Paycom email scam/virus

Jel · 2005-12-20, 01:57 AM

Quite well done, message headers make it appear it is actually from paycom, which of course, it is not. I only realised it was dodgy when I saw the attachment (was more focused on whether my CC had been used fraudently). Whatever ya do, don't open the attachment

---------------------------------

Dear customer.

Thank you for your subscription to http://www.viewpornstars.com.

You have been billed as Paycom LLC for the amount of: GBP 24.95 for 30 days then GBP 24.95 recurring every 30 days.

Time: 2005-12-16 10:54:56
Transaction ID: 965658
Amount: GBP 24.95
Applied to Account #: 10915104
Pay Method: VISA

Your new subscription identification number is: 10915104, please keep this number in a safe place, as it will be required
for reference in all future correspondence regarding your membership.

Your membership access information is:
Username for your subscription: 112002
Password for your subscription: regina
Membership website: http://www.viewpornst*rs.com

For further details regarding this transaction and direct access to our online billing support services, available
24-hours a day, 365-days a year, please check your transaction details in attachment.

Thank you for choosing Paycom as the eMerchant for your subscription!

Customer Support

****************************************
Billing services provided by Paycom, LLC

------------------------------------------

I know almost all of us know not to poen attachments unless yada yada yada, but would hate to see someone here get hit with a virus for 2 seconds of being off guard if you just woke up to it (as I did)

Halfdeck · 2005-12-20, 02:09 AM

Does Paycom even handle processing for that site?

RawAlex · 2005-12-20, 02:43 AM

Where do the links actually go?

Alex

Jel · 2005-12-20, 02:56 AM

links go to the correct places, it's the running of the .exe attachment that is the 'goal' of the spammer

FILE.965658.exe

is the name of it for what it's worth. Paycom are aware of it, apparently a lot of people are getting the email, here's the full exchange between paycom and myself (newest first)

-------------------------------------------------------

not actually. a lot of people are receiving it and we are already investigating it.

Quoting Jel <xx@xx>:

> Hi Ashley,
>
> Yeah, I got the part about it being a spoof, what I'm saying is would you
> like the email headers etc. to assist you in finding the people who started
> it?
>
>
> ----- Original Message -----
> From: <xx@xx.com>
> To: "Jel" <xx@xx.co.uk>
> Sent: Tuesday, December 20, 2005 7:13 AM
> Subject: Requested Information
>
>
> > Dear Sir or Madam:
> > Please find below the information you requested:
> >
> > someone has started this spam virus using us a forefront. we did not have
> > any
> > thing to do with this. we have our tech dept working on the problems but
> > as for
> > now please disregard the message of billing it was sent as a virus
> >
> > In the future, if you wish to auto administer your account information,
> > visit
> > our self-help page at:
> >
> > http://www.billingsupport.com/
> >
> > Best Regards,
> >
> > Ashley E.
> >
> > Billing Support On-line Customer Service
> >
> > From US and Canada toll Free 1-800-893-xx
> > Standard International and US 1-310-827-xx
> > Standard International and US Fax 1-310-827-xx
> > Or use one of the international toll free numbers listed below
> >
> > INTERNATIONAL TOLL-FREE NUMBERS
> >
> > From Spain 00-800-PAYCOM-66 (00-800-7292-xx)
> > From UK 00-800-PAYCOM-66 (00-800-7292-xx)
> > From Belgium 00-800-PAYCOM-66 (00-800-7292-xx)
> > From Switzerland 00-800-PAYCOM-66 (00-800-7292-xx)
> > From Sweden 00-800-PAYCOM-66 (00-800-7292-xx)
> > From Norway 00-800-PAYCOM-66 (00-800-7292-xx)
> > From Netherlands 00-800-PAYCOM-66 (00-800-7292-xx)
> > From France 00-800-PAYCOM-66 (00-800-7292-xx)
> > From Germany 00-800-PAYCOM-66 (00-800-7292-xx)
> > From Japan 001-010-800-PAYCOM-66 (001-010-800-7292-xx)
> > From Australia 0011-800-PAYCOM-66 (0011-800-7292-xx)
> >
> > In order to take advantage of the INTERNATIONAL TOLL-FREE NUMBER, please
> > Dial the number exactly as shown. It is not necessary to dial out of the
> > Country or to dial any additional numbers.
> >
> > Business hours:
> > Open 24 hours 7 days a week for your convenience.
> >
> > Please include the original email in any replies.
> >
> > Quoting Jel <xx@xx.co.uk>:
> >
> >> Hi Ashley,
> >>
> >> I suspected it was a scam but it's very well done, the return to address
> >> etc. appears to point to yourselves. Are the email headers and message
> >> source any good to you? I can send you that info if it will assist you in
> >> any way.
> >>
> >> Kind regards,
> >>
> >> Jel
> >> ----- Original Message -----
> >> From: <xx@xx.com>
> >> To: "Jel" <xx@xx.co.uk>
> >> Sent: Tuesday, December 20, 2005 7:06 AM
> >> Subject: Requested Information
> >>
> >>
> >> > Dear Sir or Madam:
> >> > Please find below the information you requested:
> >> > Unfortunately you have been apart of an email spam virus that was has
> >> > nothing to
> >> > do withus.unfortunately or face front was put on this virus but it was
> >> > not
> >>
> >> > done
> >> > by us. There is no account with our company by this email address or
> >> > account .
> >> > sorry for any inconvience
> >> >
> >> >
> >> > In the future, if you wish to auto administer your account information,
> >> > visit
> >> > our self-help page at:
> >> >
> >> > http://www.billingsupport.com/
> >> >
> >> > Best Regards,
> >> >
> >> > Ashley E.
> >> >
> >> > Billing Support On-line Customer Service
> >> >
> >> > From US and Canada toll Free 1-800-893-xx
> >> > Standard International and US 1-310-827-xx
> >> > Standard International and US Fax 1-310-827-xx
> >> > Or use one of the international toll free numbers listed below
> >> >
> >> > INTERNATIONAL TOLL-FREE NUMBERS
> >> >
> >> > From Spain 00-800-PAYCOM-66 (00-800-7292-xx)
> >> > From UK 00-800-PAYCOM-66 (00-800-7292-xx)
> >> > From Belgium 00-800-PAYCOM-66 (00-800-7292-xx)
> >> > From Switzerland 00-800-PAYCOM-66 (00-800-7292-xx)
> >> > From Sweden 00-800-PAYCOM-66 (00-800-7292-xx)
> >> > From Norway 00-800-PAYCOM-66 (00-800-7292-xx)
> >> > From Netherlands 00-800-PAYCOM-66 (00-800-7292-xx)
> >> > From France 00-800-PAYCOM-66 (00-800-7292-xx)
> >> > From Germany 00-800-PAYCOM-66 (00-800-7292-xx)
> >> > From Japan 001-010-800-PAYCOM-66 (001-010-800-7292-xx)
> >> > From Australia 0011-800-PAYCOM-66 (0011-800-7292-xx)
> >> >
> >> > In order to take advantage of the INTERNATIONAL TOLL-FREE NUMBER,
> >> > please
> >> > Dial the number exactly as shown. It is not necessary to dial out of
> >> > the
> >> > Country or to dial any additional numbers.
> >> >
> >> > Business hours:
> >> > Open 24 hours 7 days a week for your convenience.
> >> >
> >> > Please include the original email in any replies.
> >> >
> >> > Quoting Jel <xx@xx.co.uk>:
> >> >
> >> >> Hi,
> >> >>
> >> >> Got this email today, I have no clue what it pertains to, nor why
> >> >> there
> >> >> is
> >> >> an .exe file attached - is this a scam?
> >> >>
> >> >> Many thanks.
> >> >>
> >> >>
> >> >> ----- Original Message -----
> >> >> From: "Paycom Support" <xx@xx.net>
> >> >> To: "Admin" <xx@xx.co.uk>
> >> >> Sent: Tuesday, December 20, 2005 2:25 AM
> >> >> Subject: Payment Receipt
> >> >>
> >> >>
> >> >> > Dear customer.
> >> >> >
> >> >> > Thank you for your subscription to http://www.viewpornst*rs.com.
> >> >> >
> >> >> > You have been billed as Paycom LLC for the amount of: GBP 24.95 for
30
days then GBP 24.95 recurring every 30 days.

Time: 2005-12-16 10:54:56
Transaction ID: 965658
Amount: GBP 24.95
Applied to Account #: 10915104
Pay Method: VISA

Your new subscription identification number is: 10915104, please
keep
this

number in a safe place, as it will be required
for reference in all future correspondence regarding your
membership.

Your membership access information is:
Username for your subscription: 112002
Password for your subscription: regina
Membership website: http://www.viewpornstars.com

For further details regarding this transaction and direct access to our online billing support services, available 24-hours a day, 365-days a year, please check your transaction details in attachment.

Thank you for choosing Paycom as the eMerchant for your
subscription!

Customer Support

****************************************
Billing services provided by Paycom, LLC

---------------------------------------------------------

(I did start to remove all those >>> characters and get the sentences more reader friendly but stopped early cos it's early here, should still be able to make sense of it)

markit · 2005-12-20, 07:59 AM

scary shit

..

Toby · 2005-12-20, 08:14 AM

Hey DD, looks like WildGirl has an apprentice.

Jel · 2005-12-20, 09:04 AM

Quote:

Originally Posted by Toby

Hey DD, looks like WildGirl has an apprentice.

Hey Toby, am I missing something here?

Toby · 2005-12-20, 09:53 AM

Quote:

Originally Posted by Jel

Hey Toby, am I missing something here?

I was referring to the one liner "sig placement" post prior to mine.

Jel · 2005-12-20, 10:10 AM

Quote:

Originally Posted by Toby

I was referring to the one liner "sig placement" post prior to mine.

Yeah I knew that all along......

(Takes me a bit longer than most to catch on, just call me Joey lol)

DangerDave · 2005-12-20, 09:24 PM

Sig be gone........... |merlin

MrYum · 2005-12-20, 09:55 AM

Sheesh...another one to watch out for

Thanks for the heads up Jel!

Toby · 2005-12-21, 04:55 PM

There's no way to say it politely. PayCom's affiliate system sucks. No sponsor ID on checks is a pain, but my biggest complaint is no referrer data. You have no clue where your sales are coming from.

Dagwolf · 2005-12-22, 11:23 AM

Hi, Jel! I didn't even know you posted here. I never open attached program files but thanks for the warning.

2005-12-20, 01:57 AM	#1
Jel I'm the only guy in the world who has to wake up to have a nightmare Join Date: Feb 2004 Location: London, United Kingdom Posts: 1,895	Paycom email scam/virus Quite well done, message headers make it appear it is actually from paycom, which of course, it is not. I only realised it was dodgy when I saw the attachment (was more focused on whether my CC had been used fraudently). Whatever ya do, don't open the attachment --------------------------------- Dear customer. Thank you for your subscription to http://www.viewpornstars.com. You have been billed as Paycom LLC for the amount of: GBP 24.95 for 30 days then GBP 24.95 recurring every 30 days. Time: 2005-12-16 10:54:56 Transaction ID: 965658 Amount: GBP 24.95 Applied to Account #: 10915104 Pay Method: VISA Your new subscription identification number is: 10915104, please keep this number in a safe place, as it will be required for reference in all future correspondence regarding your membership. Your membership access information is: Username for your subscription: 112002 Password for your subscription: regina Membership website: http://www.viewpornstrs.com For further details regarding this transaction and direct access to our online billing support services, available 24-hours a day, 365-days a year, please check your transaction details in attachment. Thank you for choosing Paycom as the eMerchant for your subscription! Customer Support *************************************** Billing services provided by Paycom, LLC ------------------------------------------ I know almost all of us know not to poen attachments unless yada yada yada, but would hate to see someone here get hit with a virus for 2 seconds of being off guard if you just woke up to it (as I did)

2005-12-20, 02:09 AM	#2
Halfdeck You can now put whatever you want in this space :) Join Date: Oct 2004 Location: New Haven, CT Posts: 985	Does Paycom even handle processing for that site? __________________ Success is going from failure to failure without a loss of enthusiasm.

2005-12-20, 07:59 AM	#5
markit Banned Join Date: Oct 2005 Posts: 25	scary shit .. Last edited by DangerDave; 2005-12-20 at 09:22 PM..

2005-12-20, 08:14 AM	#6
Toby Lonewolf Internet Sales Join Date: Mar 2005 Location: Houston Posts: 4,826	Hey DD, looks like WildGirl has an apprentice. __________________ Latex Vixens Babes In Boots Well Heeled Women Dressing For Sex Stocking Vixens

2005-12-20, 09:24 PM	#10
DangerDave Bonged Join Date: Mar 2003 Location: BrisVegas, AUSTRALIA Posts: 4,882	Sig be gone........... \|merlin __________________ Old Dollars >>>> Now with over 90 Hosted Free Sites <<<< DangerDave.com.au - Adult Links to Free Porn

2005-12-20, 02:43 AM	#3
RawAlex Took the hint. Join Date: Mar 2003 Posts: 5,597	Where do the links actually go? Alex

2005-12-20, 02:56 AM	#4
Jel I'm the only guy in the world who has to wake up to have a nightmare Join Date: Feb 2004 Location: London, United Kingdom Posts: 1,895	links go to the correct places, it's the running of the .exe attachment that is the 'goal' of the spammer FILE.965658.exe is the name of it for what it's worth. Paycom are aware of it, apparently a lot of people are getting the email, here's the full exchange between paycom and myself (newest first) ------------------------------------------------------- not actually. a lot of people are receiving it and we are already investigating it. Quoting Jel <xx@xx>: > Hi Ashley, > > Yeah, I got the part about it being a spoof, what I'm saying is would you > like the email headers etc. to assist you in finding the people who started > it? > > > ----- Original Message ----- > From: <xx@xx.com> > To: "Jel" <xx@xx.co.uk> > Sent: Tuesday, December 20, 2005 7:13 AM > Subject: Requested Information > > > > Dear Sir or Madam: > > Please find below the information you requested: > > > > someone has started this spam virus using us a forefront. we did not have > > any > > thing to do with this. we have our tech dept working on the problems but > > as for > > now please disregard the message of billing it was sent as a virus > > > > In the future, if you wish to auto administer your account information, > > visit > > our self-help page at: > > > > http://www.billingsupport.com/ > > > > Best Regards, > > > > Ashley E. > > > > Billing Support On-line Customer Service > > > > From US and Canada toll Free 1-800-893-xx > > Standard International and US 1-310-827-xx > > Standard International and US Fax 1-310-827-xx > > Or use one of the international toll free numbers listed below > > > > INTERNATIONAL TOLL-FREE NUMBERS > > > > From Spain 00-800-PAYCOM-66 (00-800-7292-xx) > > From UK 00-800-PAYCOM-66 (00-800-7292-xx) > > From Belgium 00-800-PAYCOM-66 (00-800-7292-xx) > > From Switzerland 00-800-PAYCOM-66 (00-800-7292-xx) > > From Sweden 00-800-PAYCOM-66 (00-800-7292-xx) > > From Norway 00-800-PAYCOM-66 (00-800-7292-xx) > > From Netherlands 00-800-PAYCOM-66 (00-800-7292-xx) > > From France 00-800-PAYCOM-66 (00-800-7292-xx) > > From Germany 00-800-PAYCOM-66 (00-800-7292-xx) > > From Japan 001-010-800-PAYCOM-66 (001-010-800-7292-xx) > > From Australia 0011-800-PAYCOM-66 (0011-800-7292-xx) > > > > In order to take advantage of the INTERNATIONAL TOLL-FREE NUMBER, please > > Dial the number exactly as shown. It is not necessary to dial out of the > > Country or to dial any additional numbers. > > > > Business hours: > > Open 24 hours 7 days a week for your convenience. > > > > Please include the original email in any replies. > > > > Quoting Jel <xx@xx.co.uk>: > > > >> Hi Ashley, > >> > >> I suspected it was a scam but it's very well done, the return to address > >> etc. appears to point to yourselves. Are the email headers and message > >> source any good to you? I can send you that info if it will assist you in > >> any way. > >> > >> Kind regards, > >> > >> Jel > >> ----- Original Message ----- > >> From: <xx@xx.com> > >> To: "Jel" <xx@xx.co.uk> > >> Sent: Tuesday, December 20, 2005 7:06 AM > >> Subject: Requested Information > >> > >> > >> > Dear Sir or Madam: > >> > Please find below the information you requested: > >> > Unfortunately you have been apart of an email spam virus that was has > >> > nothing to > >> > do withus.unfortunately or face front was put on this virus but it was > >> > not > >> > >> > done > >> > by us. There is no account with our company by this email address or > >> > account . > >> > sorry for any inconvience > >> > > >> > > >> > In the future, if you wish to auto administer your account information, > >> > visit > >> > our self-help page at: > >> > > >> > http://www.billingsupport.com/ > >> > > >> > Best Regards, > >> > > >> > Ashley E. > >> > > >> > Billing Support On-line Customer Service > >> > > >> > From US and Canada toll Free 1-800-893-xx > >> > Standard International and US 1-310-827-xx > >> > Standard International and US Fax 1-310-827-xx > >> > Or use one of the international toll free numbers listed below > >> > > >> > INTERNATIONAL TOLL-FREE NUMBERS > >> > > >> > From Spain 00-800-PAYCOM-66 (00-800-7292-xx) > >> > From UK 00-800-PAYCOM-66 (00-800-7292-xx) > >> > From Belgium 00-800-PAYCOM-66 (00-800-7292-xx) > >> > From Switzerland 00-800-PAYCOM-66 (00-800-7292-xx) > >> > From Sweden 00-800-PAYCOM-66 (00-800-7292-xx) > >> > From Norway 00-800-PAYCOM-66 (00-800-7292-xx) > >> > From Netherlands 00-800-PAYCOM-66 (00-800-7292-xx) > >> > From France 00-800-PAYCOM-66 (00-800-7292-xx) > >> > From Germany 00-800-PAYCOM-66 (00-800-7292-xx) > >> > From Japan 001-010-800-PAYCOM-66 (001-010-800-7292-xx) > >> > From Australia 0011-800-PAYCOM-66 (0011-800-7292-xx) > >> > > >> > In order to take advantage of the INTERNATIONAL TOLL-FREE NUMBER, > >> > please > >> > Dial the number exactly as shown. It is not necessary to dial out of > >> > the > >> > Country or to dial any additional numbers. > >> > > >> > Business hours: > >> > Open 24 hours 7 days a week for your convenience. > >> > > >> > Please include the original email in any replies. > >> > > >> > Quoting Jel <xx@xx.co.uk>: > >> > > >> >> Hi, > >> >> > >> >> Got this email today, I have no clue what it pertains to, nor why > >> >> there > >> >> is > >> >> an .exe file attached - is this a scam? > >> >> > >> >> Many thanks. > >> >> > >> >> > >> >> ----- Original Message ----- > >> >> From: "Paycom Support" <xx@xx.net> > >> >> To: "Admin" <xx@xx.co.uk> > >> >> Sent: Tuesday, December 20, 2005 2:25 AM > >> >> Subject: Payment Receipt > >> >> > >> >> > >> >> > Dear customer. > >> >> > > >> >> > Thank you for your subscription to http://www.viewpornstrs.com. > >> >> > > >> >> > You have been billed as Paycom LLC for the amount of: GBP 24.95 for 30 days then GBP 24.95 recurring every 30 days. Time: 2005-12-16 10:54:56 Transaction ID: 965658 Amount: GBP 24.95 Applied to Account #: 10915104 Pay Method: VISA Your new subscription identification number is: 10915104, please keep this number in a safe place, as it will be required for reference in all future correspondence regarding your membership. Your membership access information is: Username for your subscription: 112002 Password for your subscription: regina Membership website: http://www.viewpornstars.com For further details regarding this transaction and direct access to our online billing support services, available 24-hours a day, 365-days a year, please check your transaction details in attachment. Thank you for choosing Paycom as the eMerchant for your subscription! Customer Support *************************************** Billing services provided by Paycom, LLC --------------------------------------------------------- (I did start to remove all those >>> characters and get the sentences more reader friendly but stopped early cos it's early here, should still be able to make sense of it)

2005-12-20, 09:55 AM	#11
MrYum Arghhhh...submit yer sites ya ruddy swabs! Join Date: May 2004 Location: Sunny Florida! Posts: 5,108	Sheesh...another one to watch out for Thanks for the heads up Jel! __________________ Porno Flixxx Submissions SOTI Site Submissions Free Porn Resource Submissions

2005-12-21, 04:55 PM	#12
Toby Lonewolf Internet Sales Join Date: Mar 2005 Location: Houston Posts: 4,826	There's no way to say it politely. PayCom's affiliate system sucks. No sponsor ID on checks is a pain, but my biggest complaint is no referrer data. You have no clue where your sales are coming from. __________________ Latex Vixens Babes In Boots Well Heeled Women Dressing For Sex Stocking Vixens

2005-12-22, 11:23 AM	#13
Dagwolf They have the Internet on computers, now? Join Date: Aug 2003 Location: British Columbia Posts: 146	Hi, Jel! I didn't even know you posted here. I never open attached program files but thanks for the warning. __________________ Hey, what did I do this time?