X

On March, 2010

Browsing all posts on March, 2010

  • March 31, 2010
  • By John
  • Comments Off on The IRS is emailing me now?
  • in geekstuff

The IRS is emailing me now?

I doubt the federal government would ever become that efficient.

image

no paypload in the email itself.. but a few things to notice on this one.  my email address isn’t in the to.  The website at first glance looks like irs.gov but it’s actually eawsqu.pl registered to a guy in Germany:

DOMAIN: eawsqu.pl is releasing after termination
created:                2010.03.31 13:08:04
last modified:          2010.03.31 18:02:42
expiration date:        2010.04.05 18:02:42
no option
REGISTRAR:
Key-Systems GmbH
Prager ring 4 - 12
66482 Zweibrücken 
Niemcy/Germany
+49 6332791850

Firefox gave me a big red warning when trying to visit the site.  I much rather like FF’s warning rather than IE’s

image

IE let the site come up but a tiny warning in the title bar

image

image

Telling me that the website may be unsafe.  The site then ask users to download an EXE.  I wonder what that could do…

Another case where common sense goes a long way. 

  • March 30, 2010
  • By John
  • Comments Off on UPS delivers everything, even virus’?
  • in geekstuff

UPS delivers everything, even virus’?

Well, they might deliver bio hazards but not via email.  Here’s a letter i got this evening.

image

symantec let the file go right through the email.

extracted the zip,

image

scanned the file again with symantec and

image

doubled check the date on my definitions.  they are current.  I’ll test it against sophos tomorrow and see what they say.

  • March 29, 2010
  • By John
  • Comments Off on another attempt
  • in geekstuff

another attempt

I was originally going to ignore this spam but i got it twice today so might as well share.

 

MICROWORD.COM CORPORATIONS

CUSTOMER SERVICE: TARRAGONA ESPANA Email:

ADDRESS: C/ L'ESTANY, PARC. 2, POST CODE - 43006 CITY - TARRAGONA - SPAIN.

MICROWORD.COM RESOURCE ADVERTISING LINK: http://www.microword.com/

Date: 03/03/2010.

MICROWORD.COM CORPORATIONS MARCH 2010 (3RD TO 30TH) OFFICIAL WINNING NOTIFICATION.

Good day, we write to inform you that your email address has won, in the microword.com corporation internet March 2010 promotions. Your email address was selected randomly from the microword.com automatic computer generated machine, and your email address emerges as one of the online winners. This attracts a prize of Three hundred thousand Euros only (300,000.00 Euro) and an Apple 13.3" Mac Book Pro Notebook laptop.

----------------------------------------------------------------------------------------------------------------------------

*Your won cheque of three hundred thousand Euros (300,000.00 Euro) and Apple 13.3" Mac Book Pro Notebook laptop will be presented to you on arrival to our office in Tarragona, within the period of 30 days. Your winnings will be cancelled, if you do not present yourself at our office, within the given period of 30 days.

---------------------------------------------------------------------------------------------------------------------------

*If you are unable to come to our office in Tarragona- Spain to claim your won prize, your won prize will be presented to you by courier delivery via the promotion board contracted courier company. Microword.com Corporation is not responsible for the delivery changes [charges?] to your location. You will pay for the cost of delivery yourself. Please do not respond to this option, if you know, you will not pay for the courier service delivery. [ got, enough, commas, in there?]

-----------------------------------------------------------------------------------------------------------------------------

Please note: The draft certified cheque and all documents are packaged to be delivered under one way bill by the contracted courier company and are categorized as high priority & express delivery under applicable laws and regulations. This shipment cannot be delivered to P.O. boxes or postal codes but only to you the receiver at your given address.

------------------------------------------------------------------------------------------------------------------------------

For more information's, on how to claim your prize, do contact our promotions department via the email below or via telephone, and quote this reference number: MSTF/2010/XУNAJZ/MAR 3-30/KFYXQX as you contact our promotion department. This reference number is the security key to your winnings, we advice you keep the reference number to yourself.

Microword.com promotion department.

Tel: 0034- 634 176 053

Tel: 0034- 659 347 846

Email: promotion_department@micro-word.com

This promotion is organized by microword.com to advertise and to promote our website, http://www.microword.com/ which is based on all kind internet companies, all kind of computer hardware and software product. This promotion is as well organized to encourage the use of the Internet user and to promote computer literacy worldwide.

Congratulations to you lucky winner!

Sincerely,

Mr. Golf . P Ivan.

CEO: MSFT Word Resource Tarragona.

Copyright © 1992-2010 Micro-word.Com All rights reserved.

===========================================================

NOTICE TO RECIPIENT: THIS E-MAIL IS MEANT FOR ONLY THE INTENDED RECIPIENT OF THE TRANSMISSION, AND MAY BE A COMMUNICATION PRIVILEGED BY LAW. IF YOU RECEIVED THIS E- MAIL IN ERROR, ANY REVIEW, USE, DISSEMINATION, DISTRIBUTION OR COPYING OF THIS E-MAIL IS STRICTLY PROHIBITED.

PLEASE NOTIFY CUSTOMER SERVICE: TARRAGONA ESPANA VIA EMAIL: info@micro-word.com IMMEDIATELY OF THE ERROR BY RETURN E-MAIL AND PLEASE DELETE THIS MESSAGE FROM YOUR SYSTEM. THANK YOU IN ADVANCE FOR YOUR CO-OPERATION.

A few things to note,

  • country code returns to spain. 
  • the email address uses the domain micro-world.com but the web links provided use microworld.com
  • micro-world.com belongs to a company in Torrance, CA where the company in this email is from Spain. 
  • the company wants you to pick up the “prize” in Spain or have them deliver it COD (for shipping expenses).  I wonder how much that COD charge would be. 
  • The lack of grammar is another good give away (no pun in intended)

Basically, one of those deals where if you never entered a contest in spain, and they want you to pay up front, too good to be true.  sorry.

  • March 25, 2010
  • By John
  • Comments Off on The bad guys are busy today
  • in geekstuff

The bad guys are busy today

Got two suspicious emails today.   Here is the first one

image

Click to enlarge..

The first thing to notice, this wasn't sent directly to me.  The address is close but not me.  So this is some bot who put address in alphabetical list and set it out to groups at a time.

2nd thing, zip files have become notorious for sending virus and malware.

3rdly, I’ve been on fb all morning without any problem logging in so i know my password hasn’t been changed.

But what if I had opened that file.  Well I tested it against several antivirus programs.

Just scanning the file directly with Symantec didn’t find anything.

Opening the zip revealed an executable waiting to deliver it’s payload.

image

Symantec 10 didn’t find any problems with this file with normal scans but Sophos found it as Mal/BredoZP-B

The 2nd one was a little more crafty.

image

1st thing, this was sent directly to me but with an address i use specify for those sites which require you to enter an email address.  I use this one so i can confirm but discard any junk mail they send.

I tested the link to see if it redirected to a suspicious site.  No it actually went to that site with a doc file waiting for me.

I checked the site the file is hosted at and it belongs to:

Registrant:
R**** Z****
{Redacted}

miami, Florida 33138
United States

Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: MARCUSLAWCENTER.COM
Created on: 16-Oct-09
Expires on: 16-Oct-11
Last Updated on: 25-Jan-10

So i opened the doc file expecting maybe a macro or something.  No macros found, and it passed my initial av scans.

When i opened it i found this..

image

So why not just send me the PDF directly?  Why package it directly into a word document?  So i look at the properties of the “pdf”  AH HA!

image

in side of there is an executable waiting to be ran.

Symantec 10 didn’t find anything wrong with this file but Sophos did detect it as Virus/spyware Rooj/Resdro-C

as a side note, Marcus Law did remove the link and placed an alert on their website.  They have made an effort to thwart off any further infection.  This should be an example however to all admins of websites to ensure the security of your servers, keep up to date with patches and fixes and lock those servers down as much as possible.

  • March 24, 2010
  • By John
  • Comments Off on Mac's view of Windows
  • in geekstuff, humor

Mac's view of Windows

Here at my new job, the ratio of PCs to Mac's is about 50/50.  Today i was showing one of the professors that instead of buying a bulk of usb drives to share data between his staff, they could just all put it on one of our servers.  So i was doing some testing on his mac and when i went to browse to the server the icon looked strangly familar.  Not the typical windows icon i would expect but the icon looks liked the BSoD!

I wasn't sure if this was really what i was seeing until i "google'd" it and sure enough found this site

http://www.hongkiat.com/blog/mac-loves-windows-blue-screen-of-death/

http://www.engadget.com/2007/10/30/mini-how-to-remove-the-windows-bsod-icon-in-leopard-make-os-x-a-little-less-smug/

I guess it's just mac's way of poking fun of such a superior OS or just the best way users identify with the windows os?  Either way.. i got a slight chuckle out of it.

Contact me

Using the contact form to send me email at below

Keep in touch with us

You can use the following information to contact us if you wanna join us or anything need to communicate.

Name: john
Skype: john-munoz