26Nov2011 – “Hi we have detected you are missing files from your computer”

Posted on by dragonnefyre

Hi Everyone,

Have you had one of those calls, someone who says they are from Microsoft tells you that they have detected missing files an your PC and need access to fix it? I have, last year I think it was. And I know someone a few weeks ago who had one as well. However they were busy and said to call back later and speak to their son because they had to go out. They did not call back. Funny that.

You should be aware, that nobody is going to have access to your PC across the internet unless you have given them access. That is something you should _not_ do. Unless of course it is someone you know and they are going to help you with a problem with your PC. Someone you can trust. Someone you have already told about the problem you are having with your PC.

If they claim they are from Microsoft they are lying. Unless you gave them your number. Why would Microsoft keep an eye on your PC and let you know when it has problems? That would have all sorts of implications. But that is a subject for an other post.

Unfortunately some people fall for these scams and end up with their PCs being infected with key loggers, password stealing trojans and other malware. the more people read this the better. If you know about this scam but know people who may not, then please let them know. Tell them, nobody is going to be able to tie together their PC to their phone number (except of course for their ISP if they provide their phone number and broadband or they provide broadband and have their contact details).

It boils down to this – anyone can call you and pretend to be anyone they want if it will get them access to your PC, or even your house. Just because someone calls you and says they are from company XYZ does not mean that they actually are from company XYZ.

This also applies to people who call from, say, your bank. Do _not_ take their word for it, call the bank back on the number you know is the banks number.

And yes, I know some people who may fall for something like this so I try to make sure they don’t. And one way is to put posts like this on my blog. This blog.

Thank you for reading. have a very good day. And night.

14Oct2011 – scam email supposedly from the Co-Op bank

Posted on by dragonnefyre

Just had another phishing email, this time for the Co-Operative bank. They don’t stop do they? The email address to send scam or phishing emails that are ‘supposedly’ from the Co-Op Bank is ihaveseenascam@co-operativebank.co.uk. The headers are included after the email. The link to click on leads to http://anahaberler.xx/xxxxxxx.php. The email comes from spant@ptd.net. I have seen a few coming from ptd.net in the last few days. Maybe someone will shut them down quickly.

Surely the banks out there should send emails to their customers giving them info on this sort of thing and how to avoid them. And don’t click on links in emails. It is just as easy to type the address in if it is one you know to be safe, like http://www.co-operativebank.co.uk.

Email :

We are receiving complaints from our customers for unauthorised use of the Cooperative Online banking accounts. As a result we are making an extra security check on all of our Customers account in order to protect their information from theft and fraud. Due to this, you are requested to follow the provided steps and confirm your Online Banking Details

At Co-operative Bank, we take the job of protecting our customers very seriously, so for your protection we are proactively notifying you of this activity.

To restore access to your online banking please click on the link below.

http://www.co-operativebank.co.uk

Kind regards
Jayashree C
Co-operative Internet Banking Customer Support
Because email is not a secure form of communication, this email box is not equipped to handle replies.
If you have any questions about your account or need assistance, please call the phone number on your statement or go to Contact Us at www.Co-operative.co.uk

Headers :

——– Original Message ——–
From: - Fri Oct 14 01:31:37 2011
X-Account-Key: account4
X-UIDL: AIa97k0AABuNTpa0DgXBvSKOjfU
X-Mozilla-Status: 1001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
X-Apparently-To: xxxxxxx@xxxxx via 77.238.189.134; Thu, 13 Oct 2011 09:49:02 +0000
X-YahooFilteredBulk: 204.186.204.106
Received-SPF: pass (domain of ptd.net designates 204.186.204.106 as permitted sender)
X-YMailISG: karg6QQWLDv4FIfjyZm9qld_zjzLBijj_KLI_kNi14f6UJ8e RVSf_T6zGSIjuHvJk4d56aGVz6I5iV.x5CsgWBPAXbMhyI4BJM1mi2QzgZo. 9LhEgwBC_kyks068SD2TcxVnczm1ZkLMq3XjH4jRBycHsesf_OlvH8KI4hEP oUrQgxeCNldq2.mSRPoBJQNAkiS7VQBR5hHc8tZqXoFseZU7dhvdyGGPqBZL jE_TMY1dOEvxy61XL_E0sT6oT1vw3EuzBRT2D6QXT2F7Ab1szRVF6GGmgYgS ekSLy6C3.LMz8CcpPUmxktfFDPhTTAGcjUZCHOe8qkOTMlVlYm4ncTRD7b0w QQYeGg_Qqez5GwDkqc.7jUuOPrz1fG6HlU9XZT2teQG_Elw7SSLyzoitHm2L Hc2IaBRRXv5zrx_Xn.p7AuJ6D8BQSED1CRWmMtguTumwgN9XH75t8X9WH7iB FIErJf6l5cVv.aE65odZpgVX2jIqZ22_tzNZJvMeQdNGo8Lgn0P.bfIommQp RCPikEtdQ5V999ys8qvxylSME0kZ2tx8ANOtdMpeHARVLR73QfeFmYH0GnCV VFo3_6PrPrnrLrg7BkfgXHQw81JcoJnYCDcaYj2Gsjf6.SS7Kx1DB4qNyK4n ncm2OhrLQrgV7HJ_lWwJFAYLl9kp9X3i7qaUSqlfY94y8v1lcFMpNeUwAXB8 BjIso0hSBAXDw_vNlmrVEq9Y31rEdJeqjSAjWr6ib8GRUv3HJqKmmPNm0RUZ jRaJHMjL7smXPBEAPqMFcV48c3cRdDcel7etS43MFsfVIsGB54I6RoaHz9vf IQyHKxASZkSgflT2hmYNMZgRxtfdoEfaNL.lLDpz0ptMqDFfr2VYxXil8dRM DVdEm5P0NajaBc3ZyRDv4l_93UsMd141G0e4i9U6cFEn7OIzUyOhopSNv7tJ 4oQPleeUxjNKZbXLa3TSOfu.KHwbhyYJWdAC6f4yb466PaoOdLGbK6SO6Es5 DUnoTpytzHgY06ZDVyOpfV4rxEjFMXKDtdfB_DwTptMaFnnWeKqYnVVOfPDK 4L6YCgbPvDmZgltF9CvGff.uQDA7OkpVnaPmh5isSA3ODvlQb0FQt28WMFg1 QkzmWSKRmBeV7tXBZBr9BBJT2Sp1A9ce8XFxQqAZG0FYQuTsTAInZnUcjblP otyxwZhHFqHNj6YxuZNx0npDdZBRa4M3oyKlTUv.XgVJMIQQy0zspDdttHJm n6jUbcckikKEafU-
X-Originating-IP: [204.186.204.106]
Authentication-Results: mta1063.mail.ukl.yahoo.com from=ptd.net; domainkeys=neutral (no sig); from=ptd.net; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO proxyz14.mailnet.ptd.net) (204.186.204.106) by mta1063.mail.ukl.yahoo.com with SMTP; Thu, 13 Oct 2011 09:49:00 +0000
Received: from localhost (localhost.localdomain [127.0.0.1]) by proxyz14.mailnet.ptd.net (Postfix) with ESMTP id 5741D1108F33; Thu, 13 Oct 2011 05:48:58 -0400 (EDT)
X-Virus-Scanned: amavisd-new at
Received: from proxyz14.mailnet.ptd.net ([127.0.0.1]) by localhost (proxyz14.mailnet.ptd.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bnavupgvx3wx; Thu, 13 Oct 2011 05:48:57 -0400 (EDT)
Received: from User (unknown [95.56.94.194]) (Authenticated sender: tjhe) by proxyz14.mailnet.ptd.net (Postfix) with ESMTPA id 68E8D1108F42; Thu, 13 Oct 2011 05:48:20 -0400 (EDT)
From: The Co-operative
Subject: [Bulk] Important Message From Co-operative Internet Banking
Date: Thu, 13 Oct 2011 10:48:43 +0100
MIME-Version: 1.0
Content-Type: text/html; charset=”Windows-1251″
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id:
To: undisclosed-recipients:;

21Apr2011 – Student Loan Payment Processing Error! phishing email

Posted on by dragonnefyre

Hi,

It has been a while since I last added a post. Today I received a phishing email for Student Loan Payment Processing Error!. It supposedly came from notifications@slc.co.uk. Obviously a forged email address, especially when you look at the full headers.

If you get this email don’t click on any links, just forward it to phishing@slc.co.uk preferably with the full headers. Remember – never click on a link in an email unless you really do know where it has come from and the source is trusted, say like when you get a password reset email from your one of the websites you regularly log into, eg WordPress

The body of the email is below. At the top there was a box which says undefined in it, so definitely an error there.

Email :

This is a message for all students receiving grants and loans from the Students Loan Company. You are required to verify your account information in order to avoid any delay in your loan/grant payments. Do this here now by visiting http://www.studentfinance.direct.gov.uk/

Yours Sincerely
Student Finance England

Please do not reply to this email as it has been automatically produced from an address which cannot accept incoming mail.

*******************************************************************************
The information from the Student Loans Company Ltd contained in this e-mail is private and privileged. If you have received this e-mail in error be advised that any use is strictly prohibited. Please notify us and delete the message from your computer. You may not copy or forward it or use or disclose its contents to any other person.

As internet communications are capable of data corruption it may be inappropriate to rely on advice or opinions contained in an e-mail without obtaining written confirmation of it. This footnote also confirms that this email message has been swept for the presence of computer viruses, however we do not accept any liability or responsibility for resultant virus infection. Opinions and views expressed in this e-mail are those of the sender and may not reflect the opinions and views of The Student Loans Company Limited.

The Student Loans Company Ltd registered office is at 21 St Thomas Street, Bristol, BS1 6JS and it is registered in England Company No. 02401034, VAT No. 556 4352 32.
********************************************************************************

End of email

For those who may be interested, here are the headers form the email. I have replaced my email address with me@myemailaddr.ess :

From – Thu Apr 21 09:14:36 2011
X-Account-Key: account3
X-UIDL: 46c13a4a000005ba
X-Mozilla-Status: 1001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path:
Received: from smtp4.clear.net.nz (smtp4.clear.net.nz [203.97.37.64])
by s1b.uklinux.net (8.12.11.20060308/8.12.11) with ESMTP id p3L8G2Zm009040
for ; Thu, 21 Apr 2011 09:16:38 +0100
Envelope-To:
Received: from User
(host86-136-96-98.range86-136.btcentralplus.com [86.136.96.98])
by smtp4.clear.net.nz (CLEAR Net Mail)
with ESMTPA id for
me@myemailaddr.ess; Thu, 21 Apr 2011 20:11:16 +1200 (NZST)
Date: Thu, 21 Apr 2011 09:11:14 +0100
From: Student Finance England
Subject: Student Loan Payment Processing Error!
Reply-to: webmaster@slc.co.uks
Message-id:
MIME-version: 1.0
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
Content-type: text/html; charset=Windows-1251
Content-transfer-encoding: 7bit
X-Priority: 1
X-MSMail-priority: High
Status:
X-P3Scan: Version 2.3.2 by /

I hope this stops anybody getting their details robbed and their bank account emptied.

Andy.

05Jan2011 – Lloyds TSB and more phishing emails

Posted on by dragonnefyre

Hi Everyone,

The phishing emails are doing the rounds again, this time for Lloyds TSB. If you get an email that looks like it is from your bank it shouldn’t be asking you to click on a link or provide any of your banking details or personal details.

Here is the email I received :

From “Lloyds TSB Bank”
To

 

Our Valued Customer,
You have (1) Unread Secured Message !
Sign In To Online Service
Thank you for helping us to protect you.
Security Advisory
Lloyds Security Team

So now they are trying a different format. Usually it is one that states you must sign into your account or it will be disabled, or, it has been accessed from aaa.bbb.ccc.ddd (an IP address) and you just login to confirm your security details.

Unfortunately some people do follow those links. Don’t. If in doubt call your bank on a number that you know will definitely get you through to them.

Always treat these emails with suspicion. Never click on links in them. Don’t let these emails bully you into doing something you shouldn’t and don’t let them make you fear the consequences of not clicking on the links. You could ask friends or call the bank. It doesn’t take long.

Andy.

15Dec2010 – keep getting called by 07589 000595

Posted on by dragonnefyre

Hi All who read my blog,
Soem of you may have had calls from the number in the subject, 07589 000595. I have searched for that number on the net and only found entries for it at WhoCallsMe.

It starts with a recorded voice saying he is calling from the approvals team and wants to chat about your loan. Press 5 to continue. I need to call my telco and see if they will block the number as I am treating them as nuisance calls. If I have to, I will get the Police involved.

Have any of you out there had calls from this number? Found out who they are? I suspect the numbers that are called are computer generated. The Truecall would probably stop them. Might have to invest in one to stop these nuiscance calls.

11Dec2010 – Ideal World and their online ordering system

Posted on by dragonnefyre

Hi Everyone,

A slightly different topic today. Ideal World’s online and telephone ordering system. I know someone today who tried to order something from them today but had problems at the checkout. It says on their site that items should be in your basket for at least 30 minutes. However, when she was at the checkout, 20 minutes after adding the item to her basket it disappeared.

I wasn’t watching at the time, but I know she can order from the QVC site very easily indeed, so it seems to me that Ideal Worlds online ordering system is perhaps not as user friendly as it should be.

If you order by telephone you have to call 09056 48 48 48 which costs 20p per minute which is damned expensive. You can see their info on phone calls on their Contact Us page which states :

Telephone Numbers:

08431 680 680 – Ideal World Customer Services (Open 24 hours a day, seven days a week)

09056 48 48 48 – Automated Ideal World OrderLine (Calls cost 20p per minute from BT landlines, other networks and mobiles may cost more)

08431 681 000 – Create and Craft Club Member Helpline (Open 10am to 4pm, Monday to Friday)

I have searched for alternative numbers and there don’t appear to be any. The usual site I check for alternative numbers is Say No To 0870 but there are none on there except the alternatives for 0870 numbers. Alternative numbers for Sky are on there as well (for UK residents), very useful if you don’t want to pay stupidly high prices for phone calls to Sky.

When you call the orderline to order, you are speaking to someone in India apparently. Not had to do it myself.

Feedback I have been getting is that a lot of people won’t order from their website because it is so difficult to use. And if you do decide to call, that’s 20p per minute. I wonder if anyone from Ideal World will be reading this. Perhaps they could reply to this post as to why it costs 20p per minute to call their helpline/order line? Another tv retailer (QVC) has freephone numbers and their website is easier to use. Perhaps someone at Ideal World should take note. It won’t be the developers, it will be the business people who decide how the website should look and how it should work. You’re the people who take note. Yes, you sat behind your desk who thinks he knows it all and this is how websites should work. Listen to what your customers tell you and act accordingly.

If you don’t listen to your customers, they go elsewhere. No customers, no business. And bring your call centre back into the UK, with free, or, at the very least very cheap rate numbers.

There, I’ve had my say. Publishing this a couple of days late, but I’ve been busy. So, who is going to be first to post a reply? Go on, it’s easy. Let’s see if this is going to be a big discussion. Maybe Ideal World will sit up and take notice, especially as this is on the net for all to see.

Go on, you know you want to have your say.

19Nov2010 – scam Facebook email with trojan

Posted on by dragonnefyre

Hi Everyone,

Another scam email about your Facebook account sending spam and being locked out. Here is the email :

From (apparently!) : support.nr.7921@facebook.com
Subject : Facebook Support. Your account is temporarily blocked. ID302

Body text :

Good afternoon.A spam is sent from your Facebook account.
Your password has been changed for safety.

Information regarding your account and a new password is attached to the letter.
Read this information thoroughly and change the password to complicated one.

Thank you for your attention,
Facebook Service.

The attachment is called Facebook_document_Nr2509.zip. Accoridng to GMX’s antivirus it contains Trojan.Sasfis. According to Clamav 0.96.4 it contains Suspect.Bredozip-zippwd-3. Either way it’s a Trojan.

If you get one like this delete it. You know it makes sense.

Now for the technical stuff, the full headers, for thpose who may be interested :

Received SPF fail (mta1002.mail.ird.yahoo.com: domain of support.nr.7921@facebook.com does not designate 66.238.61.123 as permitted sender)

XYMailISG o9UN4wEcZArqRdBZKYHiGCJeYcPyix2g_RvTxanQClvkpAxu bBtnTBUs3j8DwNQjwc2TOzLDNo5WGbDsIeXONI4zF2PpCWc05vPxiIDEDiQT 1zdhUKHz5QKev_1bxJqSFwwRdLNDk7a2PHD0qVZQZksH8reHHyBnf.Fq8l1D wo2lgHfQPgNM9d8ADs60Rz3wz20azgWicJxwm65UEAeAAcZjCvizyYcjAqQU VHgVMINkYS1SX4t4iMlWEqOJmIhLez8zKJ4HqLHlRLgNUUoyrdtH1rBqrPmZ kU6mgBt_PnDIFK9pTBFd.uORxzhlOBuYh7jAnWtdfnNjMBkQjNa.nHjC6gQt k7joEoGnYagx2yHGBzjrCD980SL_q3Q2mJmkIYuZn3nNLDHGsdO8k4H2JTk1 BWS2thTn8Qr7ziMWYKa6iF_Q.hVyZG04.MLnuRtUovGKhcBCH63GlgCYWR1Q jMgm_LKPI0pNiyVbytZ2Q.3TCilYnJlacPZSx_BRwWLWsCdyfGH5WLIlLA2x AIcNH1n.rpZeoMND7d7n9Obk1ZH5KVKuI4BaihxGUI8bLFuRhUFzXdEx1j__ 0DDXkutG1Lu3l7alL9lIxpM_Wmctp7GKYeR3x6tWM5XKqzsA8eIShtxytRa_ 8co5E6beYCofny1_X1lgqHqobL9wXD.oLzTW1MAFpWY3Quox_rekGgpGU5wO .gCNfwE2FsHUEacP2XFIImrciFTkuz4XLLMU48rMQcfQtdBrQcjnCMquqgT5 WMvttSvhdMzj.7gWqoemaea1JbBQ_iFr5rQThaPV946F1SpQfTw93g_Y9NBU CUldx4rJnI6LUCaXisPIU8IdA63_3Ht63SW0ZKB_12CtA24JunOuNQVHQH7I xqEskx1l60SdDT.QR4clDMR2x9HFqWkvVR57PxhB6FLaw4X2ptIYswS0ZSR9 MEsphqDhjforigLdUcuyVEWyosqvbZA7XbNHgPAZTQQpI05Ti1xtFPNphQns f._7nz.D.kKibbPQTS49m1PiAR31h8SWhv4bNW8C0iBod8So9z8E.9BpsqjE .nGNeYPEA56SoRDPy3p9LxNZciKsQpEMqlyH9UcOHfL3y1EU52RSvjrjWZRR VxZHo_orb7YE3jkPZMus4R7O0SCl0BPaaIBCzJSQ1EMj15S0SvSBFxqDyxBg waYjONMbyY4nIOXSFnaWl2jMMwl9WhzrUOUIL2Wwz7w-

X-Originating-IP [66.238.61.123]

Authentication-Results mta1002.mail.ird.yahoo.com from=facebook.com; domainkeys=neutral (no sig); from=facebook.com; dkim=neutral (no sig)

X-Mailer Microsoft Outlook Express 6.00.2900.2180

So, it looks like it was sent form a Windows PC, infected no doubt.

Dragonnefyre.