NatWest link for Virus

NatWest Logo

You have a new private message from NatWest

To view/read this your secure message please click here

Email Encryption Provided by NatWest. Learn More.
Email Security Powered by Voltage IBE
Copyright 2014 National Westminster Bank Plc. All rights reserved.

Footer Logo NatWest

To unsubscribe please click here

National Westminster Bank Plc. All rights, save as expressly granted, are reserved. Reproduction in any form of any part of the contents of this website without our prior written consent is prohibited unless for personal use only.

Email analysis :
=================================================
NOTE : Return-Path : < denqv@bpbcorp.com >
NOTE : Received : from unknown (HELO localhost) (113.167.221.144)

NOTE : User-Agent : Mozilla/5.0 (Windows NT 6.1; rv:24.0)
NOTE : Gecko/20100101 Thunderbird/24.2.0
NOTE : You have received a new secure message from NatWest
=================================================

Link analysis :
=================================================
NOTE : Click "To view/read this your secure message please click here"
NOTE : Open "http://high-hollin.org/nrhscgfayh/rxyxzmsbsy.html"
NOTE : A new download is processed :

NOTE : File "SecureMessage.zip" from http://www.explicacoesmagicmath.pt
NOTE : File "SecureMessage.zip" is a VIRUS !
=================================================

Virus analysis (DEF 20140916) :
=================================================
AVware : Win32.Malware!Drop
Avira : TR/ATRAPS.A.1717
Baidu-International : Trojan.Win32.Upatre.ABlK
DrWeb : Trojan.DownLoad3.34292
ESET-NOD32 : Win32/TrojanDownloader.Waski.A
Ikarus : Trojan-Spy.Agent
K7AntiVirus : Trojan (7000000c1)
K7GW : Trojan(7000000c1)
Kaspersky : Trojan-Downloader.Win32.Upatre.avh
Kingsoft : VIRUS_UNKNOWN
Malwarebytes : Trojan.Upatre
McAfee : Artemis!AE3D2F8620F0
Microsoft : TrojanDownloader:Win32/Upatre.AA
Panda : Trj/Chgt.F
Qihoo-360 : HEUR/QVM20.1.Malware.Gen
Sophos : Mal/DrodZp-A
Symantec : Trojan.Zbot
Tencent : Win32.Trojan-downloader.Upatre.Wqmz
VIPRE : Win32.Malware!Drop
ViRobot : Trojan.Win32.S.Agent.20992.PD
=================================================

Whois Analysis :
=================================================
high-hollin.org
=================================================
Domain Name:HIGH-HOLLIN.ORG
Domain ID: D153034212-LROR
Creation Date: 2008-06-20T18:34:26Z
Updated Date: 2012-06-19T08:02:22Z
Registry Expiry Date: 2015-06-20T18:34:26Z
Sponsoring Registrar:Tucows Inc. (R11-LROR)
Sponsoring Registrar IANA ID: 69
Domain Status: ok
Registrant ID:tuMZ59PcSs2k5l1K
Registrant Name:Douglas McCowen
Registrant Organization:None
Registrant Street: Riverside Barn
Registrant City:Winford- BRISTOL
Registrant State/Province:Avon
Registrant Postal Code:BS408HJ
Registrant Country:GB
Registrant Phone:+44.7985466869
Registrant Email:dhl_mccowen@hotmail.com
Admin ID:tuMZ59PcSs2k5l1K
Admin Name:Douglas McCowen
Admin Organization:None
Admin Street: Riverside Barn
Admin City:Winford- BRISTOL
Admin State/Province:Avon
Admin Postal Code:BS408HJ
Admin Country:GB
Admin Phone:+44.7985466869
Admin Email:dhl_mccowen@hotmail.com
Tech ID:tu9LIBi0nseyvCgJ
Tech Name:Pickaweb Limited Domains Dpt
Tech Organization:Pickaweb Limited
Tech Street: 7 Marlow Copse
Tech City:Chatham
Tech State/Province:Kent
Tech Postal Code:ME59DP
Tech Country:GB
Tech Phone:+44.8712180841
Tech Email:domains@pickaweb.co.uk
Name Server:NS7.UKHOSTSUPPORT.COM
Name Server:NS8.UKHOSTSUPPORT.COM
=================================================
explicacoesmagicmath.pt
=================================================
Domain Name: explicacoesmagicmath.pt
Creation Date (dd/mm/yyyy): 04/02/2013
Expiration Date (dd/mm/yyyy): 03/02/2015
Status: ACTIVE

Registrant

Francisco Cascao
Rua Francisco sa Miranda Lt 7
538
2975 538

Email: franciscocascao@iol.pt

Entidade Gestora / Billing Contact
EASYHOST - SERVI?OS INTERNET, UNIPESSOAL LDA
Email: dns@easyhost.pt
RACKSPOT LDA
Email: helpdesk@rackspot.com
Nameserver: explicacoesmagicmath.pt NS a.ns.rackspot.com.
Nameserver: explicacoesmagicmath.pt NS b.ns.rackspot.com.
=================================================

Hello Friend

Hello, I'm Norman Chan, Tak-Lam, S.B.S., J.P, Chief Executive, Hong Kong Monetary Authority (HKMA). I have a Business worth $47.1M USD for you to handle with me. Contact me for more details on this business proposal.

Email analysis :
===============================
NOTE : Return-Path :
NOTE : Received : from mail.hfs-sports.de (HELO hfs-sports.de) (87.139.42.29)

NOTE : Received : from 41.71.216.117 ([41.71.216.117]) by hfs-sports.de with ESMTP;

NOTE : X-Msmail-Priority : Normal
NOTE : X-Mailer : Microsoft Outlook Express 6.00.2900.5843
NOTE : X-Mimeole : Produced By Microsoft MimeOLE V6.00.2900.5579
NOTE : Hello Friend
===============================

About Printing Solution for Mimaki and EPSON, HP Z6100

The Best Printing Solution for Saving the Cost.

Chip PROGRAMMER for Mimaki & Roland Printer

Inquiry to info@***.com

Mimak, Mimaki JV33, Mimaki 440ml, Mimaki Ink, Mimaki Chip
CISS ( Continuous Ink Supply System ) of EPSON 11880 & 9700, HP Z6100
for More Economic & Convenient USE

Inquiry to info@***.com

EPSON 11880, EPSON Ink. ESPON 9700, EPSON Printer, EPSON Ink, HP Z6100, HP Z6100 Ink, HP Z6100 Printer

Download Product Information

www.***.com

PLEASE DID YOU CHANGE YOUR BANK ACCOUNT DETAILS???

WORLD BANK AUDITORS/INTERNATIONAL MONETARY FUNDS
(IMF) Millbank Tower, 12th Floor, 21-24 Millbank, London
SW1P 4QP
From the Desk Of Sri Mulyani Indrawati
Managing Director and Chief Operating Officer, World
Bank
8th of September 2014

YOUR OVER DUE CONTRACT/INHERITANCE FUNDS
Attention. Beneficiary ,

This is to bring to your notice about the due process of your outstanding Contractual/Inheritance payment which was suspended by the British Council there by stopping the telex unit to pause the transfer of your contract/inheritance fund to your nominated bank account. As a result of this development, verification conducted by the Finance Ministry in conjunction with the Debt Verification Panel on your contract/inheritance case ,your file has been endorsed for payment awaiting your confirmations. During the auditing and closing of all financial records of the World Bank it was discovered from the records of outstanding foreign contractors due for payment with the World Bank Auditors London in the year 2013/2014 that your name and company is next on the list of those who will received their fund this quarter 2014. Meanwhile, a woman came to my office few days ago with a letter ,claiming to be your true representative. Here are her information for you to confirm to this office if this woman is truly from you or not, so that the world bank will not be held responsible for paying into the wrong account.

NAME: MRS. JANET WHITE
BANK NAME: CITI BANK
BANK ADDRESS: ARIZONA, USA.
ACCOUNT NUMBER: 6503809428.

Please, do reconfirm to this office, as a matter of urgency if this woman is from you. you are requested to fill and send this information for verifications purposes so that your fund valid us$10.7m us dollars will be remitted into your nominated bank account. this fund is as a result of inheritance on your behalf. Information needed from you for verification is as follow:

(1) Your full name and address:
(2) Your age and marital status:
(3) Your occupation:
(4) Your telephone/fax number:
(5) Your nationality:
6) Your Bank Account Number
7_ Scan any of your Id to send

As soon as we receive this, we will commence with all necessary procedures in other to remit this money into your account. the world BankAuditors and the ,Executive Board of Directors and the Brithis Councl for foreign over due inheritance fund have approved and accredited this reputable with the office of the minister of finance international remittance/foreign operations, to handle and supervise the transfer of all foreign inheritance funds for this second quarter payment of the year 2014.

However, we shall proceed to issue all payments details to the said Mrs. White, if we do not hear from you within the next seven working days from today. We are sorry for any inconvenience the delay in transferring of this fund must have caused you.

Yours Faithfully,
Sri Mulyani Indrawati
Managing Director and Chief Operating Officer, World

PAYMENT NOTICE OF YOUR FUNDS

OFFICE OF THE PRESIDENCY
FEDERAL REPUBLIC OF NIGERIA
Tel: Highly Confidential.
19 Walter Carrington Str. Ikoyi Lagos-Nigeria.
ASO ROCK VILLA, ABUJA ANNEX OFFICE.
From the Desk of Chief. Terry Edmond GCON.
Our Ref: FGN/OHG/OXD1/2011
TELEX: FEDGOVNIG.
PAYMENT FILE: FGN/BEN/08.

ATTN: Dear Beneficiary,

PAYMENT NOTICE OF YOUR FUNDS

May you remain favored.

This letter will definitely be amazing to you because of its realistic value. Sorry for the inconveniences that was rendered to you in your line of Inheritance Payment transaction with some Nigerian Officials some while ago. Without taking much of your time, my name is Chief.Jim Nagy, the Honorable Paymaster General of The Federal Republic of Nigeria. Presently, were in partnership with the American government in averting Scams and also to avert beneficiary funds delays here in Nigeria, So far, we have succeeded in Settling the likes of (Mrs. Ann Keyser, Mr. Edward Drake etc) their inheritance funds which was previously delayed. Your Funds were returned to the Federal Government Treasury some while ago because you did not finalize your claim for it. A week ago, the Presidency and the Federal Executive Council collectively agreed to release the sum of US$1,200,000.00 to you but to our surprise you sent down your representatives Mr. Robert Jason and Mr. Jim Harrison to collect this Funds on your behalf, this morning. Since you sent your representatives to us, kindly give us the authority to transfer your Funds into their own Bank Account in Singapore. We await your immediate response via email and telephone But if you did not Authorize this claim then fill and submit this form right away to this department:

FULL NAME:
HOME ADDRESS:
PHONE NUMBER:
AGE:
SEX:
STATUS:
OCCUPATION:
COUNTRY:

Officially Sealed,
Direct Line :+2347039237429

Chief.Jim Nagy
The Honorable Paymaster General.

STOP CONTACTING THOSE PEOPLE !!!

Kind Attention:

My name is Rev. John Anderson; I am a US citizen, 51 Years Old. My residential address is as follows. 5424 Pent ridge Street Philadelphia, Pennsylvania, 19143-4126, United States of America, I am one of those people that took part in receiving Inheritance funds and Lottery funds from African banks and European banks even from many lottery organizers few years ago and they refused to pay me, I had paid different fees or charges of over $85,000 while in the USA trying to get my funds from those banks and lottery organizers but all to no avail. So i decided to travel to WASHINGTON D.C USA with all my payment approval documents,and I was directed by the F.B.I. Director to contact a man called Mr. Stephen David Purchase, A BRITISH CITIZEN and a member of the UNITED NATIONS ORGANISATION (UNO) & INTERNATIONAL MONETARY FUNDS (IMF) COMPENSATION AWARD COMMITTEE currently staying in United - Kingdom. I contacted him in United Kingdom and he explained everything to me. Mr. Stephen David Purchase personally directed me on how to successfully claim my Inheritance and Lottery payment from the paying bank and right now I am the happiest man on earth because I have now finally received my funds totaling US$ 6 Million (Six Million U.S Dollars). Moreover Mr. Stephen David Purchase, showed me the full information of those people that are yet to receive their payments and I saw your names/your email address as one of the beneficiaries and that is why I decided to email you to stop dealing with those people because they are not with your funds but they are only making money out of you.

I will personally advise you to contact Mr. Stephen David Purchase in United-Kingdom immediately after reading this message. You have to contact him directly on this information below:

Contact Person: Mr. Stephen David Purchase
Contact Address: No. 285 Griffiths Drive Wolverhampton WV11 2JT United Kingdom.
eMail ID: mrstephendavid@gmail.com
Telephone Number: +44 702 406 8431

Contact him now and send him (1). Your full names, (2). Your full contact Address, (3). Your mobile phone numbers (4). Your Age and Occupation Etc... You really have to stop dealing with those people that are contacting you now telling you that your funds is with them because your funds is not in anyway with them, they are only taking advantage of you and they will dry you up until you have nothing left with you. Once again stop contacting those people, I will advise you to contact only Mr. Stephen David Purchase in United - Kingdom so that he can help you process your payment through the paying bank instead of dealing with those liars that will be turning you around asking for different kind of money for fees to complete your transaction.

Thank You and Be Blessed.
Rev. John Anderson
5424 Pent ridge Street Philadelphia,
Pennsylvania, 19143-4126, U.S.A