We’re using a bundled virtual machine called ESVA for spam filtering; it’s basically a prebuilt CentOS server preconfigured with Postfix, MailScanner, SQLGrey (for greylisting), MailWatch, etc.. It’s worked quite well for us for several years – on our site for filtering our inbound email and that for our hosted customers, and at several customer sites where they’re running Exchange. I highly recommend it as a drop-in spam filtering solution with good reporting and manageability, plus a fairly active user community that can generally answer any questions they haven’t already answered.

Our internal ESVA server was slightly out of date, so last weekend was a good time to update it to 2.0.5.9 (a simple process using ‘esva-update‘) and update a few packages such as ClamAV (‘yum update‘). I ran the updates, verified that email messages were coming in correctly, and figured I was done with it. I also updated the nameserver entries in /etc/resolv.conf to point to our new internal DNS servers.

A brief digression on our network: We have external-facing DNS servers for domains that we host, but we also have internal servers that return internal addresses for some systems. Those internal servers report as authoritative because they are for the internal hosts that they serve. Thus from outside mail.example.com may resolve to 209.252.x.y but from inside it resolves to 10.3.4.5.

After the update, message traffic was fine – messages were coming in and being passed along to the mail servers, obviously there were no problems. By Monday morning, though it became apparent that while our customers were receiving outside email, we were not. This was easy to miss initially because we’re a small company and quite frankly we’re not getting a lot of message traffic overnight on weekends. A quick test from inside the network (‘telnet mail2.example.com 25‘ and manually entering a message) worked just fine so it wasn’t a problem with the actual handling of email messages, email for other domains that we host was being accepted and routed appropriately so it wasn’t a problem with firewall configuration, etc.

After spending more time than I like to think about digging through postfix trying to determine why it would be rejecting messages for just one domain (and the primary domain for which ESVA was set up), the problem ended up being completely different:

The new DNS servers didn’t have a host entry for the base domain example.com. All of the relevant subdomains were present (some with internal addresses, some with external ones depending on how they’re reached – they all have to be there since the DNS server thinks it’s the authoritative one for example.com and won’t forward queries for that domain. Thus example.com didn’t resolve (example.local did, which was what the domain was based on). Individual hosts had been set up in DNS (e.g. www.example.com, mail.example.com, mail2.example.com) but not a base record for the top-level domain itself.

Postfix accepted messages submitted from the internal network because it was a local network, and once it had those messages it had transport for the domain name so testing from an internal host worked. Messages from outside the local network were being checked to confirm that the top-level domain existed, but since it didn’t resolve from inside the network messages were being rejected with

Mar  1 15:12:36 mail2 postfix/smtpd[5578]: NOQUEUE: reject: RCPT from mta.sample.net[111.222.111.222]: 450 4.1.2 <recipient@example.com>: Recipient address rejected: Domain not found; from=<bounce-1234567_HTML-1234567-1234567-12345-0@bounce.example.net> to=<recipient@example.com> proto=ESMTP helo=<mta.example.net>

The fix was simple – correct the internal DNS server to allow example.com to actually resolve to a hostname. It didn’t really matter what it was (we used the IP of the web server which is pretty standard), just that it resolved to something so Postfix wouldn’t reject it.

While I feel a bit foolish for having this bit of misconfiguration happen, in searching for others who’d experienced similar problems I found nothing particularly useful except comments (generally for the error “Sender address rejected; Domain not found”) that it was probably a DNS error. Hopefully this will help someone with the same problem in the future.

Related posts:

1. Email Marketing – Use A Service I occasionally get requests from clients for assistance with sending...
2. (Fix) When DNS and ping Fail but nslookup Works (Windows) Spent some time recently with a laptop that would see...
3. Winlogon.exe at 50% or 100% CPU (Fix) There are apparently a variety of things that can cause...

Related posts brought to you by Yet Another Related Posts Plugin.

Managing multiple UPSes requires multiple instances of apcupsd each running its own configuration. The relevant section of the manual does not mention one key step that’s covered elsewhere in the manual: how to identify each individual UPS. This is covered in the manual in the section on “Device Nodes” which are created in /dev (e.g. /dev/ups0, /dev/ups1) using udev rules. Basically, those rules are run when new devices are plugged into the system and can be used to create specific device entries rather than a default “hiddev” device entry (UPSes are generally seen by the system as Human Interface Devices due to the communications format they use).

Caution: Because each UPS is being identified by serial number, replacing a UPS requires modification of the udev rules on the system in question to match the new serial number. Without that modification the UPS will not be recognized.

Related posts:

1. Slow Startup with Multiple ‘Starting’ Services After Malware I had an interesting problem with a server (Windows 2003...

Related posts brought to you by Yet Another Related Posts Plugin.

After a bit of searching, I ended up at this thread: OpenOffice-3.0.1 hangs if SCIM is active. Boiled down to something for those not interested in the technical details, OpenOffice.org 3.x has problems with some configurations of SCIM, the “Smart Common Input Method platform.”

The Fix

In this case, the conflict crops up when SCIM on the PC is configured to use en_US.UTF-8 (Unicode) rather than the older en_US. If you want to get into the technical side of it there’s assorted discussion of this scattered across many locations and several years; if you don’t care about that then simply edit the file /etc/scim/global and change the first line from

/SupportedUnicodeLocales = en_US.UTF-8

to

/SupportedUnicodeLocales = en_US

You’ll need to do that as an administrator since that file is not generally editable by normal users. Details of how to do that will vary depending on what Linux distribution you’re using and what text editors you’re familiar with, so if you’re not sure how to change that file ask for assistance.

It’s possible that making this change will have other effects if you’re using languages other than English, but I have no good way to test this as the only other languages I can even pretend to a rudimentary knowledge of use the same basic alphabet so SCIM isn’t really a requirement for me.

Side Notes

The system in question has been running OpenOffice.org 2.3, the version available from the standard CentOS repositories, but that’s quite a bit behind current developments – kind of like running Microsoft Office 2000 these days. There have been a lot of good changes since 2.3 was released. I used the Go-Oo.org version in part for convenience (it’s simple to install on systems that use “yum” for package management), in part because the main OpenOffice.org servers were down for maintenance last night (making it hard to download from them) and in part because of reported speed and functionality improvements.

SCIM and tools like it are important because they allow applications to accept text input in many languages with the details of that input handled by SCIM rather than by the application (in this case OpenOffice.org). By letting SCIM handle the input of characters in languages such as Chinese, Japanese, Korean, Russian and others, the application is both kept simpler since it doesn’t have to deal with how those characters are input and made more useful because it can work with a much wider range of languages.

Related posts:

1. Avoid VBScript for Web Apps Earlier this week I spent some time troubleshooting a browser-based...
2. (Fix) r3953724.cn Malware/Adware Redirections Quick Fix: have a program named procmon.exe running (copy of...

Related posts brought to you by Yet Another Related Posts Plugin.

Every client that I’ve dealt with that’s interested in this kind of marketing starts out planning to do it using their regular email account, but there are good reasons not to do so. The reasons for using a service break down into three key areas: creation of your content, distribution of your content, and management of your address list. Keep reading for some notes on those.

Creation

While it’s possible to build a fancy graphic mailing in Word or a desktop publishing application, email isn’t print. What goes out in email will be HTML (unless you’re going to be mailing out PDFs with embedded fonts, which most people will never look at), probably with the images attached though they might be loaded from a remote server. The design tools that most of us have conveniently at hand and are experienced in using will frequently not produce the same effect that we’re trying to achieve when we create something, then convert it to HTML (assuming that conversion to even be available).

The services that provide email marketing, on the other hand, have invested in providing design tools and pre-built templates that can be used for mailings. The output of their tools should work well across a wide range of email readers – webmail, Outlook, Thunderbird, Mail.app, etc. At least one service provider (VistaPrint) can also coordinate the appearance of your campaign with letterhead, business cards and other materials ordered from them.

Distribution

There are three common ways that company email is set up: in-house servers that send email directly to the destination, in-house servers that route outbound email through an ISP or “upstream” mail server, and direct use of a mail server at an ISP or hosting provider. Larger companies will usually have the first setup, smaller companies may have any of the three. Very small companies may actually be using a webmail service such as Google’s GMail, MSN’s Hotmail/Windows Live Mail or Yahoo’s email (which is also used by some ISPs such as AT&T/SBC).

No matter which of the configurations you’re using, there may be problems if you’re sending large volumes of bulk marketing email. Sending messages may consume all of your available bandwidth for hours causing delays in other email messages and other impact on other users. It might cause some of the larger mail providers (e.g. AOL, Comcast, Yahoo, Hotmail/Windows Live) to block your mail server as a source of spam. It might cause your ISP or hosting provider to shut down your outbound email for a time to keep the same thing from happening to them.

Mail Delays

If you’re using an in-house mail server, being just a little sloppy about the size of images or attachments can cause real problems if you’re sending to many email addresses. For example, if you include pictures that make each outbound message 1 megabyte (MB) in size, 2,000 messages comes up to 2 Gigabytes (GB) – not much for a current hard drive, but if you’re using a T-1 line at your office it’s going to be completely tied up for at least 3 hours to send that 2GB of data, slowing all other Internet traffic from your office. In addition, most mail servers operate on a first-in-first-out (FIFO) basis, which means that the very short very important email message that someone else is sending may be delayed until after all of your marketing messages have been sent.

I’ve encountered this from the small ISP side when a customer using our mail server started sending marketing messages with 3-4 MB of high-resolution images to several thousand customers; in addition to some user training on how to build appropriately-sized messages we also ended up adding prioritization rules on the mail server to keep their messages from interfering with other customer’s outbound email. The same kind of thing can happen if you’re using a hosting provider for email; this makes your service providers cranky and they may charge you for their cleanup efforts.

Spammer!

Even if you have permission forms signed in blood from everyone you’re sending messages to, some of your recipients will click the “This is Spam!” button when they get your message. Just a few of those can cause a provider like Comcast or AOL to block all of your messages, and their automated systems just don’t care about whether you really have permission. There are ways to get unblocked, but given how responsive their customer service departments can be, do you really want to be the person coming to them with a more technical issue of your messages being blocked?

Management

Finally, if you’re going to be running a mailing list you need to provide ways for people to get off of your list. In some places that’s just common courtesy, but in an increasing number of areas it’s actually legally required. The people trying to get you to purchase prescription drugs or stocks don’t follow those rules because by comparison to illegal drug sales and pump-and-dump stock marketing the penalties for abusing email are pretty low, but for your legitimate small (or large) business at a fixed address marketing to your existing customer base, those laws can have teeth – and even if they don’t, common courtesy should.

If you’re only doing a one-time mailing to thank customers for their past business and invite them to your going-out-of-business sale, you don’t need to worry about future mailings to people who’ve requested to be removed from your mailing list. Everyone else does. Maintaining the list in Excel, Outlook, or whatever other program you’re using still requires you to manually edit the list every time someone asks to be removed. If you’re sending to many people that can easily chew up some of your or your staffs’ time every month, and you need to ask yourself whether the cost of that time is worth more than the cost of an email service – particularly if you also have someone spending a few hours a month preparing marketing materials that can be done faster using the online tools.

Email Sending Programs

There’s software available out there that will let you automate the management side of email marketing, but it’s still going to suffer from the creation and distribution issues I discussed above. While you would be making completely legitimate use of these programs you have no way of knowing how others are using them, and you don’t know if messages originating from your program are therefore classified as “spam” by mail filtering systems.

Some packages may even offer to handle the distribution of email using their “distributed networks of email sending computers.” Another way to phrase that is “we’ll use the virus-infested PCs that we’ve infected to send your email.” Stay away.

Email Marketing Service Providers

Here are three companies that provide email marketing services that I’ve either heard good things about, have done business with or know someone who has done business with them and been pleased.

• MailChimp – the smallest of the email marketing companies, MailChimp is a privately held Internet startup (since 2000) based in Atlanta, Georgia. They focus entirely on email marketing. They have the smallest product line (all email marketing plans), but if you don’t have many addresses then you can’t beat their free plan that’s valid for up to 500 email addresses and 3000 messages/month – beyond that level all of the providers have pretty much the same pricing.
• Vistaprint – Vistaprint provides email marketing to complement their traditional business line of printed business products. They’re a larger company (on the NASDAQ as VPRT), and they have the big advantage of making your email marketing match your printed material – business cards, letterhead, etc. if you’ve also purchased it from them. I’ve used them for printed products and received excellent quality and value.
• Constant Contact – Constant Contact is probably the best known of the email marketing firms, in part because they advertise fairly widely (and not just with email). They’re publicly traded as CTCT (NASDAQ), and they provide some additional services such as online surveys (at additional cost) where with the others you need to use a third party such as SurveyGizmo.

With the exception of MailChimp’s free account for under 500 addresses ($15 from the other companies), pricing from all three companies is pretty much the same – $30 for up to 2500, $50 for 5000, $75 for 10,000 addresses, etc. All three companies have free plans or free trials, so it’s worth signing up with all three and looking through their offerings and software tools in more depth.

Feedback from people who’ve used one or more of these companies for email marketing is very welcome – just comment below.

Related posts:

1. NEVER Give Out Your Password IF support staff for a service you are using need...
2. (Fix) Postfix: Recipient address rejected: Domain not found We had a problem last weekend with Postfix not accepting...

Related posts brought to you by Yet Another Related Posts Plugin.

The preliminary numbers have surprised me quite a bit.

• Brother – a company I’ve always looked at as being a good choice for a home printer – is hands-down the winner on a pure cost standpoint over almost the entire range of print volumes.
• Hewlett-Packard/HP, which I knew would command a price premium, is never even within 15% of the best TCO, with toner costs in its low- to mid-range LaserJet printers more than twice most other manufacturers.
• Lexmark, another brand that I expected to be somewhat pricey, was within 15% of the best TCO only with one low-end printer under very light loads typical of household use.
• Dell, while the numbers are incomplete, looks like a very solid value for higher-volume printing or over the long term (300,000+ pages)

Read More for print volume numbers and some specific printers.

While there is some information I haven’t either found or determined not to exist (e.g. do the midline Dell printers require maintenance kits/fuser replacements and how much do they cost if so?), none of what’s missing is going to lower the calculated costs of running a printer. For the Brother printers that lead the pack, I either have all of the maintenance prices and intervals or I’ve used a guess at how long a printer will last and listed the full replacement cost as the “maintenance kit” price.

This information is comparing Brother, Dell, HP and Lexmark monochrome laser printers; I’m aware of Kyocera printers but pricing is hard to come by. I do not currently have multifunction copiers from any manufacturers, but I expect that I’ll be adding many of those multifunction devices in the future.  I may not include the truly high-end copier/printers since those are frequently leased rather than purchased and may have widely varying terms. That said, for very high volume printing you should definitely check on what your vendors can offer you – I only ran calculations out to 750,000 pages (still less than $9000 TCO).

All printers listed have network interfaces; I feel that for business environments the cost savings of cheaper non-networked printers disappears when you need to hook even one of them up to the network. Other than networking, the numbers presented here do not account for printer features or accessories such as extra trays – prices for those will probably not vary too much between brands.

I’ve added links to many of these printers to the Fencepost Software Amazon Store, and I’ll link to some of them from this article. I encourage you to read reviews of specific printers and shop around – Amazon has decent prices, free shipping for many items and a good reputation for dealing with returns, but it’s entirely possible that you’ll find some of these printers available for less. For the smaller printers, you may even find them on sale for less at office supply stores in your area if you’re not in a hurry.

In the low-volume category, which I’ll count as anything under 5000 pages for the life of the printer, the Brother HL-2170W is a solid winner at $135-250 depending on volume and the need to replace the toner cartridge (it starts with a 1000-page “starter,” regular cartridges are 2600 pages for $49 or less which is ~1.9 cents/page). The Lexmark E120N is slightly higher but still fine for light usage – base price is similar, but it comes with only a 500-page starter cartridge & replacement cartridges are 2000 pages for $74 or ~3.7 cents/page).

For higher-volume printing, the Brother HL-5370DW (or 2-tray Brother HL-5370DWT) has a very wide “sweet spot” from 10,000 up to 90,000 pages. No other printers are within 15% of the TCO except at specific narrow performance points or at the high end of the range. This is a combination of a low cost for the printer ($215) and toner at 1 cent/page (8000 pages for a $80 cartridge), plus low-cost drum replacements. I based this on an anticipated printer lifespan of 90,000-100,000 pages, but these are still the best TCO for the print volume even if you change the expected lifespan down to 75,000 or up to 150,000.

Starting around 100,000 pages and going up to around 300,000 pages, the Brother HL-7050n is your best performer, while from 300,000 up to 750,000 it alternates with the Dell 5330dn (also at Dell). Either should be a solid choice, but if you need duplexing go with the Dell – it’s included on that one where it isn’t included on the Brother.

Raw Numbers

In the attached spreadsheet PDF (see below), the cells with a green background have the lowest price for the number of pages printed. Cells with bold text are within 15% of the lowest cost. Cells with the numbers greyed out are either higher than the median cost for that number of pages or are more than $0.50/page – either way, that printer is overly expensive for that number of pages. Cells with no special formatting are less than the median cost, but are more than 15% higher than the lowest-cost option.

Some areas of the spreadsheet will be changing – for example, I’ll be adding an estimated lifetime number of pages for many of the printers and modifying the calculations to assume purchasing another of those printers when that lifetime is hit. Right now that is accomplished on a few printers by setting the maintenance kit cost to be the price of the printer itself, with the kit interval as the expected lifespan. Those cells are mostly highlighted in yellow.

Printer TCO Calculations-20091230 (PDF Download)

The printers compared in this spreadsheet are: Brother HL-2170W, Brother HL-5370DW, Brother HL-6050DN, Brother HL-7050N, Brother HL-8050N, Dell 2330dn, Dell 3330dn, Dell 5210dn, Dell 5330dn, Dell 7330dn, HP P1505n, HP P2035n, HP P2055dn, HP P3005n, HP P3015dn, HP P4014n, HP P4015n, HP P4515n, HP 5200tn, HP 9040dn, HP 9050n, Lexmark E120n, Lexmark E260dn, Lexmark E360dn, Lexmark E460dn, Lexmark T650n, Lexmark T652n, Lexmark T654n, Lexmark T656dne, Lexmark W840n

Update: For many older printers, you may find the information at PrinterDB.com interesting. While I didn’t use their formulas in creating this page, I expect to check on their color calculations when I add color printers.

Update 2: Revised links to go directly to the product pages (with reviews) at Amazon, plus one directly to Dell. If there are printers that you’re aware of that I have not included, feel free to ask me to add them to the list – I’ll be updating it with additional printer models including multi-function printers.

Related posts:

1. Calculating Printer Costs and TCO I’m currently working up an article on the total cost...
2. Choosing Printers for the Office For many small businesses, when it’s time to add or...

Related posts brought to you by Yet Another Related Posts Plugin.

Currently I’m only focusing on monochrome/black & white laser printers. The same calculations can be applied to color and multifunction/all-in-one printers as far as printing is concerned, but they don’t take into account the potential added value of the additional features (and volume of color printing will vary by office). I’m also not factoring in the cost of paper, since it’s effectively a constant – it’s unlikely that paper cost will vary based on which printer is chosen.

It’s important to do these calculations when you’re purchasing printers, because if you’re doing any significant amount of printing you may end up paying thousands of dollars more than needed over the course of just a couple of years. As a simple example, for printing 2000 pages/month (4 reams of paper, non-duplexed), a low-end printer may cost well over $2000 to use over the course of 2 years, while a slightly higher-end model may be under $1000 even with the higher initial cost of the printer factored in. At higher volumes the cost differences can be even more dramatic, and not just between low-end and midrange or high-end printers – price variations between midrange printers from different vendors can be thousands of dollars.

The basic information you need to do these calculations yourself are:

• The cost of the printer itself
• Toner information: Cartridge price and pages/cartridge. Some printers can use high-capacity cartridges, but they’re not always cheaper per page…. The capacity of the cartridge that shipped with the printer may also be important for low-volume uses. Toner cost per page is the single most important item in determining printer cost in almost all situations. Toner cost can range from 0.4 cents per page to 4 cents per page – when you’re printing 100,000 pages, that’s $400 vs. $4,000.
• Drum information: Some printers have the drum and toner cartridge as a single unit, some require that the drum be replaced separately. If the printer needs drum replacement, get drum price and lifespan (pages/drum)
• Maintenance Kit information: Higher-volume printers often require a maintenance kit after 200-300 thousand pages. These kits frequently include a fuser unit and replacement rollers, and may cost several hundred dollars.

Once you have all of those numbers, it’s just some basic arithmetic to calculate how many toner cartridges, drums and maintenance kits you’ll need based on the number of pages you expect to print, then add that to the price of the printer. If you’re not sure about how many pages you’ll be printing, think about how much paper you’re purchasing – each ream is 500 sheets, each box is 5000. If you’re going through a box of paper every two months (excluding copier usage), then you’re printing around 2500 pages/month or 30,000/year.

Doing these calculations by hand is fairly simple – for example, if a maintenance kit is good for 250,000 pages and you’re only calculating out to 120,000 pages then you need zero kits.

If you’re going to be putting this into a spreadsheet for comparing different printers, then things get a little stranger. The formula I’m using will be getting a bit more complicated, but for now it looks something like this:

=PrinterPrice+
(TRUNC((PagesPrinted-StarterPages)/TonerPages)+1)*TonerPrice+
IF(AND(ISNUMBER(DrumPages), ISNUMBER(DrumPrice)),TRUNC(PagesPrinted/DrumPages)*DrumPrice,0)+
IF(AND(ISNUMBER(KitPages),ISNUMBER(KitPrice)),TRUNC(PagesPrinted/KitPages)*KitPrice,0)

That formula factors in the price of the printer, the price of toner (including the cartridge that ships with the printer), the price of replacement drum kits if needed and the price of maintenance kits if needed. Eventually it’s going to include a “maintenance kit” estimate for printers that don’t need them; that estimate will likely be a “printer lifespan” number based on the Maximum Monthly Duty Cycle number provided by all printer manufacturers and will operate on the expectation that instead of a maintenance kit the printer will simply be replaced.

Related posts:

1. Monochrome Laser Printer TCO/Cost – Preliminary Results I’m regularly asked by customers “Which laser printer should we...
2. Choosing Printers for the Office For many small businesses, when it’s time to add or...

Related posts brought to you by Yet Another Related Posts Plugin.

Digging around on the console attempting to track down the source of the problems, I found multiple services listed as “Starting” – all of them malware-based, with the actual infection cleaned out. My suspicion is that these non-startable services were causing the startup of other services to be delayed, though in this case I’m not really planning on setting up a test system to verify that.

In the rest of this post I’ll give a bit more detail on the scenario, what I found, what was needed to clean it out, and a few more notes on what I suspect was happening.

Scenario

We haven’t been working with this client for very long, so I’m not sure when these infections were actually cleaned out; the antivirus software (VIPRE Antivirus from Sunbelt Software) was configured to only keep logs for a few weeks (now corrected) but it was at least a month ago. I’m not even certain whether the problems were cleared by the current antivirus package or by a CD-based virus scan when we first started working with them. I know they had a rash of Conficker in the office, so this may have been the aftermath of that.

VIPRE and other tools all showed the system as clean even with the service entries in place, because the files that were being referenced no longer existed, and I suspect that nobody’s noticed the slow startup times because A) the user-facing services (database, authentication) were up fairly quickly B) the system was generally not being restarted while staff was in the office and C) it’s a server, it’s really not restarted that often. In this case an overnight power outage had exceeded the available battery backup duration and the system was shut down when they arrived in the morning.

Findings

In general, I didn’t find any indications of specific causes for the slowdowns – nothing relevant in the event log, etc. The suspicious services were all running with “svchost -k netsvcs” which is not surprising – it’s the home for multiple services loaded from DLLs, see the TechNet article in the resources list at the end of this post. The list of services run as part of netsvcs is found at HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/SvcHost in the netsvcs value (not in the subkey by the same name); the malware entries in my case were at the end of the list.

The short names for the services were randomly generated, but the descriptive names were reasonable-sounding fakes and the descriptions were pulled from other services. The services were hanging at stage “starting” and until they died other services weren’t starting even though there were no dependencies.

Setting the problem services to Disabled was not possible because access to the registry for them was denied. Similarly, the simple way to get rid of some services is with Sysinternals’ Autoruns tool, but because only the System account had access to those registry keys the version of Autoruns already on the system didn’t show the services (I have not checked whether newer versions will detect this problem).

Resolution

Identifying the specific service entries in the Registry wasn’t hard – I was looking for keys with no descendants (no plus sign next to them) and with randomly-generated names. It’s helpful to have a good feel for how names get shortened and abbreviated – just because a name doesn’t make sense at first doesn’t mean it’s actually random. The keys in question also all lacked values (hidden along with descendants by the lack of security permissions) and had permissions set to allow only System any level of access.

Removing the service entries from the registry manually was simple – it just required changing the security for the affected keys to allow Full Control to an administrative account; in this case the permissions were inherited all the way down. I have encountered situations in the past where security needed to be set on the key, then on the child keys separately. The names were also removed from the netsvcs value found in HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/SvcHost/ (they are in the value, not the key by the same name).

All “infection” keys were then exported and deleted.

Resources

Getting Started with SVCHOST.EXE Troubleshooting (Microsoft TechNet)

Virus alert about the Win32/Conficker worm (Microsoft Support)

Help with svchost.exe (Sysinternals Forums)

Related posts:

1. Fix for Outlook 2007 Trying to Load InfoPath (Error 1605) Just ran into this situation after a client uninstalled &...
2. (Fix) “Another Installation is Already In Progress’ installing Office 2007 over Office 2000′ Ran into an interesting problem this evening – I was...
3. (Fix) r3953724.cn Malware/Adware Redirections Quick Fix: have a program named procmon.exe running (copy of...

Related posts brought to you by Yet Another Related Posts Plugin.

He also has a few items related to medical statistics, one of which I’ve passed along to customers: How Safe is the HPV vaccine? (admittedly a controversial subject, as reflected in the comments).

Related posts:

1. Welcome to Fencepost Software Welcome to the Fencepost Software website and blog. Here you’ll...
2. Obligatory Website Color Tools Post An assortment of website color selection tools, including web-smart options....

Related posts brought to you by Yet Another Related Posts Plugin.

The standard fix for that is restarting the system to let the in-progress installation do the processing that it needs a system restart for, but in this case that wasn’t the issue.

Other options beyond that relate to removing the InProgress key from HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress, but that also wasn’t doing the trick so it wasn’t an existing installation – it was either something attempting an install behind the scenes (possible, but unlikely given the system setup) or it was something being triggered as part of the installation process.

Digging a bit, the .ipi file being referenced by that registry entry contained references to Office 2000 Professional Disk 2. That led to it being a problem with the uninstaller for the earlier version when started by the Office 2007 installer. Since it wasn’t critical to keep the other parts of Office 2000 on the system we went ahead and uninstalled that, but we received the same error attempting to uninstall Disk 2 (which contains Publisher and some Small Business Tools).

Since this was apparently an issue with the uninstall for that part of Office 2000, I did a bit of digging. It turns out that Microsoft has a cleanup utility designed to remove Office 2000 from a Windows 2000 (or earlier) system. It was last updated when Windows XP came out, and explicitly does not run on XP.

With that information, we ended up with Microsoft’s article How to remove Office 2000 CD2. This gives instructions on the files, directories and registry entries to remove after you’ve run the Disk 2 uninstallation (which was giving us problems all by itself).  Rather than individually remove all of the specified files, and since we had already removed the bulk of Office 2000, I took a bit of a shortcut.

Final Solution: While this is a little messy (there are no-longer-needed files and shortcuts left behind), the quick solution to getting the Office 2007 installer to stop trying to uninstall Office 2000 was to back up (export) the entire HKLM\Software\Microsoft\Office\9.0\ branch then remove it since no parts of Office 2000 are going to be remaining. This allowed the Office 2007 install to complete with no issues.

Followup: there are certainly files left behind that should be removed, but given the relative size of Publisher 2000 and modern hard drives I’m not too concerned about space consumed by the remaining files. There are some now-invalid shortcuts that should also be cleaned up, but since the user is above-average technically savvy she should be just fine cleaning those up herself.

Second Followup: Applies only if Outlook is being uninstalled. It turns out that the user in question was using Outlook Express but was using Outlook for storing Contacts – this was available up to Office 2000 but was removed in Office 2003 except for upgrades. Since the new version being installed didn’t include Outlook, I ended up needing to export the contacts from her PST on another system so she could use them in Windows Address Book. If you’re doing this and using Outlook Express, check first to see if you’re using Outlook Contacts and export as needed before proceeding. Microsoft’s article Copy Outlook contacts to the Outlook Express address book provides more information.

Related posts:

1. Fix for Outlook 2007 Trying to Load InfoPath (Error 1605) Just ran into this situation after a client uninstalled &...
2. Winlogon.exe at 50% or 100% CPU (Fix) There are apparently a variety of things that can cause...
3. Slow Startup with Multiple ‘Starting’ Services After Malware I had an interesting problem with a server (Windows 2003...

Related posts brought to you by Yet Another Related Posts Plugin.

The application in question uses an ActiveX table control to display data provided as XML embedded in the body of the web page, and has assorted other components that need to be installed on the PC for it to work. After getting past the basic issues (the regular user of the PC isn’t a local administrator, so no ActiveX installs allowed), we had the page loading, the table control displaying, and no contents.

After removing, reinstalling and verifying the registration of the control and the supporting libraries, both I and the vendor’s support staff were stumped (and it got kicked around their offices for a day or so). I had glanced at the HTML enough to confirm that the data to be displayed was in fact present and we knew it wasn’t an account issue on their side since the same web-app login worked correctly from other systems, so it was something specific about that newly-built system.

After a bit more poking around on my own in the HTML to see what was happening, it occurred to me that the very first thing in the block of VBScript was the command to link the table control to the XML-formatted data in the page. Since that wasn’t executing, I figured that perhaps the VBScript support on the system was out of date. I remembered seeing an update for that a few years earlier (Windows Script 5.6 for 2000/XP, 2007 and Windows Script 5.7 for XP, 2007), and applying that did the trick.

I’m not sure whether it was a question of the scripting support being outdated or simply not being present at all in a new install. In theory 5.7 was supposed to be a part of SP3 and 5.8 is in Windows 7 and Server 2008 R2, but since it’s not based on .NET it’s clearly not the direction that Microsoft is headed – it’s legacy code. Since the .NET-based PowerShell is available for all current Microsoft operating systems, I’d expect that at some point in the not too distant future the older Windows Script Host is going to fall by the wayside. If you’re developing for the long term, I’d try to avoid falling with it.

Note: Of course, this all ignores the fact that VBScript and .NET-based browser development will only run in Internet Explorer. If you’d like to have your application run in multiple browsers or be usable on Macs and Linux (and eventually on mobile devices like the iPhone, Android and probably even Windows Mobile), you should be working with JavaScript and some of the frameworks for it. ActiveX controls and IE-only scripting languages may add unnecessary constraints to your market.

Related posts:

1. Winlogon.exe at 50% or 100% CPU (Fix) There are apparently a variety of things that can cause...
2. Slow Startup with Multiple ‘Starting’ Services After Malware I had an interesting problem with a server (Windows 2003...
3. (Fix) “Another Installation is Already In Progress’ installing Office 2007 over Office 2000′ Ran into an interesting problem this evening – I was...

Related posts brought to you by Yet Another Related Posts Plugin.

The first thing to do when facing any computer problem is to figure out where the problem lies, so it was time for a bit of sleuthing.

These days the first thing to run on any general-use computer with networking problems is standard anti-spyware / anti-malware / anti-virus software. Some malware infections wedge themselves into the network stack so they can intercept and redirect traffic, and redirecting DNS queries is one approach to send traffic to either advertising that they get paid for or phishing sites where they can steal banking or credit card information. Even if an infection has been cleaned, it’s possible that a part of it was left behind and could still be causing problems. Antivirus boot/rescue CDs are great for this for two reasons: first, they clean the system of many of the more obtrusive problems and second, if they’re able to update over the Internet then it indicates that there’s not a hardware problem – just a Windows problem. Result: Nothing Found, possibly because I wasn’t the first person to look at it.

While those scans were running, I also checked whether it was a firewall issue though that seemed unlikely since nslookup was working. I have seen a major brand of “Internet Security Suite” decide to block DNS queries in the past, so I always check that. Result: Not the firewall

Microsoft has a couple of options for doing repairs to the TCP/IP stack and Winsock, both of which can be damaged by some malware. Assuming that you’re reasonably up-to-date, you can look at How to reset Internet Protocol (TCP/IP) (KB299357) and How to determine and to recover from Winsock2 corruption (KB811259), both from Microsoft. Read the cautions in these, you may need to reinstall some software that works with the Internet after using these. Result: these didn’t help either.

Windows does some caching (saving copies) of DNS lookup results, but the service that provides that isn’t critical – it just sometimes makes things faster. To see if that was the problem, I tried queries with the “DNS Client” service (as listed under Control Panel, Administrative Tools, Services) running and stopped. To start or stop it from the command line, use net stop dnscache and net start dnscache. Result: Not the DNS Client/dnscache

In the category of things I don’t expect most people to try, I checked the network traffic to and from the PC using Wireshark (formerly Ethereal, the portable version). The network traffic looked fine, but only DNS queries from nslookup were making it out – no other queries were being attempted. This is an advanced thing to check and for most users the results of using this tool will not make any sense, so unless you know what a packet sniffer is just ignore this step.

Finally, if nothing else has done the trick, you can try Winsock XP Fix. This depends on the fact that some important registry items are the same between different installations of Windows, so it’s able to completely remove those items and re-add them. In some ways this is a last resort because it’s kind of like taking a hammer to the problem, but it can do the trick when nothing else has worked. I’m also only going to suggest using it on Windows XP or older systems – it hasn’t been updated since before Windows Vista came out, so it’s quite possible that running it on Vista, Windows 7 or server operating systems would break things. Winsock XP Fix is available from multiple locations, including Winsock XP Fix at PCWorld.com, Winsock XP Fix at Ramesh/MVPS, or other locations by searching for the name. Result: This did the trick.

Update: What’s Happening?

(Added November 29, 2009) Since I neglected to include details of what’s actually causing these symptoms, here are my suspicions.

All of the items that I tried for diagnosing the problem (including a simple Python program that I didn’t mention) are using the standard gethostbyname(name) call, which is part of the standard WinSock API. If you’re a developer you may note that it accepts only the name to be looked up with no way to specify name servers, because it uses the name servers specified for your current network connection. You can see what those name servers are by running the command “ipconfig /all” from a command prompt.

NSLookup is a tool that allows you to check what results a specific name server returns, using the default name server(s) if you don’t specify one. The advantage of the tool is that if you’re in an environment with multiple name servers, you can use nslookup to confirm that Name Server B is actually returning the correct values when queried. “dig” is another tool that can be used this way, but is not normally found on Windows systems.

Because nslookup allows you to specify what name server to use, it can’t just use the built-in gethostbyname() API call since that doesn’t allow you to specify a name server. For that reason, nslookup in effect has its own internal implementation of that same call which is unaffected by many problems with the WinSock portion of Windows as long as the lowest-level network communications are still working.

For a cooking analogy, nslookup always makes its own bread from scratch rather than buying a loaf at the bakery, so when the bakery’s oven fails nslookup is unaffected.

Related posts:

1. (Fix) Postfix: Recipient address rejected: Domain not found We had a problem last weekend with Postfix not accepting...
2. Slow Startup with Multiple ‘Starting’ Services After Malware I had an interesting problem with a server (Windows 2003...
3. (Fix) “Another Installation is Already In Progress’ installing Office 2007 over Office 2000′ Ran into an interesting problem this evening – I was...

Related posts brought to you by Yet Another Related Posts Plugin.

It’s worth doing at least a little research when you’re purchasing technology items, particularly for items that you expect to last or that use consumables – specifically printers and fax machines. Because of the use of paper, toner or ink and possibly maintenance supplies, the up-front purchase price of a printer or fax machine is only a very small part of the total cost you’ll pay over several years of ownership. There may also be a surprisingly significant difference in setup costs between different pieces of equipment if you’re paying a third party to set up equipment and get it working for you.

This article leads off a series of occasional articles on purchasing printers for your office with a quick overview of some of the issues that I’ll examine in more detail in future articles.

Obviously the most important item is compatibility. If a printer that you purchase won’t work with your existing systems, it’s a waste of time and money dealing with it. While this isn’t a problem for most small companies, it might be an issue if you’re running unusual systems or are trying to use low-end consumer equipment with business-grade servers and operating systems.

Second is required features. Will you just be printing? Do you need to be receiving faxes? Scanning? Color or Black & White (and how much of each?)? Will this device be replacing your copier as well?

Beyond basic compatibility and features, it’s important to consider the cost of owning and using your printer. While a low-end printer is less expensive to purchase, if you’re printing more than 100-200 pages a month you’ll likely end up paying more for it over just the course of two years. For significant mismatches, such as a low-end printer being used for 1-2000 pages a month, you may end up paying thousands of dollars more because of the higher cost of toner or ink. It’s very important to have an idea of your print volume and needs and the cost of materials.

An issue seldom considered is installation cost – not physical installation (though if you purchase something 3 inches higher or wider than your available space then that can be an issue) but software installation. Regardless of whether you’re doing it yourself or paying someone like me to do it, you’re going to need to have drivers installed and your systems communicating with your new printer. If you purchase a printer that’s a poor fit for your existing systems, you may end up spending more time or money getting your printer installed and configured than you would’ve spent on a more suitable printer.

All of the above are very general, which is why I’ll be going into more details on each in future articles. I may recommend specific printers or manufacturers, but my general focus is going to be on determining what you need rather than on suggesting specific solutions.

To close this out I’m going to make one strong suggestion: When deciding on a printer you should always get one with networking support unless you’re working with a single PC and will never be using that printer from any other system. Printers with wired or wireless networking support may cost a few dollars more ($10-100 depending on model & overall printer cost), but built-in network support is far superior to networking added later with an external adapter and will almost always cost less than adding that adapter later. I’ll cover this a bit more in the future when talking about features.

Related posts:

1. Calculating Printer Costs and TCO I’m currently working up an article on the total cost...
2. Monochrome Laser Printer TCO/Cost – Preliminary Results I’m regularly asked by customers “Which laser printer should we...
3. (Fix) “Another Installation is Already In Progress’ installing Office 2007 over Office 2000′ Ran into an interesting problem this evening – I was...

Related posts brought to you by Yet Another Related Posts Plugin.

Update/Fix:

The system did indeed have a corrupted atapi.sys file as noted in the comments, though I did not end up using ComboFix to clean it – I was able to replace the file with the identically-sized but binary-different one from the most recent service pack (C:\Windows\ServicePackFiles\i386\atapi.sys) and have not seen the same problem recurring.

In addition, if you need to prevent it from redirecting while you download fixes, you may be able to simply copy notepad.exe (or another common executable) to the name procmon.exe and run that. Last night while I still had the infection active it did not seem to redirect while procmon was running under that name, possibly as a measure to avoid detection.

At this point (several days after initial infection, more than a week after initial reports in the wild) I suspect that many of the tools linked below are updated with definitions that cover this malware so you can probably get by with simply running updated versions of those.

Original:

I’m tracking an issue where a theoretically-clean PC is still being redirected from search results. I’ll be updating this post as I find more information.

I’m working on a PC that was infested with a variety of malware – I suspect a PDF exploit since it had an old version of Acrobat Reader and I cleaned at least one such exploit off, but there were a variety of things on there.

At this point the PC in question appears to be clear, however it still redirects search results from Google (and possibly others) to a failing domain r3953724.cn. It appears that this may be a redirection through other sites – it looks like there’s a jump from Google to another site (e.g. ecila.ceic.com, buffaloaviation.com, fashionvalleycoupons.com) to r3953724.cn. As I was writing this and testing it started directing not to the failing site but to other advertisments.

The cleaning tools I’ve used on it so far are AVG 9.0, Avira’s Rescue CD, MalwareBytes Anti-Malware, SuperAntiSpyware, GMER, and the Sysinternals tools.

An interesting note is that if Procmon.exe (from Sysinternals/Microsoft Technet) is running (or another program named to that) the redirection does not happen. Presumably this is an attempt to avoid detection. Similarly, if procmon.exe is renamed, redirection does happen.

This is not caused by an add-on in Internet Explorer – running with add-ons disabled still has the problem, and I’ve seen other reports that I believe indicated that Firefox was also affected, so this is presumably at the DNS or TCP/IP level.

Update:

No great luck in cleaning this out – it’s inconsistent in its behavior, but it does affect both IE and Firefox. I can see the DNS queries in Wireshark, but it’s not clear what’s triggering them. My suspicion is that something at the TCP/IP level is filtering the search engine results and replacing the expected redirection response with its own redirection response.

Unfortunately, I’ve more than run out of time to investigate it tonight, and taking the PC with me is not an option so I’ll have to return tomorrow.

Related posts:

1. Slow Startup with Multiple ‘Starting’ Services After Malware I had an interesting problem with a server (Windows 2003...
2. Fix for Outlook 2007 Trying to Load InfoPath (Error 1605) Just ran into this situation after a client uninstalled &...
3. (Fix) When DNS and ping Fail but nslookup Works (Windows) Spent some time recently with a laptop that would see...

Related posts brought to you by Yet Another Related Posts Plugin.

This post will be revised as I go through my bookmarks and with future tools and may end up changed into a reference page. More useful items are likely to end up higher up within the content of this post, and suggestions are welcome in the comments.

Color Picker is a simple web application that lets you use web-safe or web-smart colors and see how they’ll look.

MoreCrayons Web-Smart Palette tools has both a color cube (view interior of cube by unchecking boxes to hide the “layers” of color on the blue/Z axis) and a slider tool that only operates in the web-safe color ranges.

Adobe has a very nifty color theme tool called Kuler.

Sharebrain has a nice collection of links to color resources.

Giacomo Mazzocato has a very nice Accessibility Color Wheel that allows you to see how colors will appear to folks with some vision problems (various forms of “color blindness”).

Color Scheme Designer is a very powerful tool for picking a primary color and related colors that will work with that primary.

Acrovela has a listing of color tools.

Related posts:

1. Information Design and Graphics While unrelated to most of the content of this site,...
2. Compliment Comments and Spam Because of a standard configuration of many WordPress blogs, it’s...

Related posts brought to you by Yet Another Related Posts Plugin.

I found multiple other complaints about this, but no solutions (though some suggested removing and reinstalling Office). A bit of digging with SysInternals’ Process Monitor, turned up mention of not finding the somewhat promising value “DisableInfopathForms,” so I took a stab and created the value as a DWORD under the location ProcMon was reporting. Setting the value to 1 cleared the problem on Outlook startup.

Researching this at home later, I found very little mention of this value. The only useful mention is in Designing Forms for Microsoft Office InfoPath and Forms Services 2007 from O’Reilly, which also points out that the setting is available under Tools, Options, Other tab, Advanced Options button as a checkbox to disable InfoPath forms (as well as at HKCU\Software\Microsoft\Office\12.0\Outlook\Options\Mail where I created it).

According to the book this option is supposed to default to on (presumably treating a nonexistent registry value as “1″ or true). I’m not sure what happened in this case since the registry value was absent and I’m not sure what the checkbox in the options display was showing.

I think it was probably easier to find this by using ProcMon to look for Outlook failures than by searching the options.

Related posts:

1. (Fix) “Another Installation is Already In Progress’ installing Office 2007 over Office 2000′ Ran into an interesting problem this evening – I was...
2. Slow Startup with Multiple ‘Starting’ Services After Malware I had an interesting problem with a server (Windows 2003...
3. (Fix) When DNS and ping Fail but nslookup Works (Windows) Spent some time recently with a laptop that would see...

Related posts brought to you by Yet Another Related Posts Plugin.

It also covers an issue that has gotten a lot of attention in the open source medical software world since February – the $20 billion of funding to promote use of EMR systems in the American Recovery and Reinvestment Act of 2009, also known as the “stimulus bill.” That funding mandates “meaningful use” of “certified” EMR systems. Initial recommendations as to what “meaningful use” were released in mid-June, but the question of “certified” is still being fought since the only existing certification authority (CCHIT) is dominated by large software manufacturers and has costs that are prohibitive for small vendors and open source projects.

Read the article “Code Red – How software companies could screw up Obama’s health care reform” at Washington Monthly.

Related posts:

1. Welcome to Fencepost Software Welcome to the Fencepost Software website and blog. Here you’ll...
2. Information Design and Graphics While unrelated to most of the content of this site,...

Related posts brought to you by Yet Another Related Posts Plugin.

Update: The original title & article indicated that this applied to Windows PCs on domains only, but Offline Files is available to non-domain PCs as well as long as Fast User Switching is not turned on.

I haven’t gone through to track exactly what’s causing the problem, just identified it as an Offline Files problem. We disable Offline Files for systems we’re configuring so individual PCs shouldn’t be caching them, but every once in a while a Windows XP box will decide that it needs to be doing something. The symptoms can include either all available disk space being consumed by the C:\Windows\CSC (technically, %windir%\CSC) or winlogon.exe going into a loop that interferes with use of the system.

While Microsoft provides instructions and a mechanism to Re-initialize the offline files cache and database, following those instructions has never worked for me – possibly because the systems I’m encountering are having problems despite Offline Files being disabled.

For me, the solution has been to do the unthinkable, go against all available instructions, and simply delete the entire contents of the C:\Windows\CSC directory (from Safe Mode if necessary).

Reportedly deleting the CSC folder’s contents breaks Offline Files in ways that can’t be recovered from, but that’s not a concern for me because we aren’t using that feature and have no expectation of doing so (also, I suspect that it actually is possible to recover from this without having to reinstall Windows – possibly as easily as dropping from the Domain & rejoining). We have very few users with laptops, even fewer that need access to office files on laptops while outside the office, and none where having patient information on local laptop drives outside the office is a good idea.

Related posts:

1. (Fix) “Another Installation is Already In Progress’ installing Office 2007 over Office 2000′ Ran into an interesting problem this evening – I was...
2. Slow Startup with Multiple ‘Starting’ Services After Malware I had an interesting problem with a server (Windows 2003...
3. (Fix) r3953724.cn Malware/Adware Redirections Quick Fix: have a program named procmon.exe running (copy of...

Related posts brought to you by Yet Another Related Posts Plugin.

These generic compliment comments are part one of a two-stage spam attack.

WordPress (and possibly other blog platforms) can be set up so that comments from first-time commenters must be manually approved, but after that first comment is approved the commenter (based on email address) is free to make additional comments. Those additional comments will be automatically posted unless they violate other rules such as having two or more links/URLs in them.

The basic sequence then is something like this:

1. Spammer posts a generic comment complimenting the post. Nothing objectionable here.
2. Blog owner says “Awww, they like me! Approved!”
3. Spammer says “Great, now I can post spam to the blog!”
4. Spammer posts many spam comments with one link to their website or to whatever website they’re being paid to ‘advertise’ for. Comments show up immediately.
5. Blog owner doesn’t pay much attention.
6. Someone points out spam to blog owner.
7. Blog owner says “How did this happen???” while deleting spam comments
8. Spammer comes back again. If the blog owner didn’t block the email address, continues to post freely.

So, if you’re running a blog and see comments like that, don’t blindly approve them.

If you’re reading a blog and want to post a comment, please make it a comment about the post you’re responding to rather than a simple “I liked your post.”

Related posts:

1. Welcome to Fencepost Software Welcome to the Fencepost Software website and blog. Here you’ll...

Related posts brought to you by Yet Another Related Posts Plugin.

There were a few things that struck me as odd about this:

• It didn’t seem like a randomly-generated name,
• Most viruses/worms don’t seem to bother to set their file dates, particularly not to 5 years ago,
• I haven’t been doing anything likely to get my system infected, and
• I use a firewall that should’ve warned me if anything unusual was trying to make outbound connections from my computer (e.g. to try to spread an infection).

Searches via Google & Yahoo turned up nothing significant (mostly this file in lists of files and one warning that it had been found on infected systems), so I did a little more investigating at a very brute-force level.

The file in question doesn’t have any vendor information, version strings, etc. which is a bit suspicious, but looking at the actual content of the file, I found multiple strings tied to Dell power management configuration – hibernation, etc. Since this fits with the name “set pwr cg” I’m going to assume that the cg is short for something like “configuration” and that they were trying to stick with a DOS-style 8.3 name for this file. The reason it turns up on infected systems is that Dell computers get viruses too.

Almost certainly a harmless file, at least this version of it.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

© Alan Miller/Fencepost Software & Consulting, 2009. All Rights Reserved. | Permalink & Comments
Post tags: Maintenance, Repair, Security, Virus

This applies to email (e.g. Hotmail/Windows Live, Yahoo, Google and many others), social networking (Facebook, LinkedIn, MySpace, etc.), online photos (Flickr, etc.), and especially applies to your banking and finances. NO bank or financial services employee should ever ask for your password – bank policies generally prohibit them from doing so as a firing offense.

Think of someone asking for your password the same way you’d think about a stranger walking up to you on the street and saying “Hi, I’m with the village. I need your home address and your house keys.” No matter how friendly and professional looking, would you just give your keys to a stranger like that?

I had a situation recently where a friend using a free email account ended up with his login credentials stolen. The thief then proceeded to send email to his contacts telling them that he was in England for a conference but needed $2000 as well as making other changes to his email account to try to get into other accounts.

In this case nobody fell for the scam and we were able to get him back into his account, but looking at some of the changes that were made to his account was informative.

• The scammers had changed his default signature (which appears at the bottom of messages he sends) to look like an “official” communication from the email provider requesting the recipient’s username and password. Every email he sent included an attempt to get passwords from people.
• The scammers had set the “reply-to” value for messages to another account they controlled. That means that any replies to his messages would go to the scammers instead of to him. This was also part of the “official” request for login information.
• The scammers had deleted all of the messages they sent from his account from the Sent Items folder, so there was no way to see exactly what had been sent or to whom.

There wasn’t any sensitive or financial information in his email account, but in many cases there would be. Consider your email – do you have messages from utilities? Electronic bills? Account registration confirmations from websites that include your password? An account that has been broken into can be worth thousands of dollars to thieves if they can get into your banking information or just get your friends to send them money. Don’t let the victims be you and your friends.

Related posts:

1. Email Marketing – Use A Service I occasionally get requests from clients for assistance with sending...

Related posts brought to you by Yet Another Related Posts Plugin.