Monday, 23 December 2013

"Hearing of your case in Court NR#6976" spam

I've had quite a few spams with a similar payload to this that I can't even Unzip. Go figure. But this one is an interesting variation.

Date:      Mon, 23 Dec 2013 10:05:38 -0500 [10:05:38 EST]
From:      Notice to Appear [support.6@jonesday.com]
Subject:      Hearing of your case in Court NR#6976

 Notice to Appear,
   Hereby you are notified that you have been scheduled to appear for
   your hearing that
   will take place in the court of Washington in January 9, 2014 at 10:00
   am.
   Please bring all documents and witnesses relating to this case with
   you to Court on your hearing date.
   The copy of the court notice is attached to this letter.
   Please, read it thoroughly.
   Note: If you do not attend the hearing the judge may hear the case in
   your absence.
   Yours truly,
   Alison Smith
   Clerk to the Court. 
There is an attachment Court_Notice_Jones_Day_Wa#8127.zip which in turn contains an executable Court_Notice_Jones_Day_Washington.exe which is presumably malicious, but I can't analyse it. The VirusTotal detection rate for the ZIP is 4/49.

Updated: a couple of other variants.. and the ISC have a report now too.

Date:      Mon, 23 Dec 2013 20:02:52 -0400 [19:02:52 EST]
From:      Notice to Appear [ticket_support.6@jonesday.com]
Subject:      Hearing of your case in Court NR#2682

 Notice to Appear,
   Hereby you are notified that you have been scheduled to appear for
   your hearing that
   will take place in the court of Washington in January 15, 2014 at
   09:00 am.
   Please bring all documents and witnesses relating to this case with
   you to Court on your hearing date.
   The copy of the court notice is attached to this letter.
   Please, read it thoroughly.
   Note: If you do not attend the hearing the judge may hear the case in
   your absence.
   Yours truly,
   Olivia Tailor
   Clerk to the Court.

--------------

Date:      Mon, 23 Dec 2013 11:21:46 -0700 [13:21:46 EST]
From:      Notice to Appear [ticket_support.8@jonesday.com]
Subject:      Notice of appearance in court NR#5365

 Notice to Appear,
   Hereby you are notified that you have been scheduled to appear for
   your hearing that
   will take place in the court of Washington in January 19, 2014 at
   09:00 am.
   Please bring all documents and witnesses relating to this case with
   you to Court on your hearing date.
   The copy of the court notice is attached to this letter.
   Please, read it thoroughly.
   Note: If you do not attend the hearing the judge may hear the case in
   your absence.
   Yours truly,
   Jennifer Tailor
   Clerk to the Court.
--------------

Date:      Mon, 23 Dec 2013 21:37:10 -0700 [12/23/13 23:37:10 EST]
From:      Notice to Appear [ticket_support.8@jonesday.com]
Subject:      Urgent court notice NR#31620

Notice to Appear,
   Hereby you are notified that you have been scheduled to appear for
   your hearing that
   will take place in the court of Washington in January 11, 2014 at
   11:00 am.
   Please bring all documents and witnesses relating to this case with
   you to Court on your hearing date.
   The copy of the court notice is attached to this letter.
   Please, read it thoroughly.
   Note: If you do not attend the hearing the judge may hear the case in
   your absence.
   Yours truly,
   Barbara Smith
   Clerk to the Court. 

Update 2 [31/12/2013]  in the past couple of days there has been a renewed spam run with some slightly different details. For some reason I cannot analyse the contents of the ZIP file, but you can be sure that it is malicious.

Sample emails:

Date:      Tue, 31 Dec 2013 06:45:59 -0700 [08:45:59 EST]
From:      Notice to Appear [support.7@lw.com]
Subject:      Urgent court notice No#14110

 Notice of appearance,
   Hereby you are informed that you are due in the court of New York
   on the 19 of January, 2014 at 10:00 am for the hearing of your case.
   You are kindly asked to prepare and bring the documents relating to
   the case to Court on the specified date.
   Please, download the copy of the court notice attached herewith to
   read the details.
   Note: The case may be heard by the judge in your absence if you do not
   come.
   Yours truly,
   Clark Murphy
   Clerk to the Court.

============================

Date:      Mon, 30 Dec 2013 17:03:29 -0400 [12/30/13 16:03:29 EST]
From:      Notice to Appear [aa.support933@jonesday.com]
Subject:      Notice of appearance in court NR#4723

 Notice to Appear,
   Hereby you are notified that you have been scheduled to appear for
   your hearing that
   will take place in the court of Washington in January 17, 2014 at
   10:00 am.
   Please bring all documents and witnesses relating to this case with
   you to Court on your hearing date.
   The copy of the court notice is attached to this letter.
   Please, read it thoroughly.
   Note: If you do not attend the hearing the judge may hear the case in
   your absence.
   Yours truly,
   Evie Mason
   Clerk to the Court.

============================

Date:      Mon, 30 Dec 2013 13:05:54 -0600 [12/30/13 14:05:54 EST]
From:      Notice to Appear [order.040@gibsondunn.com]
Subject:      Hearing of your case in Court No7712

 Notice to Appear in Court,
   This is to advise that you are required to attend
   the court of Los Angeles in January 11, 2014 for the hearing of your
   case.
   Please, kindly prepare and bring the documents related to this case to
   Court on the date mentioned above.
   Attendance is compulsory.
   The copy of the court notice is attached to this letter, please,
   download and read it thoroughly.
   ALLEN Walsh
   Clerk to the Court.

Sample attachments:
Court_Notice_Latham_and_Watkins__NY07550.zip
Court_Notice_Jones_Day_Wa#6152.zip
Court_Notice_Los_Angeles_No0216.zip

Update 3: [8/1/2014] another slight variation of this has gone out in the past day or so..

Date:      Mon, 06 Jan 2014 18:12:16 -0400 [01/06/14 17:12:16 EST]
From:      Court attendance notification [help151@perkinscoie.com]
Subject:      Court attendance notification #No597

 Pretrial notice,
   Hereby we inform that you are obliged to come as a defendant
   to The Court of Louisiana in February 23, 2014 at 10:30 a.m.
   for the hearing of your case of illegal software use.
   If necessary you have a right to obtain a lawyer for your protection.
   You are kindly asked to have an identity document with you.
   Personal appearance is compulsory.
   Please find the plaint note with more detailed case information
   attached to this letter and study it thoroughly.
   Court clerk,
   Donna Tailor

============================

Date:      Tue, 07 Jan 2014 10:56:43 -0500 [01/07/14 10:56:43 EST]
From:      Pretrial Notice [notice_support.6@alston.com]
Subject:      Judicial summons No8365

 Pretrial notice,
   Hereby we inform that you are obliged to come as a defendant
   to The Court of Atlanta in February 19, 2014 at 10:00 a.m.
   for the hearing of your case of illegal software use.
   If necessary you have a right to obtain a lawyer for your protection.
   You are kindly asked to have an identity document with you.
   Personal appearance is compulsory.
   Please find the plaint note with more detailed case information
   attached to this letter and study it thoroughly.
   Court clerk,
   Karen Mason

============================

Date:      Tue, 07 Jan 2014 A.D. 18:33:05 -0400 [01/07/14 17:33:05 EST]
From:      Pretrial Notice [support.3@alston.com]
Subject:      Judicial summons No3877

 Pretrial notice,
   Hereby we inform that you are obliged to come as a defendant
   to The Court of Atlanta in February 20, 2014 at 10:00 a.m.
   for the hearing of your case of illegal software use.
   If necessary you have a right to obtain a lawyer for your protection.
   You are kindly asked to have an identity document with you.
   Personal appearance is compulsory.
   Please find the plaint note with more detailed case information
   attached to this letter and study it thoroughly.
   Court clerk,
   Mary Smith

============================

Date:      Wed, 08 Jan 2014 02:54:03 -0500 [02:54:03 EST]
From:      Pretrial Notice [notice_support.8@alston.com]
Subject:      Notice of appearance in court No96162

 Pretrial notice,
   Hereby we inform that you are obliged to come as a defendant
   to The Court of Atlanta in February 12, 2014 at 09:00 a.m.
   for the hearing of your case of illegal software use.
   If necessary you have a right to obtain a lawyer for your protection.
   You are kindly asked to have an identity document with you.
   Personal appearance is compulsory.
   Please find the plaint note with more detailed case information
   attached to this letter and study it thoroughly.
   Court clerk,
   Alison Tailor

Sample attachment names:
Plaint_Note_Document_06_01#0478.zip
Plaint Note_06_01_2014_No2964.zip
Plaint_Note_Document_06_01#1619.zip
Plaint_Note_Document_06_01#6017.zip

This malware is detected by 28/48 scanners at VirusTotal, but the Malwr analysis of what it does seems pretty inconclusive.

73 comments:

Boss61 said...
This comment has been removed by the author.
Marla said...

I just got the same thing but mine is January 16, 2013 at 9:00am. and the attachment says Court_Notice_Jones_Day_Wa#0914.zip

Marla said...

I just got the same thing but mine is January 16, 2013 at 9:00am. and the attachment says Court_Notice_Jones_Day_Wa#0914.zip

John Barry said...

Hi, I just received the same email, dated today, December 23, 2013.

Avery H said...

Same, mine is for jan 11 @ 10 AM
#4841.zip

jhall530 said...

Just got this spam also.

nathans226 said...

It is a scam. The attachment is a virus. Besides, if you were being taken to court, the court would not serve you via email.

Rick Carufel said...

I've received three of these today. I tried to email them back and the email was undeliverable.

Vidhi Khanna said...

I got the same email for same date. Just the sender's first name was a variation in my case - "Susan Smith"

Floyd Henderson said...

I too tried to send a scathing reply to these morons about their attempt to spread a virus or trojan, only to receive a mailer daemon reply from yahoo. To check the legitimacy of these e-mails, all you need do is try to reply. If you can't, it's a hoax.

M.D. Johns/New Communications said...

I have also received two of these notices today. Annoying!

Jill Underhill said...

I got two of these today. Do not!! open the attachment!!!

Stubborn Breeze said...

I received the exact same email today. After checking the IP it comes from Sterling, Virginia using Comcast as their provider. I forwarded it to Comcast. You can forward it to abuse@comcast.com.

Scott Visnich said...

I like a Dummy opened it.(my son happens to be in jail in Washington)
there was nothing in the zip file.
I ran a norton anti virus and malware full scan. they found nothing. Am I safe?

PC.Tech said...

Same stuff D.D.: https://isc.sans.edu/diary.html?storyid=17279
Last Updated: 2013-12-24 00:54:04
Keywords: scam spam malware
.

Claudio Sanft said...

joining the team. Received two of these since yesterday

Bob said...

You've received 1 or 2... I'm being hammered with >60 of them every day and I'm fed up with them. I report every one of these spams through Spam Cop.

Mirage said...

SO UH HI GUYS
HEH
HEHEH
I ACTUALLY OPENED THE FILE

long story short I got a really weird virus that I have not seen before, I'm literally only here because after cleaning the virus up (I think) it was so weird and the only traces left were this email that I'm pretty sure I got the virus from.

I dunno if this interests you guys, I don't really know much about this stuff so maybe it's routine. But all the viruses and such I've delt with in the past were rudimentary just some file in your startup files with some name you can just google or something like that, no real problems removing them that can't be solved with google or just having an antivirus. So what started happening was MSE would find a threat, I think it would label it as a keylogger, the filename being a strange meaningless string of characters, in one of two places:
windows/syswow64/*random*.exe
or
users/****/appdata/roaming/*random*/*random*.exe
I did not notice any pattern in the names until I noticed toomepesy.exe repeating in the first category, in syswow64. If you google that you get nothing, or at least as of this posting: http://imgur.com/vjYdie1
I also notice now in retrospect looking through the items I removed from my startup files that there were only a handful of files.

So MSE would kill this file, and it would prompt me to restart to finish the cleanup. After half an hour of not restarting, trying to restart ASAP, letting it run for a while, or whatever, basically I learned that nothing stopped the train of these files appearing in these places then being killed by MSE. I noticed also that in my startup files there were a few files that should not be there, with some weird names too:
Amrie , Manufacturer Unknown , C:\Users\****\AppData\Roaming\Benoug\irteo.exe
Aropa , Manufacturer Unknown , C:\Users\****\AppData\Roaming\Xuwaaxo\vivau.exe
Beaqliozqoxo , Manufacturer Unknown, C:\Users\****\AppData\Roaming\Dysyxyro\ywuqado.exe
Itwedeuxveoqcii , Manufacturer Unknown , C:\Users\****\AppData\Roaming\Ygylqoop\ahuwobz.exe
manwlced , Manufacturer Unknown , C:\Users\****\AppData\Local\aaqernri.exe
Umugle , Manufacturer Unknown , C:\Users\****\AppData\Roaming\Feuqafih\azxoa.exe
Ylsakifun , Manufacturer Unknown , C:\Users\****\AppData\Roaming\Myukxo\zuofsou.exe
(you can see why I only just now noticed that there were a handful of files and not some constantly shifting random filenames)

So anyway I start in safe mode, remove the items from startup and also delete them and everything else in their directories that should not have been there, and let MSE kill whatever it wanted to (it found nothing at this point). As of now I'm pretty hopeful it is gone but this full scan (with malwarebytes) takes a few hours to finish.

So I was pretty curious about this particularly because google yielded no results on the filenames... I couldn't find anything that way so I went to the place I knew I got the virus, this email. My version of the email had a .rar and uh I'm not quite so clear with my memory but I was pretty sure I didn't do the double click on the file, the courtnoticeblahblah.rar, and I sure as hell would not run any executable in that kind of circumstance. I hear you can have double extensions and make .exe look like .rar or something? I have extensions always displayed so I'm not really sure how this happened but I honestly have not had a virus on any of my own systems for years so I'm pretty sure it came from this email since I was messing around with it like an idiot. So I googled parts of the email and found you guys.

So yeah, uh, it is indeed malware. Just thought I'd confirm.

Aakash Kochar said...

I have also received the same mail.

Pat Bellew said...

Mine says to appear in "The Court of New York" (City? State? not specified)on the 17th. Fortunately I didn't open the attachment!

NoGot said...

I also got three from State of New York. Notice to Appear in Court, and Urgent Court Notice. The emails were small variations of those mentioned here. They change on digit at a time so they can tell which variant is working best or least. Like Amazon says; More on the way!

Dwight Barksdale said...

Any known fix for this? So far we have not been able to overcome this devil! Please advise.

swags0 said...

yea I stupidly opened it and now it says I don't have enough memory to run windows nt and I have window xp. can't get past start up menu any suggestions

swags0 said...

yea I stupidly opened it and now it says I don't have enough memory to run windows nt and I have window xp. can't get past start up menu any suggestions

Graeme Glen said...

I opened it because I love a good scam attempt. Computer got weird. Restarted it and all seems good.

Still, if the purpose of the scam is not to try to take your cash with some "pay now and it will all go away" deal, then what is it??

Must be a virus.

RGaines said...

I received 3 of these emails in the past 3 days. The good news is that my filter blocked it.

RGaines said...

Received 3 of these in the past 3 days. Annoying.

jim said...

I would give anything to catch one of these low life's that send out this stuff. I guarantee it would be the last time he ever even thought about posting something like this. If I only had one wish in life it would be to meet one of these a** holes.

donnasally said...

I just got one today and got worried because my former employer is based out of Chicago & I filed a complaint against them back in May. Anyway, the email it came from just said Notice to Appear but when I double-clicked that it was support7@mwe.com. mwe.com appears to be a real website of a law firm. Anyone else get one for Chicago from mwe? It had an attachment and was just as described like the others mentioned here. Is mine most likely a scam, too? The attachment is just symbols and garbled letters.

ROYGBIV said...

Mine: "Notice to Appear (ticket_support.5@mwe.com" was to appear" "in Chicago Court for the hearing of you case in January 11, 2014." Did not open attachment.

Dee Flower said...

Just got this said Jan 14th at Washington from Emma Mason. Annoying as hell

Gampa and Gamma said...

I don't understand how people can just open this stuff without checking on it first. Google is such a good resource. I googled this FIRST, found all these comments, then went back a deleted the emails. Problem solved. Check Google FIRST, if you don't find anything then go to the email.

Gampa and Gamma said...
This comment has been removed by the author.
bengalmom said...

I received one from support.7@mwe.com for a Chicago hearing. Did not open. Thinking it is a scam.

Hank said...

I've received 3 of them today alone and after reading the first one, it was clear that whoever sent it out has a very limited grasp of the English language and even less knowledge of how the US court system really works.

How on earth could anyone actually fall for this and open the attachment?

Unknown said...

run malwarebytes from a thumb drive. Install it onto the thumbdrive from a safe computer first.

Nevena Srnić said...

I am in Serbia,and I got this too, and didn't opoen it, because I knew that something is wrong,because why would I go to Washington, I have newer been there...

Unknown said...

Like Nevena, I am also not Stateside. Seemed pretty obviously a virus-bearer, but like Gampa, I googled just to be sure. Would love to know who to report it to so these folks get caught. I absolutely cannot fathom what pleasure there could be in ruining computer files of random strangers...

Deborah Ames said...

I just received today...who is Evie Mason - Clerk to the Court?

Is she THAT stupid to actually SIGN her name to the email?

Glad I didn't open...just had a gut feeling that for once paid off!

:)

azella nesbitt said...

wow i just received one last week and it almost put a virus on my computer and then i get two on Saturday one from St. Louis and one from Chicago Courts, please dont open them! You cant send a reply then your computer will start acting up! Besides you will never be notified by e-mail!

BizCrazy2 said...

I got the same one this morning but it is from Louisiana Court... These people are messed up. Nothing like getting a Court Notification on a Monday Morning. Fortunately I have Excellent Software on my computer and it refused to open the link due to Phishing Scam Notifications. Obviously it is not real. They didn't have a name or a case Number.

non sibi sed patriae said...

Mine was said notice to appear in the circuit court of Chicago. Has a case number and date to appear of Jan. 18 at 0900. I was curious as I had gotten a speeding ticket south of Chicago and the due date to pay the fine was the 18th but it wasn't even in cook county or Chicago area. My anti virus said it was a Trojan not seen by members of the forum or by the antivirus people either. It did say it was also a key logger so I copied the whole email and found the real clerk of the county and sent it to them with the explanation that I had received it supposedly from them.havent got anything back yet

non sibi sed patriae said...

Mine said I am summoned to appear in circuit court in Chicago. It had a case number and had a name I don't remember as clerk of the county. I was curious as had speeding ticket south of there but not in cook county when I tried to find it there was no such thing in chicagos court

Judith Turner said...

I got one today and laughed my socks off!! mainly because i have to attend the court in Loiusiana and i happen to live in AUSTRALIA - long way to go - wonder if they'll send me the air fare - they must think we were born yesterday!!!

Mark Florida said...

Same here Jan 13th 2014

wyld said...

Got one today for appearing in San Francisco! Anyone else?

Also there appears to be a slight variation on the appearance#. The one sent to me didn't start with NR#, just N# followed by four digits-three digits. EXAMPLE: N#0000-000 Anyone else get that?

Does anyone know if there is a way to report this to the actual courts that are being used for the scam? It'd be nice to send some REAL legal people after these scammers!

jlsyourtube said...

Jimmie - I received an email like this also.

Court attendance notification No7165

Mandatory Court Appearance
To Me
Today at 3:49 AM
Mandatory court appearance.

Hereby we inform you about the hearing of your case that will take place in the Court of Cobb County, State of Georgia in February 24, 2014, at 11:30 a.m.

Hearing subject: use of pirated software.
Your attendance is mandatory.
No adjournments will be granted.

The judicial notice with all details is attached to this mail.

It is advised to be thoroughly examined in order
you could properly prepare for the hearing.

Judicial representative,
Susan Mason
1 Attachment
Judicial_Notice_14_01_2014_No_6183.zipDownload
Reply, Reply All or Forward | More
by nana817 on

Susan said...

Has anyone else been receiving phone calls too? We've gotten several phone calls and today was the first email...

Kevin Khair said...

I got one and I foolishly opened it on my.phone. Now what? What do I do now?

JAK said...

Got one today for appearing in NOW-Y! ? BUT i didn't open attachment.

Thanks for help

Irish Miss said...

Mine was for Atlanta, also. It went to spam and the attachment was removed as it contained malware.

Jim Zy said...

just got one this morning, from alston.com

has one attachment, i did not open it:

Plaint_Note _16_01_14_Copy_985.zip (84.2 KB)

x-store-info:4r51+eLowCe79NzwdU2kR3P+ctWZsO+J
Authentication-Results: hotmail.com; spf=softfail (sender IP is 12.205.205.72) smtp.mailfrom=information@alston.com; dkim=none header.d=alston.com; x-hmca=fail header.id=information@alston.com
X-SID-PRA: information@alston.com
X-AUTH-Result: FAIL
X-SID-Result: FAIL
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD02
X-Message-Info: 11chDOWqoTmjqhOzvWWho/vK8oL2x1FIoEm0Tn+r3D4Vy8IHo2wUnsyrGzDvKeqkJtMeTZY+Nmsf8P9jABL0t17cmD7//fhbmiY1q6wmXvgxnZHlVyRreDnMBIHVGJhSAIYGqgA2imBuWSjQAdQsCx10ErM7COxXQDbI5Sd4/grvIzjDME1r9Tv/eAjJL+tpW73QRq3pQlrBaGuZ/tgppYHRTnkMdklr
Received: from alston.com ([12.205.205.72]) by SNT0-MC1-F15.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Thu, 16 Jan 2014 12:12:13 -0800
Message-ID: <000e01cf12f7a20c2eae7fc8050a@NHLIBT>
From: "Pretrial Notice"
To:
Subject: Court attendance notification No8101
Date: Thu, 16 Jan 2014 14:15:00 -0500
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_000B_01CF12C5.5770EEF0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: XimianEvolution1.4.6
X-MimeOLE: Produced By XimianEvolution1.4.6
Return-Path: information@alston.com
X-OriginalArrivalTime: 16 Jan 2014 20:12:13.0974 (UTC) FILETIME=[3EF8AB60:01CF12F7]

This is a multi-part message in MIME format.

------=_NextPart_000_000B_01CF12C5.5770EEF0
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_000C_01CF12C5.5770EEF0"


------=_NextPart_001_000C_01CF12C5.5770EEF0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Pretrial notice,

Hereby we inform that you are obliged to come as a defendant
to The Court of Atlanta in February 20, 2014 at 11:00 a.m.
for the hearing of your case of illegal software use.
If necessary you have a right to obtain a lawyer for your protection.
You are kindly asked to have an identity document with you.
Personal appearance is compulsory.

Please find the plaint note with more detailed case information
attached to this letter and study it thoroughly.

Court clerk,
Sophie Tailor

Jim Zy said...

DO NOT OPEN THE EMAIL ATTACHMENT, A PROPER COURT SUMMON WILL NOT COMES IN THE FORM OF EMAIL, THEY WILL BE MAILED TO YOU IN PLAIN OLD PAPER FORM............AGAIN.....DO NO OPEN THOSE ATTACHMENT.

Lemon Lady said...

I am getting emai, which started with phone calls, and tons of it. Usually the calls are from area code 601, sometimes different, but very rarely. It is so funny, they say, on the voice mail (I never answer), that they need my address and phone no. so they can serve me. Hahaha. I keep blocking the phone nos. and they keep changing them. With the ever increasing emails, it is getting really irritating. Besides not contacting you by email, there would be a specific court and judge named, not 'Court of New York' lol. Anyway, I heard, with the phone calls, that they try to get your money, after much fear mongering, 'to defend your case', presumably when they hit upon someone who coincidentally has something legal going on. There are various govmt depts you can report to, although I doubt anything would happen, but most strange I must say; not the usual malware/virus/scam, esp as it is mixed with phone calls, which is indeed weird as I got the phone calls first, then the email, which really makes you want to open it, of course. I get at least 1 scam of come sort every day, but every email that comes from someone I don't know goes to my Spamblocker on the email server, which I sift through before POPing down to my mail client They often catch these things and remove the bad content but not in this case; guess I should send it to them...argh.

Lemon Lady said...

Wow, be careful. I was going to send it to my email provider, but the headers would not appear, so I tried View Page Source, out of curiosity as much as giving them information and bam, virus software caught it, and it was one of the files mentioned in this blog. I had not downloaded it or opened the attachment...nothing. I've viewed a lot of page source in my time but it never executed anything...scary.

Yum Chi said...

You can fix the virus, if you have accidentally opened the file, by downloading and running Malwarebytes. You can use the 14-day trial to perform a quick scan on your computer to find any corrupted files created from the virus. After about 1-2 hours, the scan should finish and you should be able to delete all corrupted files, removing the virus. Upon removal, you will be prompted to restart your computer! Malwarebytes worked for me, but I'm not sure it will for everyone else!

Traveller said...


Notice to Appear,

Hereby you are notified that you have been scheduled to appear for your hearing that will take place in the court of
London in January 31, 2014 at 10:00 am.

Please bring all documents and witnesses relating to this case with you to Court on your hearing date.

The copy of the court notice is attached to this letter.
Please, read it thoroughly.

Note: If you do not attend the hearing the judge may hear the case in your absence.

Yours truly,
L.McNamara
Clerk to the Court.

gail hart said...

New notice is for eviction, good luck on this one as I rent from my parents who own the house LOL

Mariana Azambuja said...

Hi! I just got one saying that I should move out of my property, that I would be forced to relocate if I didn't move... bla bla bla... I have been receiving this e-mails for some time now..

jmedia said...

i just got it this morning, unfortunately,i opened it. so now i got in virus. how can i remove this virus... PLEASE?

rmays80 said...

I received 2 if these. What are they? And why are they sending them?

Bob said...

Recd 2 of these the past week. One from court of Anaheim Ca, the other from Modesto Ca where I have never been. Googled it and trashed it.

Ahmad Mazlumyar said...


I got 3 of these emails in the past 3 months, but thankfully I couldn't open the attachment lol its annoying



Notice to Appear,

Please bring all documents and witnesses relating to this case with you to Court on your hearing date.
The copy of the court notice is attached to this letter.


Truly yours,
Clerk to the Court.
Barbara Tailor

kelly duffy said...

yes , I just got one May 09, 2014..Notice to Appear..Clerk of Courts Alison Smith files Attached..files couldn't open Scared me..I didnt know what was going on ..so I called the Court house Clerk of Courts they said they do not email

kelly duffy said...

just now received another email..Notice to Appear Urgent...from Linda Mason clerk of courts...support423@yellowpage...files attached...ThankGod this site here I was hone crazy tryin figure out where to Appear

Diane Cawley said...

Maybe if someone emailed the firm of lawyers who's name appears in the email address they would have the resources and the incentive to limit these emails.

speakingout said...

just received this on May 30 2014 dated for May 29, 2014. I know my local politcs and new it was crap. So I looked it up and found this site. Thought I would let you know it's still circulating.

Simanchal Panigrahi said...

Hi,

I am also got the mail like this yesterday at Morning 8.44 AM and same if I try to forward to some one it bounce and the attchement shows viruses in google what shoild i do is the mail is real one but i did not know what i did exactly can someone help me..

Shelly Coulter said...

I know your post is old, but omg I'm getting so many of these to my cell phone its driving me nuts. Did u find a way of stopping it?

Kureusviewr said...

received this "notice to appear in court" today . . .

To prevent these messages from ever entering your systems,
(For those using Outlook.com)

Use your RIGHT mouse button, click on the message title and a drop down window appears, Select, "view message source". Click on that and a new tab opens with all the HTML code for that message. Look along the top for the code that has the senders address. for me it was, "custservice806@probateadministrationlawyers.com"

Highlight this and copy. Go back to your email tab and click on the gear at the upper right hand corner of the email window. A drop down window appears, select "options". This opens a new view. Look for the title "preventing junk email". and select "safe and blocked senders".
Click on the blocked senders link. A new view opens. Paste the copied address in the text field and click "add to list".

This action will block that sender. close this tab, refresh your junk folder to show the word, "empty" in the blue band and click empty without ever selecting the message.

Dave Brown said...

Hi all, very interesting, I thought it was a scam at first looking to blackmail those gullible enough to let this thing loose. Tactic change from the authors I think as mine came from staten-island-lawyers.com - a site that is hosted for free by godaddy.com. Mine was about illegal software use, which I know I don't have & have to attend Killeen (Texas?) in Sept. Looks like this thing is starting the rounds again

Lori Mooney said...

Got one from the Circuit Court of Lakeland Florida

Did a reverse domain registrant lookup on WHOIS.

for the email addy attached to the scam email

"mail968@the-consumer-lawyers.com"


The body of the email itself:

"...As a defendant you have been scheduled to attend the hearing in the
Court of Lakeland.

Hearing date: 3 September 2014
Hearing time: 11:00 a.m.
Hearing subject: illegal use of software

Prior to the court thoroughly study the plaint note in the attachment
to this mail.

Sincerely,
Court agent,
Barbara Tailor

The results of abuse history profile, originated in Newark, email registrant is currently registered in Ft. Lauderdale:

Domain Name: the-consumer-lawyers.com
Registry Domain ID: 1565966753_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.moniker.com
Registrar URL: http://www.moniker.com
Updated Date: 2014-08-26T09:08:12.0Z
Creation Date: 2009-08-17T20:14:06.0Z
Registrar Registration Expiration Date: 2015-08-17T20:14:06.0Z
Registrar: Moniker Online Services LLC
Registrar IANA ID: 228
Registrar Abuse Contact Email:
Registrar Abuse Contact Phone: +1.9546071294
Domain Status: clientDeleteProhibited
Domain Status: clientTransferProhibited
Registry Registrant ID: WP-4
Registrant Name: Moniker Privacy Services
Registrant Organization: Moniker Privacy Services
Registrant Street: 2320 NE 9th St, Second Floor
Registrant City: Fort Lauderdale
Registrant State/Province: FL
Registrant Postal Code: 33304
Registrant Country: US
Registrant Phone: +1.8006886311
Tech Organization: Moniker Privacy Services
Tech Street: 2320 NE 9th St, Second Floor
Tech City: Fort Lauderdale
Tech Postal Code: 33304
Tech State/Province: FL
Tech Country: US
Tech Phone: +1.8006886311

Maj Balakrishnan TK said...

I got a similar notice on 06 Nov 2014, but the subject line it is written to attend court, but attached couldn't open. Balakrishnan