More bogus technical support

The sample below is an example of .... well a trojan horse. Oh this is annoying.

tc

---

Dear use of the xxxxxx.com mailing service!

We are informing you that because of the security upgrade of the mailing service your mailbox xxx@xxxxxx.com settings were changed. In order to apply the new set of settings open this file:

http: / / irai.nerim.net/settings.exe

Best regards, xxxxxx.com Technical Support.

It's a phishing time of the year.

The latest in phishing, likely to infect the unsuspecting, is the follow.

>Dear taxpayer,The Federal income tax is a progressive tax, meaning that the more you earn, the higher your tax rate. Your tax rate depends not just upon your taxable income, but also upon your filing status (single, married filing jointly, etc.).You're in a higher tax bracket because:- your annual income for the last tax year has increased.Please review your annual tax report immediately

Life is marvelous. The link is in .kr (south korea).
naughty, naughty.

tc

Spammers abandon China?

Hardly. It's worth noting that the use of chinese domains has fallen off. Dot ru (.ru) has taken its place. Yipe!

Is this related to google's threat to leave China? We'll see.

tc

Bogus security update

The latest round of spam is a bogus security update. Just for good measure they take down your DNS servers. No doubt, this is intended to cause confusion in the ranks of large institutions. The sample below is just one of many similar spams.

tc

Attention! On October 16, 2009 server upgrade will take place. Due to this the system may be offline for approximately half an hour. The changes will concern security, reliability and performance of mail service and the system as a whole. For compatibility of your browsers and mail clients with upgraded server software you should run SSl certificates update procedure. This procedure is quite simple. All you have to do is just to click the link provided, to save the patch file and then to run it from your computer location. That's all. http://updates.YOURDOMAINNAMEHERE.com.secure.admindatacenter.com/mail/id=741248762-harjaicv@AGAIN.com-patch55129.exe Thank you in advance for your attention to this matter and sorry for possible inconveniences. System Administrator

Domain names of the day

the.last.version.norton-antivirus.sk

ccbfgsafaq.tk

Bold or Desperate

If I had read the rendered html version is would look like this:

---

You have just received for your computer the best antivirus from someone who cares about you...

Just click here
to receive your version norton !

Thank you for using www.norton.com services !!!

Please take this opportunity to take your ultimatum version of norton antivirus

---

Of course, click here would be our nafarious link. OUCH!! (an icon!!)

http://the.last.version.norton-antivirus.sk/icons/norton.exe


tc

ASCII Art and eee

ee       ee   ee       ee   ee       ee         eeeee    ee   ee    eeeee    ee   ee   ee    eeeee            eeeeee    eeeee    ee     ee
ee       ee   ee       ee   ee       ee        ee   ee   ee   ee   ee   ee  eee   ee   ee   ee   ee          ee        ee   ee   eee   eee 
ee   e   ee   ee   e   ee   ee   e   ee        ee   ee   ee   ee   ee   ee   ee   ee   ee   ee   ee          ee        ee   ee   ee e e ee
ee  eee  ee   ee  eee  ee   ee  eee  ee         eeeeee   eeeeeee    eeeee    ee   eeeeeee    eeeee           ee        ee   ee   ee  e  ee         
eeee   eeee   eeee   eeee   eeee   eeee             ee        ee   ee   ee   ee        ee   ee   ee          ee        ee   ee   ee     ee                          
eee     eee   eee     eee   eee     eee   ee   ee   ee        ee   ee   ee   ee        ee   ee   ee   ee     ee        ee   ee   ee     ee           
e       e     e       e     e       e    ee    eeeee         ee    eeeee    ee        ee    eeeee    ee      eeeeee    eeeee    ee     ee      

---

If you don't see it, it is www.948148.com
It was also in 3px font-size.