I noticed a few emails with the subject "Credit card account statement (Visa, MC)", and decided not to let OzEfilter delete the email, so I could check the contents.
The start of the message in the emails was the following:
Dear Valued Customer:
ID: - user name for a valid email address -
As requested, we are sending you this account statement with information on the transactions carried out with your credit card between 1/1/2008 and 8/1/2008.
The email also had an attached zip file "Statement.zip", which contained the file which appeared to be "Statement.doc". This is where the virus writers trick people into thinking it is a just a Word document. The virus writers create a very long file name filled with lots of spaces, so the real file extension of "exe" is not easily visible. The real file name is something like the following:
"Statement.doc exe"
This is similar to the "statement of fees" virus recently, which has infected a lot of people.
The Desktop anti-virus client, and the mail server anti-virus software, did not stop this email from getting through. The email address is a random user name, which is also a good indicator this is a malicious email and would be obvious to OzEfilter users.
The last couple of weeks has shown it is pretty obvious that most anti-virus software packages won't protect you from new viruses, as the anti-virus software can take days to be updated and by that time thousands of people have damaged their computers. Care with emails is vital.
A simple trick to protect you from viruses targeted at your banking facilities is not to provide your email address to your bank. I don't provide my email address to banks and I advise others to have their email address removed from their bank details. Then you know every email from a bank is most likely malicious or unwanted email.
Please take care.
- Kelvin Eldridge
Tuesday, September 16, 2008
Monday, September 15, 2008
New Australian English spellcheck file for Internet Explorer 7 and 8 (beta).
Version 3.0.0 of the Australian English spellcheck dictionary files are now available for use with Internet Explorer 7 and Internet Explorer 8 beta 2.
The new files contain around 40,000 more words than the previous versions I created. There are two versions, the full version which is equivalent to a descriptive dictionary, and the Kelvin version which is a prescriptive dictionary. The prescriptive version of the dictionary aims to provide the preferred spelling of words such as "organise", but not "organize". The choice however is up the you as to which spellcheck dictionary you wish to use.
The dictionary files are available via the dictionary project page or directly on the Internet Explorer page of the dictionary project.
Happy spellchecking.
- Kelvin Eldridge
The new files contain around 40,000 more words than the previous versions I created. There are two versions, the full version which is equivalent to a descriptive dictionary, and the Kelvin version which is a prescriptive dictionary. The prescriptive version of the dictionary aims to provide the preferred spelling of words such as "organise", but not "organize". The choice however is up the you as to which spellcheck dictionary you wish to use.
The dictionary files are available via the dictionary project page or directly on the Internet Explorer page of the dictionary project.
Happy spellchecking.
- Kelvin Eldridge
Friday, September 12, 2008
V3.0.0 of the Microsoft Exclude Dictionary now available.
Many people consider the "ize" spelling of words to be American English and not Australian English. I've heard of academics marking students as being wrong for using "ize" spelling. I have many people applaud my work reclaiming the Australian English language and getting rid of the Americanisms.
The reality is far from any of the above. In Australia our language has evolved and both "ise" and "ize" and valid ways to spell words. So whether you use "organise" or "organize" you are correct.
To me however I think this is confusing. There are thousand of words in our language where there are two ways to spell the same word with the same meaning and that leads to inconsistency in documents and confusion for the next generation.
For OpenOffice.org users I produce the Kelvin version of the dictionary files which removes the secondary spelling variations so there is a single way to spell a word. This is a much cleaner and consistent way to work. It is actually what is known as a prescriptive way to spell.
But I can't replace the Microsoft dictionary. What I can do however is to provide an Exclude file which produces a similar result. For those who want "organize" to appear as a spelling error along with thousands of other similar words the Exclude file is for them. For those who want to use "ise" spelling because that is what their lecturers want, the Exclude file is for them. For those who want consistent spelling in their documents such as when they copy and paste work together, the Exclude file is for them. For those who want to make spelling simpler and more consistent for their children, the Exclude file is for them.
It is sometimes considered wrong to spell using the secondary spelling of a word, but it is not considered wrong to use the main spelling. It is always considered wrong to spell using different spelling of the same word in a document, and that happens very easily when copying and pasting work.
Check out the Exclude file and add polish to your written work.
Enjoy.
- Kelvin Eldridge
The reality is far from any of the above. In Australia our language has evolved and both "ise" and "ize" and valid ways to spell words. So whether you use "organise" or "organize" you are correct.
To me however I think this is confusing. There are thousand of words in our language where there are two ways to spell the same word with the same meaning and that leads to inconsistency in documents and confusion for the next generation.
For OpenOffice.org users I produce the Kelvin version of the dictionary files which removes the secondary spelling variations so there is a single way to spell a word. This is a much cleaner and consistent way to work. It is actually what is known as a prescriptive way to spell.
But I can't replace the Microsoft dictionary. What I can do however is to provide an Exclude file which produces a similar result. For those who want "organize" to appear as a spelling error along with thousands of other similar words the Exclude file is for them. For those who want to use "ise" spelling because that is what their lecturers want, the Exclude file is for them. For those who want consistent spelling in their documents such as when they copy and paste work together, the Exclude file is for them. For those who want to make spelling simpler and more consistent for their children, the Exclude file is for them.
It is sometimes considered wrong to spell using the secondary spelling of a word, but it is not considered wrong to use the main spelling. It is always considered wrong to spell using different spelling of the same word in a document, and that happens very easily when copying and pasting work.
Check out the Exclude file and add polish to your written work.
Enjoy.
- Kelvin Eldridge
Version 3.0.0 of the Australian English dictionary for OpenOffice.org 3 beta and 2.4 available.
Hi,
After a considerable amount of work, I'm pleased to say the latest version of the Australian English dictionary files for OpenOffice.org 3.x beta and OpenOffice.org 2.4 are now available .
The dictionary has been completely built from scratch. The new version is more localised for Australians and comes in at over 160,000 words, compared with my old version of 119,000.
A very pleasing part has been to include the names of people contributing in the dictionary. If you've contributed recently, don't be concerned if your name is not in the dictionary files. I had to freeze the files a few weeks ago and your name will be in the next minor release. Thank you for contributing and I hope you feel proud when you know you name is now correct in the spellcheck.
The dictionary is now copyright so you know your contribution goes towards building better spellcheck dictionaries for Australians. It also means things are a lot clearer for developers wanting to use the dictionary files.
I hope everyone finds the new dictionaries even better and if you find any omissions or errors, please let me know.
- Kelvin Eldridge
After a considerable amount of work, I'm pleased to say the latest version of the Australian English dictionary files for OpenOffice.org 3.x beta and OpenOffice.org 2.4 are now available .
The dictionary has been completely built from scratch. The new version is more localised for Australians and comes in at over 160,000 words, compared with my old version of 119,000.
A very pleasing part has been to include the names of people contributing in the dictionary. If you've contributed recently, don't be concerned if your name is not in the dictionary files. I had to freeze the files a few weeks ago and your name will be in the next minor release. Thank you for contributing and I hope you feel proud when you know you name is now correct in the spellcheck.
The dictionary is now copyright so you know your contribution goes towards building better spellcheck dictionaries for Australians. It also means things are a lot clearer for developers wanting to use the dictionary files.
I hope everyone finds the new dictionaries even better and if you find any omissions or errors, please let me know.
- Kelvin Eldridge
Virus alert: Reply: A report on radiation contamination of Australia
The Internet presence of JustLocal means we receive a lot of unwanted emails. That's OK, because it also means I can often see new virus outbreaks and this blog lets my clients know.
I use OzEfilter (and so do my clients) so I can review and delete emails from people I don't know at the mail server, without letting potentially dangerous emails into my computer. I often wonder how people can work in this day and age where they receive tens of potentially dangerous emails each day. Over a year that's thousands of chances they take where they could infect their computer. These viruses are not picked up by the leading anti-virus software packages and once the anti-virus software is updated days later, the virus outbreak will have affected thousands of people, which is confirmed by my site statistics.
The latest virus comes in an email with the subject: "A report on radiation contamination of Australia". I would normally delete at the mail server using OzEfilter, but for the benefit of my clients, I decided to receive and investigate the email.
The body of the email contains the following:
"On Internet forums there appeared messages of a powerful explosion at a Australia nuclear power station located in the suburbs of Sydney.. According to witnesses’ statements the explosion happened at about 3 pm on the 9th of September. ..."
The email contains an attachment victims.zip which contains the file victims.exe. An exe file is an executable file and whilst the zip attachment should be a warning, the exe file should is an obvious danger sign.
The virus infected email was not reported by our computer's anti-virus software and neither was it stopped by the anti-virus software on our mail server provided by the hosting company. The file has been submitted to the online scanning service provided by one of the leading anti-virus companies which service the corporate sector. Details of how to submit a suspicious file is included in MyAnswers solution 1885.
Please practise safe computing.
- Kelvin Eldridge
I use OzEfilter (and so do my clients) so I can review and delete emails from people I don't know at the mail server, without letting potentially dangerous emails into my computer. I often wonder how people can work in this day and age where they receive tens of potentially dangerous emails each day. Over a year that's thousands of chances they take where they could infect their computer. These viruses are not picked up by the leading anti-virus software packages and once the anti-virus software is updated days later, the virus outbreak will have affected thousands of people, which is confirmed by my site statistics.
The latest virus comes in an email with the subject: "A report on radiation contamination of Australia". I would normally delete at the mail server using OzEfilter, but for the benefit of my clients, I decided to receive and investigate the email.
The body of the email contains the following:
"On Internet forums there appeared messages of a powerful explosion at a Australia nuclear power station located in the suburbs of Sydney.. According to witnesses’ statements the explosion happened at about 3 pm on the 9th of September. ..."
The email contains an attachment victims.zip which contains the file victims.exe. An exe file is an executable file and whilst the zip attachment should be a warning, the exe file should is an obvious danger sign.
The virus infected email was not reported by our computer's anti-virus software and neither was it stopped by the anti-virus software on our mail server provided by the hosting company. The file has been submitted to the online scanning service provided by one of the leading anti-virus companies which service the corporate sector. Details of how to submit a suspicious file is included in MyAnswers solution 1885.
Please practise safe computing.
- Kelvin Eldridge
Wednesday, September 10, 2008
Things we say that are simply wrong.
I was recently talking with a Read's Office Supplies, a VPS partner, and for some reason I mentioned a black and white toner. Now I know the toner is simply black toner. But so many people ask for a toner so they can print in black and white, it is hard not to say black and white.
That made me think about the things we say frequently which are probably wrong, but once said often enough, become part of the language.
As the creator of the Australian English dictionary files which now help nearly a million people spellcheck their documents, I will admit I frequently flipped between writing spell check/spellcheck and spell checker/spellchecker. Then I read in a forum, where a person pointed out to others it is not a spell checker. You would use a spell checker to check a spell. Now since I don't know many witches or warlocks, I don't really think my dictionary work is for a spell checker.
A bit of checking and it becomes quite evident the forms should probably be:
I wonder how many other words or expressions we use in day-to-day life, which we don't realise are perhaps not quite right and the majority of people also use.
Using spell check is so common it would not be considered an error. For me now that I know better, I will be using the spellchecker to spellcheck my work for spelling errors;-)
Enjoy.
- Kelvin Eldridge
That made me think about the things we say frequently which are probably wrong, but once said often enough, become part of the language.
As the creator of the Australian English dictionary files which now help nearly a million people spellcheck their documents, I will admit I frequently flipped between writing spell check/spellcheck and spell checker/spellchecker. Then I read in a forum, where a person pointed out to others it is not a spell checker. You would use a spell checker to check a spell. Now since I don't know many witches or warlocks, I don't really think my dictionary work is for a spell checker.
A bit of checking and it becomes quite evident the forms should probably be:
- spelling check
- spellchecker
- spellcheck
- spell check is used three times as much as spellcheck
- spell checker is used three times as much as spellchecker
I wonder how many other words or expressions we use in day-to-day life, which we don't realise are perhaps not quite right and the majority of people also use.
Using spell check is so common it would not be considered an error. For me now that I know better, I will be using the spellchecker to spellcheck my work for spelling errors;-)
Enjoy.
- Kelvin Eldridge
Virus alert: I received a message from your bank
This morning I receive twenty spam or potentially dangerous emails and I used OzEfilter to delete nineteen of those at the mail server so I never receive them into my computer. However I decided to accept one which had the subject "I received a message from your bank". This email was repeated a number of times which is often an indication others will start receiving a similar email.
I scanned the attachment BANK_DETAILS.zip and my anti-virus software reported no problem, but this attachment has the form typical of malware. The file contained in the zip file is named BANK_DETAILS.exe and being an executable file there is without doubt this email contains malicious content. I would suggest that you don't check out the content of the zip file as you are only steps away from potentially infecting your computer.
The email starts with the message:
Yesterday I received a message from your bank with your account statement.
I dont need problems with the police because of your banks error!!!
Please contact your bank and ask them to not mistakenly send me your personal data to me.
It is a bit sad the aggressive tone of this email may trick some people into thinking their bank has made a mistake. It never ceases to amaze me the psychological tactics used by malicious software writers. A moment of weakness, a moment of vagueness is all it takes for the malware writer to achieve their objective.
Take care
- Kelvin Eldridge
I scanned the attachment BANK_DETAILS.zip and my anti-virus software reported no problem, but this attachment has the form typical of malware. The file contained in the zip file is named BANK_DETAILS.exe and being an executable file there is without doubt this email contains malicious content. I would suggest that you don't check out the content of the zip file as you are only steps away from potentially infecting your computer.
The email starts with the message:
Yesterday I received a message from your bank with your account statement.
I dont need problems with the police because of your banks error!!!
Please contact your bank and ask them to not mistakenly send me your personal data to me.
It is a bit sad the aggressive tone of this email may trick some people into thinking their bank has made a mistake. It never ceases to amaze me the psychological tactics used by malicious software writers. A moment of weakness, a moment of vagueness is all it takes for the malware writer to achieve their objective.
Take care
- Kelvin Eldridge
Tuesday, September 09, 2008
Client alert: Trend Micro Internet Security 2008 false positive issue.
Recently Trend Micro Internet Security 2008 reported two false positives, which removed the system files Ezcapt.exe and nlasvc.dll.
In MyAnswers solution 1900 I show how I restored the affected files. If you have found Trend Micro Internet Security to remove either of these files, act quickly and restore the files as these false positives damage your software installation.
- Kelvin
In MyAnswers solution 1900 I show how I restored the affected files. If you have found Trend Micro Internet Security to remove either of these files, act quickly and restore the files as these false positives damage your software installation.
- Kelvin
Virus alert: Western Union MTCN #218375813
I just noticed an increase of the occurrence of this malicious email in my OzEfilter log which I have reported before. Please take extra care.
The email contains the attachment FED655812.zip. In the zip file is the executable file FED655812.exe. It is obvious from the email it is from a made up email address.
The following is the start of the email content.
Attention! The wire sent to Vladimir Kirkorov, Moscow, Russia has been blocked by our security service.
Your credit card issuing bank has halted the transaction by the demand of the Federal Criminal Investigation Service (case No. 73491 since the recipient has been undergoing the international retrieval by the InterPol.
Most people delete these emails, but from our logs we can see that perhaps thousands get tricked.
Instead of deleting the email at the mail server as I normally do with OzEfilter, I allowed this email so I could check to see if this type of malware would be picked up by my anti-virus software. A scan of the file detected no malware and that is obviously not correct. The email attachment most probably does contain a malicious load. The file has been submitted to the online scanning service for verification mentioned in MyAnswers solution 1890.
To all clients and users of JustLocal please take care with any email received with attachments. For extra protection use OzEfilter and delete the email at the mail server safely away from your computer. Infected computers can cost hundreds of dollars to repair.
A few extra seconds when checking emails can save you a very costly repair expense.
- Kelvin Eldridge
The email contains the attachment FED655812.zip. In the zip file is the executable file FED655812.exe. It is obvious from the email it is from a made up email address.
The following is the start of the email content.
Attention! The wire sent to Vladimir Kirkorov, Moscow, Russia has been blocked by our security service.
Your credit card issuing bank has halted the transaction by the demand of the Federal Criminal Investigation Service (case No. 73491 since the recipient has been undergoing the international retrieval by the InterPol.
Most people delete these emails, but from our logs we can see that perhaps thousands get tricked.
Instead of deleting the email at the mail server as I normally do with OzEfilter, I allowed this email so I could check to see if this type of malware would be picked up by my anti-virus software. A scan of the file detected no malware and that is obviously not correct. The email attachment most probably does contain a malicious load. The file has been submitted to the online scanning service for verification mentioned in MyAnswers solution 1890.
To all clients and users of JustLocal please take care with any email received with attachments. For extra protection use OzEfilter and delete the email at the mail server safely away from your computer. Infected computers can cost hundreds of dollars to repair.
A few extra seconds when checking emails can save you a very costly repair expense.
- Kelvin Eldridge
Saturday, September 06, 2008
Google Chrome's impact on Internet Explorer and Firefox.
The recent appearance of Google Chrome raises the question, which browser will Google Chrome impact the most?
I read once that about 85% of the $65 million dollars of Firefox revenue is from Google, and if Google Chrome eats into the Firefox share, then Firefox revenue will obviously reduce and that could be a good substantial saving for Google. Internet Explorer on the other hand now has another browser to contend with.
Whilst it has only been a few days since Google Chrome was released, and our logs don't really provide sufficient volume to give concrete proof, there are some interesting figures starting to appear.
Google Chrome according to the site statistics, has quickly gained approximately 6% of the browser market share. For such a short time on the market, this is a fairly impressive start. Put into context, this has already passed Apple's Safari and Opera. So far what I have seen is the Firefox market share has reduced by 10% and Internet Explorer by 5%, so the impact has been greater on Firefox.
I do want to reiterate this information is based on a relatively low volume of data for the site where the data was available and I consider the volume to be fairly small and thus the information is not conclusive.
From my point of view this means for those developing web sites, we may soon need to be checking the layout using Google Chrome as well as Internet Explorer and Firefox. As the creator and maintainer of the Australian English dictionary files used by Internet Explorer and Firefox users, I will also be looking at how to patch Google Chrome, so users can use Google Chrome with an Australian English dictionary.
I hope others find this information interesting and of value.
- Kelvin Eldridge
I read once that about 85% of the $65 million dollars of Firefox revenue is from Google, and if Google Chrome eats into the Firefox share, then Firefox revenue will obviously reduce and that could be a good substantial saving for Google. Internet Explorer on the other hand now has another browser to contend with.
Whilst it has only been a few days since Google Chrome was released, and our logs don't really provide sufficient volume to give concrete proof, there are some interesting figures starting to appear.
Google Chrome according to the site statistics, has quickly gained approximately 6% of the browser market share. For such a short time on the market, this is a fairly impressive start. Put into context, this has already passed Apple's Safari and Opera. So far what I have seen is the Firefox market share has reduced by 10% and Internet Explorer by 5%, so the impact has been greater on Firefox.
I do want to reiterate this information is based on a relatively low volume of data for the site where the data was available and I consider the volume to be fairly small and thus the information is not conclusive.
From my point of view this means for those developing web sites, we may soon need to be checking the layout using Google Chrome as well as Internet Explorer and Firefox. As the creator and maintainer of the Australian English dictionary files used by Internet Explorer and Firefox users, I will also be looking at how to patch Google Chrome, so users can use Google Chrome with an Australian English dictionary.
I hope others find this information interesting and of value.
- Kelvin Eldridge
Wednesday, September 03, 2008
How to add JustLocal Search to Google Chrome.
On the JustLocal Search page I've provided links when allows anyone to quickly add a number of search engines to Internet Explorer and Firefox. This approach doesn't work with Google Chrome.
To add JustLocal Search to Google Chrome do the following:
Select the spanner (Customise) icon at the right.
Select Options.
Select the Basics tab.
Click Manage in the Default search section.
Click Add.
For Name: enter JustLocal Search
For Keyword: enter jl
For URL: enter http://www.justlocal.com.au/search.html?cx=016774990086709660772%3Affvugpo_ptg&cof=FORID%3A9&ie=UTF-8&q=%s#941
Click OK
Click Close
I thought this was a neat feature. Now in the address area of the browser I can enter jl and then what I want to search for and it will use the JustLocal Search engine. Very convenient.
What I thought was also good, is if you open a new tab, the JustLocal Search engine is presented at the right, which is pretty convenient. The only problem is Google Chrome does not render this page properly. The tenth item in the search list does not list, or list fully and the option to click additional pages for the search results is not shown. This is the first bug I've seen in Google Chrome. This page is rendered OK with Internet Explorer, Firefox, Safari and Opera (Safari and Opera add too much white space at the bottom of the page), but not with Google Chrome.
Bugs aside, with Google Chrome it is fairly easy to manually add your favourite search engine, which in my case of JustLocal Search.
Happy searching - Kelvin.
To add JustLocal Search to Google Chrome do the following:
Select the spanner (Customise) icon at the right.
Select Options.
Select the Basics tab.
Click Manage in the Default search section.
Click Add.
For Name: enter JustLocal Search
For Keyword: enter jl
For URL: enter http://www.justlocal.com.au/search.html?cx=016774990086709660772%3Affvugpo_ptg&cof=FORID%3A9&ie=UTF-8&q=%s#941
Click OK
Click Close
I thought this was a neat feature. Now in the address area of the browser I can enter jl and then what I want to search for and it will use the JustLocal Search engine. Very convenient.
What I thought was also good, is if you open a new tab, the JustLocal Search engine is presented at the right, which is pretty convenient. The only problem is Google Chrome does not render this page properly. The tenth item in the search list does not list, or list fully and the option to click additional pages for the search results is not shown. This is the first bug I've seen in Google Chrome. This page is rendered OK with Internet Explorer, Firefox, Safari and Opera (Safari and Opera add too much white space at the bottom of the page), but not with Google Chrome.
Bugs aside, with Google Chrome it is fairly easy to manually add your favourite search engine, which in my case of JustLocal Search.
Happy searching - Kelvin.
Google chrome now available, but no Australian English.
As the creator and maintainer of the Australian English dictionary files now used by an estimated million Australians, when I see new software I think you can probably guess my main desire is to see if it has a good Australian English dictionary. Even better is if the software can use the dictionaries I provide.
In this case Google Chrome does not currently have an Australian English dictionary. The next best option for Australians is generally to select British English. This is done as follows:
Select the spanner (Customize/Customise) icon at the right.
Select Options.
Select the Minor Tweaks tab.
Click Change font and language settings.
Select the Languages tab.
For Google Chrome language select English (United Kingdom).
For Spell checking language select English (United Kingdom).
Click OK
Click Close
Restart Google Chrome
Select Options.
Select the Minor Tweaks tab.
Click Change font and language settings.
Select the Languages tab.
For Google Chrome language select English (United Kingdom).
For Spell checking language select English (United Kingdom).
Click OK
Click Close
Restart Google Chrome
This now allows the word "colour" to be spelt correctly. Sadly the word "color" appears as correct as well, but this is still better than the default US English language. The good thing is words like "canceled" and "mom" now appear as an error. The British dictionary is better, but not as good as the dictionaries I provide. I will continue to check out Google Chrome and see if it is possible to provide the Australian English dictionary files for those who wish to use them.
Interestingly, even though Google Chrome now provides in-line spellchecking, the in-line spellchecking is not available when creating a blog entry using Google blogger. The best option (although it is still not that good) is to use Internet Explorer 7 with IE7Pro with the Australian English dictionary and force a spellcheck.
Happy Chroming, or for the rest of us, browsing.
- Kelvin
Friday, August 29, 2008
Virus alert: Western Union MTCN #0559760778
I noticed in my OzEfilter log this email starting to appear more frequently so decided to receive one into my email. It was not detected as containing malware by the anti-virus software when received. However when I saved the file to my Desktop the anti-virus software quarantined the file and that is a good sign.
The attached file in this case was named MT77232.zip.
The process I have been using to test these attachments is to save the file to my Desktop and then scan the file using my anti-virus software. I've found over the years anti-virus software leaves a window of opportunity from the time the virus is released into the wild until the anti-virus software companies get the updates out to users. This process can be a number of days.
To check the file because it really is obvious to me it is malware based on coming from someone I don't know with a subject that is obvious it has nothing to do with me I then check the file by sending the file to the online scanning service. The scanning service is run by one of the anti-virus companies and they use it to receive feedback from users and improve their product. (You can find details of the service in MyAnswers solution 1890 which can be found on the MyAnswers solutions page I maintain on virus, spyware/adware and spam.)
In this case the file was found to be malware so there is no need to submit the file to the online virus scanning service.
I've found in every case that I can recall with a virus infection that a user has initiated the infection by running a program. In most cases this is via an attachment in an email, but also by clicking on a link on a web page. Only once have I seen an infection occur by going to a web site and this issue was fixed when Internet Explorer SP2 came out. So in essence whilst the virus writers are an enormous nuisance, in order for the virus to infect our computers it requires our assistance. In effect virus writers use a bit of psychology to trick us into helping them take that final step. Treat every email you receive (even from family and friends), and particularly emails with attachments and links with suspicion and you will go a long way in protecting yourself from infection your computer.
Also don't assume because something comes from a friend or a work colleague that it is clean. They could have easily been tricked and either sent something on, or their infected computer could be sending it to you as though it was from them.
Please take care.
- Kelvin
The attached file in this case was named MT77232.zip.
The process I have been using to test these attachments is to save the file to my Desktop and then scan the file using my anti-virus software. I've found over the years anti-virus software leaves a window of opportunity from the time the virus is released into the wild until the anti-virus software companies get the updates out to users. This process can be a number of days.
To check the file because it really is obvious to me it is malware based on coming from someone I don't know with a subject that is obvious it has nothing to do with me I then check the file by sending the file to the online scanning service. The scanning service is run by one of the anti-virus companies and they use it to receive feedback from users and improve their product. (You can find details of the service in MyAnswers solution 1890 which can be found on the MyAnswers solutions page I maintain on virus, spyware/adware and spam.)
In this case the file was found to be malware so there is no need to submit the file to the online virus scanning service.
I've found in every case that I can recall with a virus infection that a user has initiated the infection by running a program. In most cases this is via an attachment in an email, but also by clicking on a link on a web page. Only once have I seen an infection occur by going to a web site and this issue was fixed when Internet Explorer SP2 came out. So in essence whilst the virus writers are an enormous nuisance, in order for the virus to infect our computers it requires our assistance. In effect virus writers use a bit of psychology to trick us into helping them take that final step. Treat every email you receive (even from family and friends), and particularly emails with attachments and links with suspicion and you will go a long way in protecting yourself from infection your computer.
Also don't assume because something comes from a friend or a work colleague that it is clean. They could have easily been tricked and either sent something on, or their infected computer could be sending it to you as though it was from them.
Please take care.
- Kelvin
Wednesday, August 27, 2008
Virus alert: Windows - Drive Not Ready
One of my users kept repeatedly getting the message "Windows - Drive Not Ready. Exception Processing Message c00000a3 Parameters 75b6bf7c 4 75b6bf7c 75b6bf7c".
I read a number of posts on the Internet which indicated people were disabling their floppy drive. Gut feeling told me it was most likely a virus. It took quite some time but I remove the virus manually and the anti-virus then removed the related files.
In the past I have seen people replace keyboards because they felt the keyboard was not working when in fact the computer was infected with a virus. Yes your hardware may be failing and so it may have been a hardware failure, but also don't rule out malware if you find you are having unexpected hardware issues. We've also seen weird behaviour on a computer which looked like a virus infect (text in a merged Word document being spaced weird) but in fact this turned out to be a failing hard disk. So it cuts both ways.
Since I saw many posts relating to this issue not mentioning a possible virus infection I felt this post might help others.
- Kelvin
Virus alert: Your Online Flight Ticket N 45412
This one has increased recently and was reported to me by a JustLocal friend. I've mentioned this one in an earlier blog, but since it has now increased in the number of emails we receive I felt it was appropriate to mention it again.
This is a attempt to scare people into thinking they have had charges made against their credit card. If you are in the process of booking a holiday this one may trick you.
It is obvious from the randow user name in the from email address that it is malware.
It was not detected by my virus scanning software which was just updated with a reboot to the computer.
It really is a concern that so many of these emails are getting into people's computers. I had not realised the level of viruses getting through, since I use OzEfilter to delete them before they reach my computer. Often fixing a computer after one of these virus infections gets through can be almost as much as a new computer.
Please do take care when you receive an attachment from anyone, even someone you know.
- Kelvin
This is a attempt to scare people into thinking they have had charges made against their credit card. If you are in the process of booking a holiday this one may trick you.
It is obvious from the randow user name in the from email address that it is malware.
It was not detected by my virus scanning software which was just updated with a reboot to the computer.
It really is a concern that so many of these emails are getting into people's computers. I had not realised the level of viruses getting through, since I use OzEfilter to delete them before they reach my computer. Often fixing a computer after one of these virus infections gets through can be almost as much as a new computer.
Please do take care when you receive an attachment from anyone, even someone you know.
- Kelvin
Tuesday, August 26, 2008
Having fun with Search Engines
I often see people with a Google toolbar still installed or typing in the address to get to Google. Both of these are no longer necessary. Both Internet Explorer 7 and Firefox now contain the search feature built into the browser at the top right of the browser window. However adding new search engines can be a bit tricky, so I decided to create a few links to make things a little easier.
You can find the links for installing the search engines on the JustLocal search page at the bottom left. Installing the search engine is as simple as clicking on the link. You are given the option to make the search engine the default search engine. Naturally I make JustLocal Search my default search engine, but many people may wish to make JustLocal Google search engine their default search engine.
JustLocal search
Many people have asked to be able to search across all JustLocal friends and so I created the JustLocal Search Engine.
The interesting result with the JustLocal search feature, is all of a sudden it becomes apparent the major players in the market, who are keen to get business and appear at the right in the Google sponsored listing. As a JustLocal friend these advertisers are most likely your keenest online competitor. Even if you aren't a JustLocal friend, searching for the product or service your business sells, and seeing the competitors, will provide great marketing information.
JustLocal Google
This search engine will allow you to quickly search www.google.com.au. I created this because most new Windows computers arrive with Microsoft Live as the search engine and most people want to use Google. By selecting the JustLocal Google search engine, you can quickly switch to Google Australia as your search engine with a couple of clicks.
Did you know you can do the following with Google?
Most people in Australian think when they search Google for pages from the world they see what everyone else in the world sees. This is not so. Google presents pages it feels is relevant to the location the person who is searching. The JustLocal World search engine shows you the results as though you are searching from another country outside of Australia. I don't know which country or servers exactly, but I suspect it may be somewhere in the USA.
How can this knowledge be useful you might ask.
Many less experienced SEO professionals will tell you they can get you first page presence in Google worldwide. But what these SEO marketers don't realise is the results in Australia are only what is seen when you are in Australia. If your business is selling worldwide, you want to see what the rest of the world sees when they search. The sad truth is your product may never be seen by someone in another country. This search engine has been provided to help educate people on the difference between searching when in Australia and when in another country. You can't easily get Google to search as though you are in America when you are in Australia, because if you enter www.google.com you are redirected to www.google.com.au automatically. The JustLocal Word search engine gives you an idea of what others might see.
If you find these search engines of interest let me know. I have a few more search engines to come and I think you will find them to be quite handy.
Enjoy - Kelvin
You can find the links for installing the search engines on the JustLocal search page at the bottom left. Installing the search engine is as simple as clicking on the link. You are given the option to make the search engine the default search engine. Naturally I make JustLocal Search my default search engine, but many people may wish to make JustLocal Google search engine their default search engine.
JustLocal search
Many people have asked to be able to search across all JustLocal friends and so I created the JustLocal Search Engine.
The interesting result with the JustLocal search feature, is all of a sudden it becomes apparent the major players in the market, who are keen to get business and appear at the right in the Google sponsored listing. As a JustLocal friend these advertisers are most likely your keenest online competitor. Even if you aren't a JustLocal friend, searching for the product or service your business sells, and seeing the competitors, will provide great marketing information.
JustLocal Google
This search engine will allow you to quickly search www.google.com.au. I created this because most new Windows computers arrive with Microsoft Live as the search engine and most people want to use Google. By selecting the JustLocal Google search engine, you can quickly switch to Google Australia as your search engine with a couple of clicks.
Did you know you can do the following with Google?
- Find out the time in another location. Thinking of going to Paris, then search "Time in Paris".
- Find out the weather in a location. If you want to find out the weather currently in Paris then search "weather in Paris".
- Find out how much your money can buy in another country. Now if you want to know what does that 30 Euro item in Paris cost in Australian dollars then search for "30 EUR in AUD". It looks cheap in euros doesn't it;-)
- Need a calculator, then just type the calculation into the search field such as "4 x 30", and now all your family can have that item from Paris, or not!
Most people in Australian think when they search Google for pages from the world they see what everyone else in the world sees. This is not so. Google presents pages it feels is relevant to the location the person who is searching. The JustLocal World search engine shows you the results as though you are searching from another country outside of Australia. I don't know which country or servers exactly, but I suspect it may be somewhere in the USA.
How can this knowledge be useful you might ask.
Many less experienced SEO professionals will tell you they can get you first page presence in Google worldwide. But what these SEO marketers don't realise is the results in Australia are only what is seen when you are in Australia. If your business is selling worldwide, you want to see what the rest of the world sees when they search. The sad truth is your product may never be seen by someone in another country. This search engine has been provided to help educate people on the difference between searching when in Australia and when in another country. You can't easily get Google to search as though you are in America when you are in Australia, because if you enter www.google.com you are redirected to www.google.com.au automatically. The JustLocal Word search engine gives you an idea of what others might see.
If you find these search engines of interest let me know. I have a few more search engines to come and I think you will find them to be quite handy.
Enjoy - Kelvin
Monday, August 25, 2008
Virus alert: Statement of fees 2008/09
I attended a client who had infected their computer. The email had the subject "Statement of fees 2008/2009" with a zip attachment and the zip attachment initially looked like a Word document, but was actually an executable file. The anti-virus software picked up there had been an infection, but didn't stop the email contents from infecting the computer.
We tested this on another computer with a different anti-virus program and it too didn't pick up the attachment contained malware.
Using the anti-virus software to clean up the computer didn't work and manually removing the effects of the virus didn't remove everything and so the computer will require additional work to recover.
The attached file was submitted to the online virus scanner for review and came back as:
File: Fees_2008-2009.zip
Conclusion: malware container
File: Fees_2008-2009.doc______________.exe
Conclusion: malware
It is very important not to open a zip file which is received unexpectedly and certainly don't run an executable unless you specifically know the source of the file and the file is clean.
A product like OzEfilter will allow you to see the subject and sender of this email before receiving it into your computer. In this case the email address of the sender was obviously meaningless and that would have helped to avoid this infection. Always take care with emails with links or attachments. One lapse of concentration can cost hundreds of dollars in repair time and lost productivity whilst the computer is down.
- Kelvin
We tested this on another computer with a different anti-virus program and it too didn't pick up the attachment contained malware.
Using the anti-virus software to clean up the computer didn't work and manually removing the effects of the virus didn't remove everything and so the computer will require additional work to recover.
The attached file was submitted to the online virus scanner for review and came back as:
File: Fees_2008-2009.zip
Conclusion: malware container
File: Fees_2008-2009.doc______________.exe
Conclusion: malware
It is very important not to open a zip file which is received unexpectedly and certainly don't run an executable unless you specifically know the source of the file and the file is clean.
A product like OzEfilter will allow you to see the subject and sender of this email before receiving it into your computer. In this case the email address of the sender was obviously meaningless and that would have helped to avoid this infection. Always take care with emails with links or attachments. One lapse of concentration can cost hundreds of dollars in repair time and lost productivity whilst the computer is down.
- Kelvin
Saturday, August 23, 2008
Virus alert: Attention! Your PayPal account has been limited!
Strictly speaking this is not a virus, but a phishing attempt where the email is attempting to obtain the log on details for a users PayPal account.
The email is well worded and considerate in tones, apologising for any inconvenience. The even provides very good advice that you should not provide your details to fraudulent web sites. The email has legitimate links to the PayPal site in all but one case, which is the activate link. If you hover your mouse over the activate link you see it is not a PayPal site.
When we initially started to use PayPal these emails were a bit of a concern. No business wants to have their PayPal account suspended so it aims to put pressure on the PayPal user. Often in business we are under various pressures so one more pressure may lead to an error in judgement resulting in your account details being provided to a fraudulent web site.
As this email says, do not click on links in the email. Go to the PayPal site by typing in the PayPal address in the address bar of the browser.
Now if PayPal provided their own email service for messages and only contacted via their email service with a short alert email, then there would be little reason for concern. Any attempt to obtain details would be an obvious phishing attack.
This type of email cannot harm your computer. It is designed to trick you as phishing emails attempt to do. Only by being tricked can you cause harm.
We generally do not receive this type of email as we delete it from the mail server using OzEfilter. In this case we downloaded the email so we could review and report on the contents.
- Kelvin
The email is well worded and considerate in tones, apologising for any inconvenience. The even provides very good advice that you should not provide your details to fraudulent web sites. The email has legitimate links to the PayPal site in all but one case, which is the activate link. If you hover your mouse over the activate link you see it is not a PayPal site.
When we initially started to use PayPal these emails were a bit of a concern. No business wants to have their PayPal account suspended so it aims to put pressure on the PayPal user. Often in business we are under various pressures so one more pressure may lead to an error in judgement resulting in your account details being provided to a fraudulent web site.
As this email says, do not click on links in the email. Go to the PayPal site by typing in the PayPal address in the address bar of the browser.
Now if PayPal provided their own email service for messages and only contacted via their email service with a short alert email, then there would be little reason for concern. Any attempt to obtain details would be an obvious phishing attack.
This type of email cannot harm your computer. It is designed to trick you as phishing emails attempt to do. Only by being tricked can you cause harm.
We generally do not receive this type of email as we delete it from the mail server using OzEfilter. In this case we downloaded the email so we could review and report on the contents.
- Kelvin
Installing Firefox 3 stops links working on Outlook 2007 emails.
This problem crops up every now and then when Firefox is installed. The message received when clicking on a link in Outlook 2007 is "This operation has been canceled due to restrictions in effect on this computer."
For a solution to this problem obtain MyAnswers solution 1665.
For JustLocal readers who haven't heard about MyAnswers, the following is some background on MyAnswers which I started in 2002.
Over the last six years in my role as an IT consultant, I have attended to many computer problems. In many instances I document the solution and make the solution available to all clients, which can result in considerable savings for clients.
The solutions I provide to clients are now available for purchase by all JustLocal users via the Internet. Whilst there are many solutions on the Internet, and much of it is free, I have found over the years solutions can be quite time consuming to find. It can also be hard for a less IT experienced person to tell the difference between a quality solution and wrong information. I've seen some solutions which will damage a person's computer if the advice were to be followed.
The solutions provided in MyAnswers are actual documented solutions to problems which have occurred in the field. There are now over 1,800 solutions available.
Some problems have taken hundreds of dollars in time to solve. A recent MyAnswers solution will save a client over $2,000 a year in printing costs.
MyAnswers solutions are currently available at the special price of $5.95 each and solutions come with a money back guarantee.
Usually this type of information is not made available by IT consultants because what IT consultant knows, is how they make money. In this case my approach is to share my knowledge, and by sharing my knowledge with more people, I can do so at a lower cost per person. That means everyone wins.
A good place to start with MyAnswers is to read the Recent Solutions page. Chances are if you are having a problem with a computer, someone else is also having the same problem at the same time and your problem may have already been solved. A MyAnswers solution could save you hundreds of dollars in computer support costs.
May your next computer problem be an easy problem to solve, and if you need help, think MyAnswers. Search the Internet using our Google search engine and you will often find a MyAnswers solution.
- Kelvin
For a solution to this problem obtain MyAnswers solution 1665.
For JustLocal readers who haven't heard about MyAnswers, the following is some background on MyAnswers which I started in 2002.
Over the last six years in my role as an IT consultant, I have attended to many computer problems. In many instances I document the solution and make the solution available to all clients, which can result in considerable savings for clients.
The solutions I provide to clients are now available for purchase by all JustLocal users via the Internet. Whilst there are many solutions on the Internet, and much of it is free, I have found over the years solutions can be quite time consuming to find. It can also be hard for a less IT experienced person to tell the difference between a quality solution and wrong information. I've seen some solutions which will damage a person's computer if the advice were to be followed.
The solutions provided in MyAnswers are actual documented solutions to problems which have occurred in the field. There are now over 1,800 solutions available.
Some problems have taken hundreds of dollars in time to solve. A recent MyAnswers solution will save a client over $2,000 a year in printing costs.
MyAnswers solutions are currently available at the special price of $5.95 each and solutions come with a money back guarantee.
Usually this type of information is not made available by IT consultants because what IT consultant knows, is how they make money. In this case my approach is to share my knowledge, and by sharing my knowledge with more people, I can do so at a lower cost per person. That means everyone wins.
A good place to start with MyAnswers is to read the Recent Solutions page. Chances are if you are having a problem with a computer, someone else is also having the same problem at the same time and your problem may have already been solved. A MyAnswers solution could save you hundreds of dollars in computer support costs.
May your next computer problem be an easy problem to solve, and if you need help, think MyAnswers. Search the Internet using our Google search engine and you will often find a MyAnswers solution.
- Kelvin
Friday, August 22, 2008
Virus alert: online verification from Westpac Bank
I just received an online verification email from Westpac Bank and thought I would review this type of malicious email.
Unlike many other emails this email appears to come from an email address for the Westpac Bank which is online@westpac.com.au. Rest assured this is a fake email and the address has been faked. It was not sent from WestPac.
The email looks OK, but as you can see the grammar is incorrect. Since a bank most likely uses automated systems with responses which are professionally reviewed, these types of errors are less likely. You will notice I have highlighted the use of plurals where it should be singular. A good sign of a fake is the language used. Sometimes however the language difference can be subtle and not all of us are strong on grammar.
" Monitor your transaction history and statements because your Westpac Bank online account may have been compromised.
We also suspect an unauthorised transactions has been taken place on your accounts.
Please take a simple step to secure your information and reduce your risk of falling victim to online threats now ."
The real give away however is in the link in the email in the following text.
Click Here For Westpac Bank Transactions Verification
If you hover your mouse over the link the web site address will appear. If you check the domain you will see it is not a WestPac domain.
I see a considerable number of fake emails which are supposedly from banks. These emails are known as phishing attempts, where they try to get you to log on to a fake site so they can collect your log on details.
I don't receive these emails into my computer because I use OzEfilter, but I actually have a much better technique that I use.
I do not provide my email address to the bank. If the bank doesn't have my email address then any email I receive from a bank is a fake. If the bank wants to contact me, they can contact me by telephone or via the postal service. I've only received one call in the last few years from the bank which wasn't telemarketing.
I highly recommend if you have registered your email address with your bank, to ask them to remove it. You then can't be tricked by one of the fake emails. Very simple and very effective.
- Kelvin
Unlike many other emails this email appears to come from an email address for the Westpac Bank which is online@westpac.com.au. Rest assured this is a fake email and the address has been faked. It was not sent from WestPac.
The email looks OK, but as you can see the grammar is incorrect. Since a bank most likely uses automated systems with responses which are professionally reviewed, these types of errors are less likely. You will notice I have highlighted the use of plurals where it should be singular. A good sign of a fake is the language used. Sometimes however the language difference can be subtle and not all of us are strong on grammar.
" Monitor your transaction history and statements because your Westpac Bank online account may have been compromised.
We also suspect an unauthorised transactions has been taken place on your accounts.
Please take a simple step to secure your information and reduce your risk of falling victim to online threats now ."
The real give away however is in the link in the email in the following text.
Click Here For Westpac Bank Transactions Verification
If you hover your mouse over the link the web site address will appear. If you check the domain you will see it is not a WestPac domain.
I see a considerable number of fake emails which are supposedly from banks. These emails are known as phishing attempts, where they try to get you to log on to a fake site so they can collect your log on details.
I don't receive these emails into my computer because I use OzEfilter, but I actually have a much better technique that I use.
I do not provide my email address to the bank. If the bank doesn't have my email address then any email I receive from a bank is a fake. If the bank wants to contact me, they can contact me by telephone or via the postal service. I've only received one call in the last few years from the bank which wasn't telemarketing.
I highly recommend if you have registered your email address with your bank, to ask them to remove it. You then can't be tricked by one of the fake emails. Very simple and very effective.
- Kelvin
Subscribe to:
Posts (Atom)
