1. Terry Zink Program Manager Microsoft Corporation SESSION CODE: SIA316 Mike Chan Group Product Manager Microsoft Corporation Behind the Spam A look at spammers, botnets, and other sundry subterfuge

5. http://en.wikipedia.org/wiki/Russian_Business_Network

6. http://www.sophos.com/security/technical-papers/samosseiko-vb2009-paper.pdf

13. Source: APWG Internet Explorer 8 Phishing blocks

20. % bagle% bobax% cutwail%darkmailer% donbot% grum% mega-d% rustock%xarvester 7/28/200924%0%36%3%2%0%2%32%1% 8/4/200929%0%37%5%2%0%1%26%1% 8/11/200930%0%29%4% 0%1%31%1% 8/18/200931%0%20%5%2%0%3%38%1% 8/25/200935%0%24%10%6%0%1%24%0% 9/1/200926%3%23%24%2%3%0%17%1% 9/8/200925%1%34%2%5%6%2%23%1% 9/15/200923%0%24%11%3%5%1%33%1% 9/22/200922%2%10%4%3% 2%53%1% 9/29/200927%2%12%1%3%4%2%46%2% 10/6/200922%1%16%5%1%2%3%49%1% 10/13/200924%1%16%1%2%4%2%50%1% 10/20/200938%1%21%0%6%7%1%25%0% 10/27/200941%2%17%1%2%8%1%28%0% 11/4/200949%1%12%2%0%8%0%27%0%

29. 5:30 pm 258.14.99.18 5:40 pm 268.24.109.28 5:50 pm 278.34.119.18 6:00 pm 288.44.129.48 6:10 pm 258.14.99.18

30. DNS ns.xcfwqc.ru ns.qxfslx.cn ns.vblgsa.net ns.xcfwqc.ru rxcoenbitee.cn 292.154.23.18 64.65.92.98 ns.qxfslx.cn 274.41.4.97 294.101.14.79 ns.vblgsa.net ns.ukap.net

33. Trfacifconverter.biz k

36. Before Black SEO

37. After Black SEO

38. How?

39. Rogue A/V

40. Steals credit card numbers

41. Targets MMORPGs Spread via thumb drives and mapped drives

43. Learn more about our solutions: http://www.microsoft.com/forefront Try our products: http://www.microsoft.com/forefront/trial

44. www.microsoft.com/teched www.microsoft.com/learning http://microsoft.com/technet http://microsoft.com/msdn

46. Sign up for Tech·Ed 2011 and save $500 starting June 8 – June 31 st http://northamerica.msteched.com/registration You can also register at the North America 2011 kiosk located at registration Join us in Atlanta next year