Welcome to DKR Computing

DOH!

Sunday, 22 November 2009 20:28 Keith Rice

I was just going back and looking at some of the different spam/malware emails I've gotten over the last couple of months and ran across one that said the following:

From: DHL Delivery Services
Subject: DHL Delivery Problem Number 31965
Date: 10/6/09 4:09 AM

Hello!

Unfortunately we failed to deliver postal package sent on the 8th of June in time
because the addressee's address is wrong.
Please print out the invoice copy attached and collect the package at our office.

DHL Delivery Services.

There was one slight problem though. They forgot to attach the "invoice copy." :-)

Add new comment

Last Updated on Sunday, 22 November 2009 20:43

Spam/Malware Report - November 21, 2009

Saturday, 21 November 2009 23:59 Keith Rice

Starting at 9:56 AM CST on Friday, Nov. 20th my spam traps started receiving emails that claim to be from several of my domains telling me that I need to "change the security mode on my account, from standart [sic] to secure". Here's the text of the mail with the email address masked to protect my spam trap addresses and the link deleted:

Dear owner of the [email address] mailbox,
You have to change the security mode of your account, from standart to secure. Please change the security mode by using the link below:

[LINK DELETED]

When you click the link, you are taken to a web page that tells you that you do not have Macromedia Flash installed.

DNS Problems

Saturday, 07 November 2009 16:03 Keith Rice

Let me apologize to those of you who may have experienced problems reaching any of our websites today. We completed the last part of our move to a our new hosting provider last night but overlooked some DNS configurations that needed to be updated. Those have now been corrected but it may take a few more hours before the changes propagate across the DNS root servers.

We apologize for the inconvenience and thank you for your patience.

Regards,

Keith Rice

Add new comment

Last Updated on Saturday, 07 November 2009 16:04

New Spam/Malware Campaign

Thursday, 19 November 2009 12:46 Keith Rice

Starting the morning of Tuesday, November 17th, my spam traps have been receiving mail with subject lines like:

payment request from "Gatorade"

The body of the emails read:

We recorded a payment request from "Gatorade" to enable the charge of $365.24 on your account.

The payment is pending for the moment.

If you made this transaction or if you just authorize this payment, please ignore or remove this email message. The transaction will be shown on your monthly statement as "Gatorade".

If you didn't make this payment and would like to decline it, please download and install the transaction inspector module (attached to this letter).

The company name and the reported charge amount change from message to message, but the "transaction inspector module" remains the same, a file named "module.zip". Inside that is a file named "module.exe" which, when run, installs the Sasfis.C trojan that downloads other types of malware.

Read the VirusTotal report here.

As always, never open email from someone you don't know and never open unexpected file attachments even if they come from someone you know.

Tcpcheck 0.01 Released

Wednesday, 04 November 2009 11:44 Keith Rice

Our first utility, tcpcheck, is now available for downloading!

Tcpcheck simplifies the task of checking if a remote host is listening on a specific port with out having to use telnet to connect to the port, press Ctrl-], and enter "quit". All you need to do is run "tcpcheck host port", where host is the name or IP address of the remote host, and port is the name or number of the TCP port you wish to check.

To download tcpcheck, click on the "Downloads" link on our Main Menu. It's available in the "Networking" category. It should be pretty easy to find since it's our only available download at this time. :-)

Check it out and please let us know what you think!

Add new comment

Last Updated on Friday, 06 November 2009 17:42

More Articles...