Search This Blog

Thursday, April 18, 2013

Boston Marathon spam emails infect many computers today

Please be warned about a brand new massive spam campaign on malware distribution, supposedly showing videos related to the Boston Marathon explosion tragedy that occurred a couple of days ago. In fact, this spam is nowadays attacking millions of PCs and distributing spam with tremendous speed. Clicking the links contained inside of such spam emails is extremely dangerous for your computer and the computers of your friends, colleagues and relatives.

These emails may have the following subjects:

  • Boston Explosion Caught on Video
  • Explosions at the Boston Marathon
  • Aftermath to explosion at Boston Marathon
  • 2 Explosions at Boston Marathon
  • Explosions at Boston Marathon
  • Explosion at Boston Marathon
  • Video of Explosion at the Boston Marathon 2013
  • Explosion at the Boston Marathon
  • BREAKING - Boston Marathon Explosion

Similarly, there's another spam-sending campaign formalized in the form of news. It uses the following subjects in spam emails:

  • Opinion: North Korean Official's child was the CIA target - Boston Marathon Explosions Worse Sensations. -
  • Opinion: Osama bin Laden's legacy - Boston Marathon Explosions -
  • Opinion: FBI knew about bombs 3 days before Boston Marathon - Why and Who Benefits? -
  • Opinion: Boston Marathon Explosions - Who benefits? -
  • Opinion: China Official's child was the CIA target - Boston Marathon Explosions Worse Sensations. -
  • Opinion: Osama Bin Laden video about Boston Marathon Explosions - bad news for all the world. -
  • Opinion: Boston Marathon Explosions - CIA Benefits? -
  • Undeliverable: Explosion at the Boston Marathon
  • Opinion: Osama bin Laden still alive - Boston Marathon Worse Sensation!? -
  • Undeliverable: Explosions at Boston Marathon
  • Opinion: Boston Marathon Explosions made by radical Gays? Really? -
  • Opinion: Boston Marathon Explosions - Obama Benefits? -
  • Undeliverable: Boston Explosion Caught on Video
  • Opinion: Boston Marathon Explosions - Osama bin Laden still alive? -
  • Undeliverable: Video of Explosion at the Boston Marathon 2013
  • Opinion: Osama death was Faked by CIA - Boston Marathon Explosions Worse News. -

These spam links may begin with various IP addresses, such as,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, and will have the ending like /boston.html or /news.html.

Also, these spam emails may begin with domain names, such as,,,,,,,,,,,, mannesmann.c,,,,,,,,,,, and These ones have the endings as /bostoncnn.html or /cnn_boston.html.

Clicking such links in spam Boston Marathon emails with videos is dangerous, even though some of these videos can be really viewed after clicking the link. However, in the source code of the web page opened there's a special malicious code that is associated with the site and a file "waiq.html".

When clicking the link, the following registry entry is added HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SonyAgent: "C:\WINDOWS\Temp\temp86.exe", as well as the hidden file with 815,616 bytes in size in the same location. By the way, the MD5 of the file is fdbc94958b8f0ec2b24302c6d4685c46. It's worth saying that only few antiviruses detect this file as malware. Once the link is clicked, your computers turn out to be a real spam machine and thus begins to spread similar emails with enormous speed, with the similar subjects stated above. The other, CNN-subjected spam campaign is a Financial Crimes malware infector, often referred to as Cridex. So, please don't ever click such dangerous spam links. Instead, scan your system with reliable security software downloadable below.

Recommended software for malware removal:

Download GridinSoft Trojan Killer

1 comment:

  1. I saw that you are putting a lot of efforts into your blog. Keep posting the good work.Some really helpful information in there. Nice to see your site. Thanks!

    dell support