Monday 23 December 2013

"Hearing of your case in Court NR#6976" spam

I've had quite a few spams with a similar payload to this that I can't even Unzip. Go figure. But this one is an interesting variation.

Date:      Mon, 23 Dec 2013 10:05:38 -0500 [10:05:38 EST]
From:      Notice to Appear [support.6@jonesday.com]
Subject:      Hearing of your case in Court NR#6976

 Notice to Appear,
   Hereby you are notified that you have been scheduled to appear for
   your hearing that
   will take place in the court of Washington in January 9, 2014 at 10:00
   am.
   Please bring all documents and witnesses relating to this case with
   you to Court on your hearing date.
   The copy of the court notice is attached to this letter.
   Please, read it thoroughly.
   Note: If you do not attend the hearing the judge may hear the case in
   your absence.
   Yours truly,
   Alison Smith
   Clerk to the Court. 
There is an attachment Court_Notice_Jones_Day_Wa#8127.zip which in turn contains an executable Court_Notice_Jones_Day_Washington.exe which is presumably malicious, but I can't analyse it. The VirusTotal detection rate for the ZIP is 4/49.

Updated: a couple of other variants.. and the ISC have a report now too.

Date:      Mon, 23 Dec 2013 20:02:52 -0400 [19:02:52 EST]
From:      Notice to Appear [ticket_support.6@jonesday.com]
Subject:      Hearing of your case in Court NR#2682

 Notice to Appear,
   Hereby you are notified that you have been scheduled to appear for
   your hearing that
   will take place in the court of Washington in January 15, 2014 at
   09:00 am.
   Please bring all documents and witnesses relating to this case with
   you to Court on your hearing date.
   The copy of the court notice is attached to this letter.
   Please, read it thoroughly.
   Note: If you do not attend the hearing the judge may hear the case in
   your absence.
   Yours truly,
   Olivia Tailor
   Clerk to the Court.

--------------

Date:      Mon, 23 Dec 2013 11:21:46 -0700 [13:21:46 EST]
From:      Notice to Appear [ticket_support.8@jonesday.com]
Subject:      Notice of appearance in court NR#5365

 Notice to Appear,
   Hereby you are notified that you have been scheduled to appear for
   your hearing that
   will take place in the court of Washington in January 19, 2014 at
   09:00 am.
   Please bring all documents and witnesses relating to this case with
   you to Court on your hearing date.
   The copy of the court notice is attached to this letter.
   Please, read it thoroughly.
   Note: If you do not attend the hearing the judge may hear the case in
   your absence.
   Yours truly,
   Jennifer Tailor
   Clerk to the Court.
--------------

Date:      Mon, 23 Dec 2013 21:37:10 -0700 [12/23/13 23:37:10 EST]
From:      Notice to Appear [ticket_support.8@jonesday.com]
Subject:      Urgent court notice NR#31620

Notice to Appear,
   Hereby you are notified that you have been scheduled to appear for
   your hearing that
   will take place in the court of Washington in January 11, 2014 at
   11:00 am.
   Please bring all documents and witnesses relating to this case with
   you to Court on your hearing date.
   The copy of the court notice is attached to this letter.
   Please, read it thoroughly.
   Note: If you do not attend the hearing the judge may hear the case in
   your absence.
   Yours truly,
   Barbara Smith
   Clerk to the Court. 

Update 2 [31/12/2013]  in the past couple of days there has been a renewed spam run with some slightly different details. For some reason I cannot analyse the contents of the ZIP file, but you can be sure that it is malicious.

Sample emails:

Date:      Tue, 31 Dec 2013 06:45:59 -0700 [08:45:59 EST]
From:      Notice to Appear [support.7@lw.com]
Subject:      Urgent court notice No#14110

 Notice of appearance,
   Hereby you are informed that you are due in the court of New York
   on the 19 of January, 2014 at 10:00 am for the hearing of your case.
   You are kindly asked to prepare and bring the documents relating to
   the case to Court on the specified date.
   Please, download the copy of the court notice attached herewith to
   read the details.
   Note: The case may be heard by the judge in your absence if you do not
   come.
   Yours truly,
   Clark Murphy
   Clerk to the Court.

============================

Date:      Mon, 30 Dec 2013 17:03:29 -0400 [12/30/13 16:03:29 EST]
From:      Notice to Appear [aa.support933@jonesday.com]
Subject:      Notice of appearance in court NR#4723

 Notice to Appear,
   Hereby you are notified that you have been scheduled to appear for
   your hearing that
   will take place in the court of Washington in January 17, 2014 at
   10:00 am.
   Please bring all documents and witnesses relating to this case with
   you to Court on your hearing date.
   The copy of the court notice is attached to this letter.
   Please, read it thoroughly.
   Note: If you do not attend the hearing the judge may hear the case in
   your absence.
   Yours truly,
   Evie Mason
   Clerk to the Court.

============================

Date:      Mon, 30 Dec 2013 13:05:54 -0600 [12/30/13 14:05:54 EST]
From:      Notice to Appear [order.040@gibsondunn.com]
Subject:      Hearing of your case in Court No7712

 Notice to Appear in Court,
   This is to advise that you are required to attend
   the court of Los Angeles in January 11, 2014 for the hearing of your
   case.
   Please, kindly prepare and bring the documents related to this case to
   Court on the date mentioned above.
   Attendance is compulsory.
   The copy of the court notice is attached to this letter, please,
   download and read it thoroughly.
   ALLEN Walsh
   Clerk to the Court.

Sample attachments:
Court_Notice_Latham_and_Watkins__NY07550.zip
Court_Notice_Jones_Day_Wa#6152.zip
Court_Notice_Los_Angeles_No0216.zip

Update 3: [8/1/2014] another slight variation of this has gone out in the past day or so..

Date:      Mon, 06 Jan 2014 18:12:16 -0400 [01/06/14 17:12:16 EST]
From:      Court attendance notification [help151@perkinscoie.com]
Subject:      Court attendance notification #No597

 Pretrial notice,
   Hereby we inform that you are obliged to come as a defendant
   to The Court of Louisiana in February 23, 2014 at 10:30 a.m.
   for the hearing of your case of illegal software use.
   If necessary you have a right to obtain a lawyer for your protection.
   You are kindly asked to have an identity document with you.
   Personal appearance is compulsory.
   Please find the plaint note with more detailed case information
   attached to this letter and study it thoroughly.
   Court clerk,
   Donna Tailor

============================

Date:      Tue, 07 Jan 2014 10:56:43 -0500 [01/07/14 10:56:43 EST]
From:      Pretrial Notice [notice_support.6@alston.com]
Subject:      Judicial summons No8365

 Pretrial notice,
   Hereby we inform that you are obliged to come as a defendant
   to The Court of Atlanta in February 19, 2014 at 10:00 a.m.
   for the hearing of your case of illegal software use.
   If necessary you have a right to obtain a lawyer for your protection.
   You are kindly asked to have an identity document with you.
   Personal appearance is compulsory.
   Please find the plaint note with more detailed case information
   attached to this letter and study it thoroughly.
   Court clerk,
   Karen Mason

============================

Date:      Tue, 07 Jan 2014 A.D. 18:33:05 -0400 [01/07/14 17:33:05 EST]
From:      Pretrial Notice [support.3@alston.com]
Subject:      Judicial summons No3877

 Pretrial notice,
   Hereby we inform that you are obliged to come as a defendant
   to The Court of Atlanta in February 20, 2014 at 10:00 a.m.
   for the hearing of your case of illegal software use.
   If necessary you have a right to obtain a lawyer for your protection.
   You are kindly asked to have an identity document with you.
   Personal appearance is compulsory.
   Please find the plaint note with more detailed case information
   attached to this letter and study it thoroughly.
   Court clerk,
   Mary Smith

============================

Date:      Wed, 08 Jan 2014 02:54:03 -0500 [02:54:03 EST]
From:      Pretrial Notice [notice_support.8@alston.com]
Subject:      Notice of appearance in court No96162

 Pretrial notice,
   Hereby we inform that you are obliged to come as a defendant
   to The Court of Atlanta in February 12, 2014 at 09:00 a.m.
   for the hearing of your case of illegal software use.
   If necessary you have a right to obtain a lawyer for your protection.
   You are kindly asked to have an identity document with you.
   Personal appearance is compulsory.
   Please find the plaint note with more detailed case information
   attached to this letter and study it thoroughly.
   Court clerk,
   Alison Tailor

Sample attachment names:
Plaint_Note_Document_06_01#0478.zip
Plaint Note_06_01_2014_No2964.zip
Plaint_Note_Document_06_01#1619.zip
Plaint_Note_Document_06_01#6017.zip

This malware is detected by 28/48 scanners at VirusTotal, but the Malwr analysis of what it does seems pretty inconclusive.

73 comments:

  1. This comment has been removed by the author.

    ReplyDelete
  2. I just got the same thing but mine is January 16, 2013 at 9:00am. and the attachment says Court_Notice_Jones_Day_Wa#0914.zip

    ReplyDelete
  3. I just got the same thing but mine is January 16, 2013 at 9:00am. and the attachment says Court_Notice_Jones_Day_Wa#0914.zip

    ReplyDelete
  4. Hi, I just received the same email, dated today, December 23, 2013.

    ReplyDelete
  5. Same, mine is for jan 11 @ 10 AM
    #4841.zip

    ReplyDelete
  6. It is a scam. The attachment is a virus. Besides, if you were being taken to court, the court would not serve you via email.

    ReplyDelete
  7. I've received three of these today. I tried to email them back and the email was undeliverable.

    ReplyDelete
  8. I got the same email for same date. Just the sender's first name was a variation in my case - "Susan Smith"

    ReplyDelete
  9. I too tried to send a scathing reply to these morons about their attempt to spread a virus or trojan, only to receive a mailer daemon reply from yahoo. To check the legitimacy of these e-mails, all you need do is try to reply. If you can't, it's a hoax.

    ReplyDelete
  10. I have also received two of these notices today. Annoying!

    ReplyDelete
  11. I got two of these today. Do not!! open the attachment!!!

    ReplyDelete
  12. I received the exact same email today. After checking the IP it comes from Sterling, Virginia using Comcast as their provider. I forwarded it to Comcast. You can forward it to abuse@comcast.com.

    ReplyDelete
  13. I like a Dummy opened it.(my son happens to be in jail in Washington)
    there was nothing in the zip file.
    I ran a norton anti virus and malware full scan. they found nothing. Am I safe?

    ReplyDelete
  14. Same stuff D.D.: https://isc.sans.edu/diary.html?storyid=17279
    Last Updated: 2013-12-24 00:54:04
    Keywords: scam spam malware
    .

    ReplyDelete
  15. joining the team. Received two of these since yesterday

    ReplyDelete
  16. You've received 1 or 2... I'm being hammered with >60 of them every day and I'm fed up with them. I report every one of these spams through Spam Cop.

    ReplyDelete
    Replies
    1. I know your post is old, but omg I'm getting so many of these to my cell phone its driving me nuts. Did u find a way of stopping it?

      Delete
  17. SO UH HI GUYS
    HEH
    HEHEH
    I ACTUALLY OPENED THE FILE

    long story short I got a really weird virus that I have not seen before, I'm literally only here because after cleaning the virus up (I think) it was so weird and the only traces left were this email that I'm pretty sure I got the virus from.

    I dunno if this interests you guys, I don't really know much about this stuff so maybe it's routine. But all the viruses and such I've delt with in the past were rudimentary just some file in your startup files with some name you can just google or something like that, no real problems removing them that can't be solved with google or just having an antivirus. So what started happening was MSE would find a threat, I think it would label it as a keylogger, the filename being a strange meaningless string of characters, in one of two places:
    windows/syswow64/*random*.exe
    or
    users/****/appdata/roaming/*random*/*random*.exe
    I did not notice any pattern in the names until I noticed toomepesy.exe repeating in the first category, in syswow64. If you google that you get nothing, or at least as of this posting: http://imgur.com/vjYdie1
    I also notice now in retrospect looking through the items I removed from my startup files that there were only a handful of files.

    So MSE would kill this file, and it would prompt me to restart to finish the cleanup. After half an hour of not restarting, trying to restart ASAP, letting it run for a while, or whatever, basically I learned that nothing stopped the train of these files appearing in these places then being killed by MSE. I noticed also that in my startup files there were a few files that should not be there, with some weird names too:
    Amrie , Manufacturer Unknown , C:\Users\****\AppData\Roaming\Benoug\irteo.exe
    Aropa , Manufacturer Unknown , C:\Users\****\AppData\Roaming\Xuwaaxo\vivau.exe
    Beaqliozqoxo , Manufacturer Unknown, C:\Users\****\AppData\Roaming\Dysyxyro\ywuqado.exe
    Itwedeuxveoqcii , Manufacturer Unknown , C:\Users\****\AppData\Roaming\Ygylqoop\ahuwobz.exe
    manwlced , Manufacturer Unknown , C:\Users\****\AppData\Local\aaqernri.exe
    Umugle , Manufacturer Unknown , C:\Users\****\AppData\Roaming\Feuqafih\azxoa.exe
    Ylsakifun , Manufacturer Unknown , C:\Users\****\AppData\Roaming\Myukxo\zuofsou.exe
    (you can see why I only just now noticed that there were a handful of files and not some constantly shifting random filenames)

    So anyway I start in safe mode, remove the items from startup and also delete them and everything else in their directories that should not have been there, and let MSE kill whatever it wanted to (it found nothing at this point). As of now I'm pretty hopeful it is gone but this full scan (with malwarebytes) takes a few hours to finish.

    So I was pretty curious about this particularly because google yielded no results on the filenames... I couldn't find anything that way so I went to the place I knew I got the virus, this email. My version of the email had a .rar and uh I'm not quite so clear with my memory but I was pretty sure I didn't do the double click on the file, the courtnoticeblahblah.rar, and I sure as hell would not run any executable in that kind of circumstance. I hear you can have double extensions and make .exe look like .rar or something? I have extensions always displayed so I'm not really sure how this happened but I honestly have not had a virus on any of my own systems for years so I'm pretty sure it came from this email since I was messing around with it like an idiot. So I googled parts of the email and found you guys.

    So yeah, uh, it is indeed malware. Just thought I'd confirm.

    ReplyDelete
  18. I have also received the same mail.

    ReplyDelete
  19. Mine says to appear in "The Court of New York" (City? State? not specified)on the 17th. Fortunately I didn't open the attachment!

    ReplyDelete
  20. I also got three from State of New York. Notice to Appear in Court, and Urgent Court Notice. The emails were small variations of those mentioned here. They change on digit at a time so they can tell which variant is working best or least. Like Amazon says; More on the way!

    ReplyDelete
  21. Any known fix for this? So far we have not been able to overcome this devil! Please advise.

    ReplyDelete
  22. yea I stupidly opened it and now it says I don't have enough memory to run windows nt and I have window xp. can't get past start up menu any suggestions

    ReplyDelete
  23. yea I stupidly opened it and now it says I don't have enough memory to run windows nt and I have window xp. can't get past start up menu any suggestions

    ReplyDelete
  24. I opened it because I love a good scam attempt. Computer got weird. Restarted it and all seems good.

    Still, if the purpose of the scam is not to try to take your cash with some "pay now and it will all go away" deal, then what is it??

    Must be a virus.

    ReplyDelete
  25. I received 3 of these emails in the past 3 days. The good news is that my filter blocked it.

    ReplyDelete
  26. Received 3 of these in the past 3 days. Annoying.

    ReplyDelete
  27. I would give anything to catch one of these low life's that send out this stuff. I guarantee it would be the last time he ever even thought about posting something like this. If I only had one wish in life it would be to meet one of these a** holes.

    ReplyDelete
  28. I just got one today and got worried because my former employer is based out of Chicago & I filed a complaint against them back in May. Anyway, the email it came from just said Notice to Appear but when I double-clicked that it was support7@mwe.com. mwe.com appears to be a real website of a law firm. Anyone else get one for Chicago from mwe? It had an attachment and was just as described like the others mentioned here. Is mine most likely a scam, too? The attachment is just symbols and garbled letters.

    ReplyDelete
  29. Mine: "Notice to Appear (ticket_support.5@mwe.com" was to appear" "in Chicago Court for the hearing of you case in January 11, 2014." Did not open attachment.

    ReplyDelete
  30. Just got this said Jan 14th at Washington from Emma Mason. Annoying as hell

    ReplyDelete
  31. I don't understand how people can just open this stuff without checking on it first. Google is such a good resource. I googled this FIRST, found all these comments, then went back a deleted the emails. Problem solved. Check Google FIRST, if you don't find anything then go to the email.

    ReplyDelete
  32. This comment has been removed by the author.

    ReplyDelete
  33. I received one from support.7@mwe.com for a Chicago hearing. Did not open. Thinking it is a scam.

    ReplyDelete
  34. I've received 3 of them today alone and after reading the first one, it was clear that whoever sent it out has a very limited grasp of the English language and even less knowledge of how the US court system really works.

    How on earth could anyone actually fall for this and open the attachment?

    ReplyDelete
  35. run malwarebytes from a thumb drive. Install it onto the thumbdrive from a safe computer first.

    ReplyDelete
  36. I am in Serbia,and I got this too, and didn't opoen it, because I knew that something is wrong,because why would I go to Washington, I have newer been there...

    ReplyDelete
  37. Like Nevena, I am also not Stateside. Seemed pretty obviously a virus-bearer, but like Gampa, I googled just to be sure. Would love to know who to report it to so these folks get caught. I absolutely cannot fathom what pleasure there could be in ruining computer files of random strangers...

    ReplyDelete
  38. wow i just received one last week and it almost put a virus on my computer and then i get two on Saturday one from St. Louis and one from Chicago Courts, please dont open them! You cant send a reply then your computer will start acting up! Besides you will never be notified by e-mail!

    ReplyDelete
  39. I got the same one this morning but it is from Louisiana Court... These people are messed up. Nothing like getting a Court Notification on a Monday Morning. Fortunately I have Excellent Software on my computer and it refused to open the link due to Phishing Scam Notifications. Obviously it is not real. They didn't have a name or a case Number.

    ReplyDelete
  40. Mine was said notice to appear in the circuit court of Chicago. Has a case number and date to appear of Jan. 18 at 0900. I was curious as I had gotten a speeding ticket south of Chicago and the due date to pay the fine was the 18th but it wasn't even in cook county or Chicago area. My anti virus said it was a Trojan not seen by members of the forum or by the antivirus people either. It did say it was also a key logger so I copied the whole email and found the real clerk of the county and sent it to them with the explanation that I had received it supposedly from them.havent got anything back yet

    ReplyDelete
  41. Mine said I am summoned to appear in circuit court in Chicago. It had a case number and had a name I don't remember as clerk of the county. I was curious as had speeding ticket south of there but not in cook county when I tried to find it there was no such thing in chicagos court

    ReplyDelete
  42. I got one today and laughed my socks off!! mainly because i have to attend the court in Loiusiana and i happen to live in AUSTRALIA - long way to go - wonder if they'll send me the air fare - they must think we were born yesterday!!!

    ReplyDelete
  43. Got one today for appearing in San Francisco! Anyone else?

    Also there appears to be a slight variation on the appearance#. The one sent to me didn't start with NR#, just N# followed by four digits-three digits. EXAMPLE: N#0000-000 Anyone else get that?

    Does anyone know if there is a way to report this to the actual courts that are being used for the scam? It'd be nice to send some REAL legal people after these scammers!

    ReplyDelete
    Replies
    1. yes , I just got one May 09, 2014..Notice to Appear..Clerk of Courts Alison Smith files Attached..files couldn't open Scared me..I didnt know what was going on ..so I called the Court house Clerk of Courts they said they do not email

      Delete
  44. Jimmie - I received an email like this also.

    Court attendance notification No7165

    Mandatory Court Appearance
    To Me
    Today at 3:49 AM
    Mandatory court appearance.

    Hereby we inform you about the hearing of your case that will take place in the Court of Cobb County, State of Georgia in February 24, 2014, at 11:30 a.m.

    Hearing subject: use of pirated software.
    Your attendance is mandatory.
    No adjournments will be granted.

    The judicial notice with all details is attached to this mail.

    It is advised to be thoroughly examined in order
    you could properly prepare for the hearing.

    Judicial representative,
    Susan Mason
    1 Attachment
    Judicial_Notice_14_01_2014_No_6183.zipDownload
    Reply, Reply All or Forward | More
    by nana817 on

    ReplyDelete
  45. Has anyone else been receiving phone calls too? We've gotten several phone calls and today was the first email...

    ReplyDelete
  46. I got one and I foolishly opened it on my.phone. Now what? What do I do now?

    ReplyDelete
  47. Got one today for appearing in NOW-Y! ? BUT i didn't open attachment.

    Thanks for help

    ReplyDelete
  48. Mine was for Atlanta, also. It went to spam and the attachment was removed as it contained malware.

    ReplyDelete
  49. just got one this morning, from alston.com

    has one attachment, i did not open it:

    Plaint_Note _16_01_14_Copy_985.zip (84.2 KB)

    x-store-info:4r51+eLowCe79NzwdU2kR3P+ctWZsO+J
    Authentication-Results: hotmail.com; spf=softfail (sender IP is 12.205.205.72) smtp.mailfrom=information@alston.com; dkim=none header.d=alston.com; x-hmca=fail header.id=information@alston.com
    X-SID-PRA: information@alston.com
    X-AUTH-Result: FAIL
    X-SID-Result: FAIL
    X-Message-Status: n:n
    X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD02
    X-Message-Info: 11chDOWqoTmjqhOzvWWho/vK8oL2x1FIoEm0Tn+r3D4Vy8IHo2wUnsyrGzDvKeqkJtMeTZY+Nmsf8P9jABL0t17cmD7//fhbmiY1q6wmXvgxnZHlVyRreDnMBIHVGJhSAIYGqgA2imBuWSjQAdQsCx10ErM7COxXQDbI5Sd4/grvIzjDME1r9Tv/eAjJL+tpW73QRq3pQlrBaGuZ/tgppYHRTnkMdklr
    Received: from alston.com ([12.205.205.72]) by SNT0-MC1-F15.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
    Thu, 16 Jan 2014 12:12:13 -0800
    Message-ID: <000e01cf12f7a20c2eae7fc8050a@NHLIBT>
    From: "Pretrial Notice"
    To:
    Subject: Court attendance notification No8101
    Date: Thu, 16 Jan 2014 14:15:00 -0500
    MIME-Version: 1.0
    Content-Type: multipart/mixed;
    boundary="----=_NextPart_000_000B_01CF12C5.5770EEF0"
    X-Priority: 3
    X-MSMail-Priority: Normal
    X-Mailer: XimianEvolution1.4.6
    X-MimeOLE: Produced By XimianEvolution1.4.6
    Return-Path: information@alston.com
    X-OriginalArrivalTime: 16 Jan 2014 20:12:13.0974 (UTC) FILETIME=[3EF8AB60:01CF12F7]

    This is a multi-part message in MIME format.

    ------=_NextPart_000_000B_01CF12C5.5770EEF0
    Content-Type: multipart/alternative;
    boundary="----=_NextPart_001_000C_01CF12C5.5770EEF0"


    ------=_NextPart_001_000C_01CF12C5.5770EEF0
    Content-Type: text/plain;
    charset="iso-8859-1"
    Content-Transfer-Encoding: quoted-printable

    Pretrial notice,

    Hereby we inform that you are obliged to come as a defendant
    to The Court of Atlanta in February 20, 2014 at 11:00 a.m.
    for the hearing of your case of illegal software use.
    If necessary you have a right to obtain a lawyer for your protection.
    You are kindly asked to have an identity document with you.
    Personal appearance is compulsory.

    Please find the plaint note with more detailed case information
    attached to this letter and study it thoroughly.

    Court clerk,
    Sophie Tailor

    ReplyDelete
  50. DO NOT OPEN THE EMAIL ATTACHMENT, A PROPER COURT SUMMON WILL NOT COMES IN THE FORM OF EMAIL, THEY WILL BE MAILED TO YOU IN PLAIN OLD PAPER FORM............AGAIN.....DO NO OPEN THOSE ATTACHMENT.

    ReplyDelete
  51. I am getting emai, which started with phone calls, and tons of it. Usually the calls are from area code 601, sometimes different, but very rarely. It is so funny, they say, on the voice mail (I never answer), that they need my address and phone no. so they can serve me. Hahaha. I keep blocking the phone nos. and they keep changing them. With the ever increasing emails, it is getting really irritating. Besides not contacting you by email, there would be a specific court and judge named, not 'Court of New York' lol. Anyway, I heard, with the phone calls, that they try to get your money, after much fear mongering, 'to defend your case', presumably when they hit upon someone who coincidentally has something legal going on. There are various govmt depts you can report to, although I doubt anything would happen, but most strange I must say; not the usual malware/virus/scam, esp as it is mixed with phone calls, which is indeed weird as I got the phone calls first, then the email, which really makes you want to open it, of course. I get at least 1 scam of come sort every day, but every email that comes from someone I don't know goes to my Spamblocker on the email server, which I sift through before POPing down to my mail client They often catch these things and remove the bad content but not in this case; guess I should send it to them...argh.

    ReplyDelete
  52. Wow, be careful. I was going to send it to my email provider, but the headers would not appear, so I tried View Page Source, out of curiosity as much as giving them information and bam, virus software caught it, and it was one of the files mentioned in this blog. I had not downloaded it or opened the attachment...nothing. I've viewed a lot of page source in my time but it never executed anything...scary.

    ReplyDelete
  53. You can fix the virus, if you have accidentally opened the file, by downloading and running Malwarebytes. You can use the 14-day trial to perform a quick scan on your computer to find any corrupted files created from the virus. After about 1-2 hours, the scan should finish and you should be able to delete all corrupted files, removing the virus. Upon removal, you will be prompted to restart your computer! Malwarebytes worked for me, but I'm not sure it will for everyone else!

    ReplyDelete

  54. Notice to Appear,

    Hereby you are notified that you have been scheduled to appear for your hearing that will take place in the court of
    London in January 31, 2014 at 10:00 am.

    Please bring all documents and witnesses relating to this case with you to Court on your hearing date.

    The copy of the court notice is attached to this letter.
    Please, read it thoroughly.

    Note: If you do not attend the hearing the judge may hear the case in your absence.

    Yours truly,
    L.McNamara
    Clerk to the Court.

    ReplyDelete
  55. New notice is for eviction, good luck on this one as I rent from my parents who own the house LOL

    ReplyDelete
  56. Hi! I just got one saying that I should move out of my property, that I would be forced to relocate if I didn't move... bla bla bla... I have been receiving this e-mails for some time now..

    ReplyDelete
  57. i just got it this morning, unfortunately,i opened it. so now i got in virus. how can i remove this virus... PLEASE?

    ReplyDelete
  58. I received 2 if these. What are they? And why are they sending them?

    ReplyDelete
  59. Recd 2 of these the past week. One from court of Anaheim Ca, the other from Modesto Ca where I have never been. Googled it and trashed it.

    ReplyDelete

  60. I got 3 of these emails in the past 3 months, but thankfully I couldn't open the attachment lol its annoying



    Notice to Appear,

    Please bring all documents and witnesses relating to this case with you to Court on your hearing date.
    The copy of the court notice is attached to this letter.


    Truly yours,
    Clerk to the Court.
    Barbara Tailor

    ReplyDelete
  61. just now received another email..Notice to Appear Urgent...from Linda Mason clerk of courts...support423@yellowpage...files attached...ThankGod this site here I was hone crazy tryin figure out where to Appear

    ReplyDelete
  62. Maybe if someone emailed the firm of lawyers who's name appears in the email address they would have the resources and the incentive to limit these emails.

    ReplyDelete
  63. just received this on May 30 2014 dated for May 29, 2014. I know my local politcs and new it was crap. So I looked it up and found this site. Thought I would let you know it's still circulating.

    ReplyDelete
  64. Hi,

    I am also got the mail like this yesterday at Morning 8.44 AM and same if I try to forward to some one it bounce and the attchement shows viruses in google what shoild i do is the mail is real one but i did not know what i did exactly can someone help me..

    ReplyDelete
  65. received this "notice to appear in court" today . . .

    To prevent these messages from ever entering your systems,
    (For those using Outlook.com)

    Use your RIGHT mouse button, click on the message title and a drop down window appears, Select, "view message source". Click on that and a new tab opens with all the HTML code for that message. Look along the top for the code that has the senders address. for me it was, "custservice806@probateadministrationlawyers.com"

    Highlight this and copy. Go back to your email tab and click on the gear at the upper right hand corner of the email window. A drop down window appears, select "options". This opens a new view. Look for the title "preventing junk email". and select "safe and blocked senders".
    Click on the blocked senders link. A new view opens. Paste the copied address in the text field and click "add to list".

    This action will block that sender. close this tab, refresh your junk folder to show the word, "empty" in the blue band and click empty without ever selecting the message.

    ReplyDelete
  66. Hi all, very interesting, I thought it was a scam at first looking to blackmail those gullible enough to let this thing loose. Tactic change from the authors I think as mine came from staten-island-lawyers.com - a site that is hosted for free by godaddy.com. Mine was about illegal software use, which I know I don't have & have to attend Killeen (Texas?) in Sept. Looks like this thing is starting the rounds again

    ReplyDelete
  67. Got one from the Circuit Court of Lakeland Florida

    Did a reverse domain registrant lookup on WHOIS.

    for the email addy attached to the scam email

    "mail968@the-consumer-lawyers.com"


    The body of the email itself:

    "...As a defendant you have been scheduled to attend the hearing in the
    Court of Lakeland.

    Hearing date: 3 September 2014
    Hearing time: 11:00 a.m.
    Hearing subject: illegal use of software

    Prior to the court thoroughly study the plaint note in the attachment
    to this mail.

    Sincerely,
    Court agent,
    Barbara Tailor

    The results of abuse history profile, originated in Newark, email registrant is currently registered in Ft. Lauderdale:

    Domain Name: the-consumer-lawyers.com
    Registry Domain ID: 1565966753_DOMAIN_COM-VRSN
    Registrar WHOIS Server: whois.moniker.com
    Registrar URL: http://www.moniker.com
    Updated Date: 2014-08-26T09:08:12.0Z
    Creation Date: 2009-08-17T20:14:06.0Z
    Registrar Registration Expiration Date: 2015-08-17T20:14:06.0Z
    Registrar: Moniker Online Services LLC
    Registrar IANA ID: 228
    Registrar Abuse Contact Email:
    Registrar Abuse Contact Phone: +1.9546071294
    Domain Status: clientDeleteProhibited
    Domain Status: clientTransferProhibited
    Registry Registrant ID: WP-4
    Registrant Name: Moniker Privacy Services
    Registrant Organization: Moniker Privacy Services
    Registrant Street: 2320 NE 9th St, Second Floor
    Registrant City: Fort Lauderdale
    Registrant State/Province: FL
    Registrant Postal Code: 33304
    Registrant Country: US
    Registrant Phone: +1.8006886311
    Tech Organization: Moniker Privacy Services
    Tech Street: 2320 NE 9th St, Second Floor
    Tech City: Fort Lauderdale
    Tech Postal Code: 33304
    Tech State/Province: FL
    Tech Country: US
    Tech Phone: +1.8006886311

    ReplyDelete
  68. I got a similar notice on 06 Nov 2014, but the subject line it is written to attend court, but attached couldn't open. Balakrishnan

    ReplyDelete
  69. You have to appear in the Court on the April 03.
    Please, prepare all the documents relating to the case and bring them to Court on the specified date.
    Note: The case may be heard by the judge in your absence if you do not come.

    The Court Notice is attached to this email.

    Sincerely,
    Dave Dougherty,
    District Clerk.

    It came from:
    dave.dougherty@core.mmc.ro

    ReplyDelete