.au with LOCAL; Sat, 20 Aug 2005 xx:xx:xx +0900
Message-ID: [ID filtered]
Reply-To: "Wichtig" <bankssrtfh [at] t-online.de>
From: "Wichtig" <bankssrtfh [at] t-online.de>
To: "Administrator" <falle-default-2005-01-27-um-22-00-12-82.165.27.152#>
Subject: Ihre Geld ist da !
Date: Sat, 20 Aug 2005 xx:xx:xx +1000
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: base64
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1123
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1123

Return-Path: <bankssefeearc [at] t-online.de>
Delivered-To: falle#
Received: (qmail 31909 invoked from network); 21 Aug 2005 xx:xx:xx -0000
Received: from unknown ([80.67.18.5])
by xaroco.ispgateway.de (qmail-ldap-1.03) with QMQP; 21 Aug 2005 xx:xx:xx -0000
Delivered-To: CLUSTERHOST mx05.ispgateway.de falle#
Received: (qmail 9504 invoked by UID: [UID filtered]
Delivered-To: falle-default-2005-02-12-um-23-23-48-82.165.27.159#
X-Envelope-To: falle-default-2005-02-12-um-23-23-48-82.165.27.159#
Received: (qmail 9433 invoked from network); 21 Aug 2005 xx:xx:xx -0000
Received: from unknown (HELO t-online.de) ([200.190.198.10])
(envelope-sender <poor [at] spamvictim.tld>)
by mx05.ispgateway.de (qmail-ldap-1.03) with SMTP
for <falle-default-2005-02-12-um-23-23-48-82.165.27.159#>; 21 Aug 2005 xx:xx:xx -0000
Received: from mailout.endmonthnow.com ([51.239.36.164])
by m1.gns.snv.thisdomainl.com with ASMTP; Sat, 20 Aug 2005 xx:xx:xx +1100
Received: from 109.89.174.76 ([109.89.174.76]) by qnx.mdrost.com with LOCAL; Sun, 21 Aug 2005 xx:xx:xx -0400
Received: from unknown (136.237.75.141)
by relay.2yahoo.com with ASMTP; Sun, 21 Aug 2005 xx:xx:xx -0600
Received: from unknown (11.97.216.236)
by nntp.pinxodet.net with LOCAL; Sun, 21 Aug 2005 xx:xx:xx +0500
Received: from unknown (151.209.152.155)
by relay.2yahoo.com with NNFMP; Sun, 21 Aug 2005 xx:xx:xx +0100
Message-ID: [ID filtered]
Reply-To: "Wichtig" <bankssefeearc [at] t-online.de>
From: "Wichtig" <bankssefeearc [at] t-online.de>
To: "Administrator" <falle-default-2005-02-12-um-23-23-48-82.165.27.159#>
Subject: Ihre Geld ist da !
Date: Sun, 21 Aug 2005 xx:xx:xx +0300
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: base64
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1123
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1123

Return-Path: <banksssfidvg [at] t-online.de>
Delivered-To: falle#
Received: (qmail 14384 invoked from network); 20 Aug 2005 xx:xx:xx -0000
Received: from unknown ([80.67.18.9])
by xaroco.ispgateway.de (qmail-ldap-1.03) with QMQP; 20 Aug 2005 xx:xx:xx -0000
Delivered-To: CLUSTERHOST mx09.ispgateway.de falle#
Received: (qmail 24417 invoked by UID: [UID filtered]
Delivered-To: falle-default-2005-01-27-um-22-00-12-82.165.27.152#
X-Envelope-To: falle-default-2005-01-27-um-22-00-12-82.165.27.152#
Received: (qmail 24390 invoked from network); 20 Aug 2005 xx:xx:xx -0000
Received: from unknown (HELO t-online.de) ([61.221.114.170])
(envelope-sender <poor [at] spamvictim.tld>)
by mx09.ispgateway.de (qmail-ldap-1.03) with SMTP
for <falle-default-2005-01-27-um-22-00-12-82.165.27.152#>; 20 Aug 2005 xx:xx:xx -0000
Received: from unknown (HELO webmail.halftomorrow.com) (30.207.195.78)
by smtp.endend.nl with LOCAL; Sun, 21 Aug 2005 xx:xx:xx -1000
Message-ID: [ID filtered]
From: "Wichtig" <banksssfidvg [at] t-online.de>
To: "Administrator" <falle-default-2005-01-27-um-22-00-12-82.165.27.152#>
Subject: Ihr Geld ist da !
Date: Sat, 20 Aug 2005 xx:xx:xx -0400
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: base64
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1158

!! Erster Deutscher Online Multi Player Pokerraum !!


Spielen Sie Poker gegen andere Mitspieler 24 Std. am Tag. Um echtes Geld
oder nur zum Spass. Über 6000 Spieler täglich.

!!!! Die Teilnahme ist völlig kostenlos und unverbindlich !!!!


*****!! Wir schenken ihnen 100 Euro Startguthaben kostenlos !!*****

http://www.playstarpoker.com/PlayStarPoker.exe ( Kostenlose MultiPlayer
Poker Software )

**************************************************************************
Spielen Sie mit unserem Geld ganz ohne Risiko. Sollten Sie gewinnen dürfen
Sie das Geld selbstverständlich behalten. Pokern Sie sich reich.
**************************************************************************

!!!! Die Teilnahme ist völlig kostenlos und unverbindlich !!!!


*****Downloaden Sie unsere kostenlose MultiPlayer Software*******

http://www.playstarpoker.com/PlayStarPoker.exe (Kostenlose Poker Software)

- Über 6000 Spieler Täglich.
- Tägliche Pokerturniere
- Poker Anfängerspiele und Profispiele

http://www.playstarpoker.com/PlayStarPoker.exe (Kostenlose Poker Software)


*********************************************************************
Gewinnen Sie mit PlayStarPoker.com eine Reise nach Paris zu der Poker
Weltmeisterschaft im Gesamtwert von über 12.000 Euro!
*********************************************************************



Mit freundlichen Grüßen

Ihr PlayStarPoker.com Team

http://www.playstarpoker.com









********************************************************************
Sie haben diesen Newsletter bekommen. Weil Sie oder ein anderer bei
PlayStarPoker ihre Email Adresse registriert hat. Wenn Sie den Newsletter
nicht mehr haben wollen. Dann schicken Sie uns bitte eine Email an
abmelden [at] playstarpoker.com
********************************************************************


--> Der Adresssammler ist auf jeden Fall Deutsch. Die in der Harvesterfalle aufgegriffene Domain gehört zu Schlund.

[Sirius]

Hallo.

Das ist der bekannte Sch*ß von http://www.grandvirtual.com.

Dazu gibt es im alten Forum bereits einen Thread: http://www.antispam-ev.de/forum/showthread.php?t=7266&page=2&pp=10

Es steckt übrigens wieder die CStart.exe dahinter, nur diesmal ist sie per UPX doppelt verschlüsselt.

Und so kommt man heran:

#!/bin/sh
wget http://www.playstarpoker.com/PlayStarPoker.exe &&
upx -d PlayStarPoker.exe &&
dd if=PlayStarPoker.exe of=CStart.exe bs=1 skip=123532 &&
upx -d CStart.exe

BTW: Hier ist überschüssige Rechenzeit besser aufgehoben und Geld verliert man auch keines:
http://athome.web.cern.ch/athome/
http://climateprediction.net/versions/DE/index.php
http://einstein.phys.uwm.edu/

Grüße

[oliveer]

Return-Path: <bankoxcwbxfx [at] t-online.de>
X-Original-To: xxx
Received: from localhost (mail-in-05.arcor-online.net [151.189.21.45])
by mail-in-01-z2.arcor-online.net (Postfix) with ESMTP ID: [ID filtered]
for <xxx>; Wed, 23 Nov 2005 xx:xx:xx +0100 (CET)
Received: from mail-in-05.arcor-online.net ([127.0.0.1])
by localhost (mail-in-05 [127.0.0.1]) (amavisd-new, port 10024) with LMTP
ID: [ID filtered]
Received: from t-online.de (unknown [200.243.121.150])
by mail-in-05.arcor-online.net (Postfix) with ESMTP ID: [ID filtered]
for <xxx>; Wed, 23 Nov 2005 xx:xx:xx +0100 (CET)
Received: from 50.224.76.16 ([50.224.76.16]) by smtp-server1.cfdenselr.com with LOCAL; Wed, 23 Nov 2005 xx:xx:xx -0100
Received: from 141.29.231.86 ([141.29.231.86]) by relay37.vosimerkam.net with QMQP; Wed, 23 Nov 2005 xx:xx:xx -0800
Received: from smtp18.yenddx.com ([197.62.66.67])
by smtp.endend.nl with NNFMP; Tue, 22 Nov 2005 xx:xx:xx +0900
Received: from 83.205.19.108 ([83.205.19.108]) by qrx.quickslick.com with QMQP; Tue, 22 Nov 2005 xx:xx:xx +0900
Received: from [211.211.232.166] by mx03.listsystemsf.net with ASMTP; Wed, 23 Nov 2005 xx:xx:xx +0200
Message-ID: [ID filtered]
Reply-To: "Bank" <bankoxcwbxfx [at] t-online.de>
From: "Bank" <bankoxcwbxfx [at] t-online.de>
To: "Administrator" <xxx>
Subject: Ihr Geld ist da
Date: Tue, 22 Nov 2005 xx:xx:xx +0800
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1158
X-Virus-Scanned: amavisd-new at arcor.de

Spambody entfernt, da bereits gepostet. Eniac

Der ist auch mal wieder aktiv. :mad:

in diesem Sinne


Oliver

[oliveer]

Received: from [211.253.223.125] (helo=t-online.de)
by mx27.web.de with smtp (WEB.DE 4.105 #323)
ID: [ID filtered]
for xxx; Wed, 23 Nov 2005 xx:xx:xx +0100
Received: from [121.108.28.63] by smtp18.yenddx.com with SMTP; Wed, 23 Nov 2005 xx:xx:xx -0900
Message-ID: [ID filtered]
Reply-To: "Bank" <bankkw [at] t-online.de>
From: "Bank" <bankkw [at] t-online.de>
To: "Administrator" <xxx>
Subject: Ihr Geld ist da
Date: Wed, 23 Nov 2005 xx:xx:xx +0600
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Sender: bankkw [at] t-online.de

...und hier hat dieses Teil auch sein Müll hinterlassen.

in diesem Sinne

Oliver

[oliveer]

Return-Path: <bankwiuc [at] t-online.de>
Delivered-To: xxx
Received: from t-online.de (c90691e2.virtua.com.br [201.6.145.226])
by xxx (Postfix) with SMTP ID: [ID filtered]
for <xxx>; Fri, 25 Nov 2005 xx:xx:xx +0100 (CET)
Received: from [7.23.94.133] by rsmail.alkoholic.net with ESMTP; Thu, 24 Nov 2005 xx:xx:xx +1100
Message-ID: [ID filtered]
Reply-To: "Bank" <bankwiuc [at] t-online.de>
From: "Bank" <bankwiuc [at] t-online.de>
To: "Administrator" <xxx>
Subject: Ihr Geld ist da
Date: Fri, 25 Nov 2005 xx:xx:xx -0900
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1123
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1123
X-UIDL: [UID filtered]
Status: RO

... und die 3. eMail-Adresse zugemüllt ! :mad:

in diesem Sinne


Oliver

[keuner]

Hallo, hab diesen Müll auch bekommen, zwei Spam-Filter haben es leider durchgehen lassen :( .

X-Virus-Flag: no
X-Spam-Checker-Version: SpamAssassin 3.1.0-gr0 (2005-09-13) on lan1.xyznet.de
X-Spam-Level: ***
X-Spam-Status: No, score=4.0 required=5.0 tests=DATE_IN_PAST_06_12,
RCVD_NUMERIC_HELO,SARE_RECV_SPAM_DOMN0a autolearn=no version=3.1.0-gr0
X-Virus-Flag: no
Return-Path: <bankx [at] t-online.de>
Delivery-Date: Fri, 25 Nov 2005 xx:xx:xx +0100
Received: from [85.70.57.67] (helo=t-online.de)
by mx.kundenserver.de (node=mxeu9) with ESMTP (Nemesis),
ID: [ID filtered]
Received: from unknown (26.188.144.24)
by mxs.perenter.com with ASMTP; Fri, 25 Nov 2005 xx:xx:xx -0100
Received: from unknown (HELO qrx.quickslick.com) (178.73.70.42)
by smtp4.cyberemailings.com with SMTP; Fri, 25 Nov 2005 xx:xx:xx -0200
Received: from 15.124.6.155 ([15.124.6.155]) by smtp.doneohx.com with SMTP; Fri, 25 Nov 2005 xx:xx:xx +0700
Received: from [104.156.20.225] by relay.2yahoo.com with QMQP; Fri, 25 Nov 2005 xx:xx:xx +0100
Message-ID: [ID filtered]
From: "Bank" <bankx [at] t-online.de>
To: "Administrator" <poor [at] spamvictim.tld>
Subject: Ihr Geld ist da
Date: Fri, 25 Nov 2005 xx:xx:xx +1000
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Envelope-To: poor [at] spamvictim.tld
X-SpamScore: 0.8
tests= DATE_IN_PAST_06_12
X-UID: [UID filtered]
Status: R
X-Status: NC
X-KMail-EncryptionState:
X-KMail-SignatureState:
X-KMail-MDN-Sent:

Spambody entfernt, da bereits gepostet. Eniac

[schara56]

Return-Path: <banko [at] t-online.de>
X-Flags: 0000
Delivered-To: GMX delivery to poor [at] spamvictim.tld
Received: (qmail invoked by alias); 30 Nov 2005 xx:xx:xx -0000
Received: from rj130.internetdsl.tpnet.pl (HELO t-online.de) [80.55.61.130]
by mx0.gmx.net (mx050) with SMTP; 30 Nov 2005 xx:xx:xx +0100
Received: from unknown (50.130.212.107)
by external.newsubdomain.com with NNFMP; Wed, 30 Nov 2005 xx:xx:xx +0300
Received: from [94.18.216.155] by mxs.perenter.com with LOCAL; Wed, 30 Nov 2005 xx:xx:xx +0000
Received: from unknown (121.39.33.13)
by external.newsubdomain.com with LOCAL; Thu, 01 Dec 2005 xx:xx:xx -0900
Received: from unknown (115.136.77.1)
by group21.345mail.com with ESMTP; Thu, 01 Dec 2005 xx:xx:xx -1100
Message-ID: [ID filtered]
From: "Bank" <banko [at] t-online.de>
To: "Administrator" <poor [at] spamvictim.tld>
Subject: Ihr Geld ist da
Date: Wed, 30 Nov 2005 xx:xx:xx -0400
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-GMX-Antivirus: 0 (no virus found)
X-GMX-Antispam: 4 (From mass domain over foreign mail server)
X-GMX-UID: [UID filtered]



Spambody entfernt, da bereits gepostet. Eniac

[Eniac]

Das unverbesserliche eFucky-Casino mal wieder, gehostet in Malysia, abegekippt über Russland.

---------------------------------------------

Re: 217.119.19.34 [fastway2.cust.smartspb.net] (Ursprungsquelle der Spammail)
To: poor [at] spamvictim.tld, poor [at] spamvictim.tld

Re: playstarpoker.com [202.75.41.17] (beworbene Seite)
To: poor [at] spamvictim.tld, poor [at] spamvictim.tld, poor [at] spamvictim.tld

From SRS0=7y2a=2B=t-online.de=bankhb [at] srs.kundenserver.de Sun Dec 4 xx:xx:xx 2005
Return-Path: <SRS0=7y2a=2B=t-online.de=bankhb [at] srs.kundenserver.de>
X-Flags: 1001
Received: (qmail invoked by alias); 04 Dec 2005 xx:xx:xx -0000
Received: from [217.119.19.34] (helo=t-online.de)
by mx.kundenserver.de (node=mxeu10) with ESMTP (Nemesis),
ID: [ID filtered]
Received: from [142.93.156.191] by mx.reskind.net with SMTP; Sat, 03 Dec 2005 xx:xx:xx +1100
Message-ID: [ID filtered]
Reply-To: "Bank" <bankhb [at] t-online.de>
From: "Bank" <bankhb [at] t-online.de>
To: "Administrator" <info [at] meine-domäne.de>
Subject: Ihr Geld ist da
Date: Sun, 04 Dec 2005 xx:xx:xx +0600
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

Eniac