Figured this belonged here.

I loved this!

Got a packet capture of a NetSend ( to port 1026 )

Message read:
STOP! WINDOWS REQUIRES IMMEDIATE ATTENTION. \n\n\nWindows has found dangerous infected spyware on your computer!\n\n To rid your computer of this dangerous spyware do the following:\n\n1. Download eAntiSpy from: www.helpfixpc.com\m2
I hope I got that right.

I came from 221.208.208.11/32874 ( China -- go figure )

That IP address is apparently well known at DShield

The addresses for the so-called product come form VC "Saint Vincent and The Grenadines"

I didn't investigate this further, just thought it humorous.