Posted on

09-Jul-2007

Disaster tolerance
To prove a point, take a look at this video (it links you to YouTube). This is why I’d prefer OpenVMS over any other OS in case of an emergency: just count the seconds ticking away!

(These systems were set up by people that know how to configure these systems, and they know more about it that I do. I haven’t setup my systems to be as disater tolerant as this – it would blow the roof of my house, if not more – but it proves a point, doesn’t it?. 13 seconds (and a bit more) for OpenVMS where Linux barely made it within the required 2 minutes….)

Posted on

Added alerts

Alerts added
I received a message today that is so obviously an attempt to install malware, that I decided to create a category to hold alerts. Not that it would help very much, most users will nver learn to think before they follow a link, but no-one can now tell they haven’t been warned…
I know it’s their very own responsibity but on the other hand, if ISP’s tend to send messages like this, they should at least warn their users for mails like this.
I get more and more of this messages – it would be a good idea that the ISP’s block these abusers _completely_, but I doubt they ever will.

Posted on

Alert 09-Jul-2007

Don’t reply on this:

Subject line:

Worm Alert!

Message body:

Dear Customer,

Our robot has detected an abnormal activity from your IP adress
on sending e-mails. Probably it is connected with the last epidemic
of a worm which does not have official patches at the moment.

We recommend you to install this patch to remove worm files
and stop email sending, otherwise your account will be blocked.

Abuse Team

(“this patch” is actually a link:

<a href="http://68.61.229.214/?7703a3b01bdad81d9b848ca9a885b5e6291c3d">this patch</a>

and will very likely install a worm, backdfoor, virus of other malware on your system.

The header that I found was:

X-McAfeeVS-TimeoutProtection: 0
Return-Path:
Received: from grootstal.nijmegen.internl.net by hees.nijmegen.internl.net
via grootstal.nijmegen.internl.net [217.149.192.7] with ESMTP for
id l69JQmRx021094 (8.13.8/2.11); Mon, 9 Jul 2007 21:26:48 +0200 (MEST)
Received: from 248.145-62-69.ftth.swbr.surewest.net by grootstal.nijmegen.internl.net
via 248.145-62-69.ftth.swbr.surewest.net [69.62.145.248] with SMTP for
id l69JQjFj012570 (8.13.6/2.05); Mon, 9 Jul 2007 21:26:47 +0200 (MEST)
X-RelayHost: 69.62.145.248
Received: (qmail 24120 invoked from network); Mon, 9 Jul 2007 12:26:42 -0700
Received: from unknown (HELO crs) (98.132.150.165)
by 248.145-62-69.ftth.swbr.surewest.net with SMTP; Mon, 9 Jul 2007 12:26:42 -0700
Date: Mon, 9 Jul 2007 12:26:42 -0700
To: willem@grooters.100.nl
From: “Abuse Team”
Reply-to: art@hyde-housing.co.uk
Subject: Worm Alert!
Message-ID:
X-Priority: 3
X-Mailer: PHPMailer [version 1.72]
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=”windows-1252″
X-Language-Detected: en
X-Spam-Scanned: InterNLnet Mail Scan System V2.03

and the address is an anonimized one (doesn’t lead to a real address)