X.Trojan-Spy.W32.Zbot.WU.8/28

Subject: Western Union MTCN #7363186527

File name: MT77232.zip

Hello!

Attention! The wire sent to Vladimir Kirkorov, Moscow, Russia has been blocked by our security service.

Your credit card issuing bank has halted the transaction by the demand of the Federal Criminal Investigation Service (case No. 52798 since the recipient has been undergoing the international retrieval by the InterPol.

Please contact the closest Western Union office and make sure you have your ID card, the credit card that was used for making the payment, and the invoice file with you.(The invoice file is attached to this message; please print it out and hand it to our agent.)

You can find the address of the closest Western Union agent on our website at www.westernunion.com

Thank you!

X.W32/Dloadr.MAD (2,3)

File name: Mad.zip

Possible Subject:

Hi

Hello

Hi there

Hello there

Possible Message Body:

Your girlfriend's video

Is that your sister?

Is that your friend?

Your girl's viedo

She is s#cking

Girl wants real man!

X.Mal/EncPk-CZ.8/28

Subject: Your Online Flight Ticket N 85997

File Name: eTicket_N832.zip

Good morning,

Thank you for using our new service "Buy flight ticket Online" on our website.Your account has been created:Your login: bricket.wood@leisureconnection.co.ukYour password: pass8DIBYour credit card has been charged for $675.45.We would like to remind you that whenever you order tickets on our website you get a discount of 10%!Attached to this message is the purchase Invoice and the flight ticket.To use your ticket, simply print it on a color printed, and you are set to take off for the journey!Kind regards,AirTran Airways

X.w32/Mal.ENPk-westun

Subject: Western Union MTCN #2944962443

File Name: In776162.zip or RN67761263.zip

Hello!
Attention! The wire sent to Maksim Zverev, Moscow, Russia has been blocked by our security service.
Your credit card issuing bank has halted the transaction by the demand of the Federal Criminal Investigation Service (case No. 00683 since the recipient has been undergoing the international retrieval by the InterPol.
Please contact the closest Western Union office and make sure you have your ID card, the credit card that was used for making the payment, and the invoice file with you.
(The invoice file is attached to this message; please print it out and hand it to our agent.)
You can find the address of the closest Western Union agent on our website at www.westernunion.com
Thank you!

X.W32\Mal/EncPk-CZ

Subject: Statement of fees 2008/09
Attachment: Fees-2008_2009.zip

Please find attached a statement of fees as requested, this will be
posted today.

The accommodation is dealt with by another section and I have passed
your request on to them today.

Kind regards.

Adrian(varies)

X.W32\Mal/EncPk-ES

Subject: Statement of fees 2008/09
Attachment: Fees-2008_2009.zip


Please find attached a statement of fees as requested, this will be
posted today.

The accommodation is dealt with by another section and I have passed
your request on to them today.

Kind regards.

Max (varies)