Info: Windows Update + Atheros AR5007EG Wireless Network Adapter

If you happen to be running a machine with the following wireless card (i.e. those of you with Toshiba Satellite laptops), be sure you read the details before updating;

Atheros AR5007EG Wireless Network Adapter

I've just had an update available for this via Windows Update, and whilst it mentioned a restart would be required (though this information was ONLY available in the extended details, which I rarely read), it did not mention that it would wipe out any saved networks, which meant I had to reconfigure them - oh joy.

If you install this update and DO NOT restart the machine, you may notice Windows telling you the adapter does not match the requirements of the wireless network - this is completely untrue. Just reboot your machine and all will be well again.

If anyone from Microsoft is reading this, this update requires a restart, so have Windows Update ask if it can restart after installing the update. Don't rely on the user reading the details - most don't bother. Oh and, ensure it doesn't wipe out any saved wireless network configs ;o)

Update 3: Malware, scams and RedStation (AS35662, 81.94.192.0/20)

Re-checking the list of domains previously mentioned, shows they're on the move to a new range. This time owned by known crimeware friendly ISP, ROOT SA (aka Root eSolutions, AS5577 212.117.160.0/19, AS44042). The new IP is 212.117.169.106.

There's only a handful resolving to the new IP at the time of writing, so presumably the rest are awaiting DNS propagation.

http://temp.it-mate.co.uk/hpObserver_results_-_Redstation-04062010.html

References:

WARNING: Malware, scams and RedStation (AS35662, 81.94.192.0/20)
http://hphosts.blogspot.com/2010/05/warning-malware-scams-and-redstation.html

Legitimate Software Typosquatted in SMS Micro-Payment Scam
http://ddanchev.blogspot.com/2009/07/legitimate-software-typosquatted-in-sms.html

Crimeware friendly ISPs: root eSolutions
http://hphosts.blogspot.com/2009/11/crimeware-friendly-isps-root-esolutions.html

hpHosts blog
http://hphosts.blogspot.com/search?q=root+esolutions

Update 2: Malware, scams and RedStation (AS35662, 81.94.192.0/20)

Second update to this, and I'm pleased to announce, Redstation forced their customer to disable the sites completely (Redstation didn't want them on their network). A quick check has revealed those still resolving to the RedStation range, are now dead (sites resolve but fail to load), and those spewing malware, are now parked at parkwebwin-v03.prod.mesa1.secureserver.net (GoDaddy parking server).

hpObserver results:
http://temp.it-mate.co.uk/hpObserver_results_-_Redstation.html

I'm still monitoring them to see where they go next, and am also still on the lookout for new domains popping up.

A special thank you to Redstation for acting to promptly is deserved I think.

References:

WARNING: Malware, scams and RedStation (AS35662, 81.94.192.0/20)
http://hphosts.blogspot.com/2010/05/warning-malware-scams-and-redstation.html

Legitimate Software Typosquatted in SMS Micro-Payment Scam
http://ddanchev.blogspot.com/2009/07/legitimate-software-typosquatted-in-sms.html

UPDATE: Malware, scams and Redstation

Just an update folks. Whilst the sites are still live, the downloads appear to have gone *for now* (pretty confident they'll be back). I did hear back from Redstation, who asked for evidence, and such was passed to them.

If you've paid for ANY of the software they're scamming and infecting for, contact your credit/debit card company and ask for a charge back.

In the case of these particular domains, the company responsible for the scams (and likely for the malware aswell, given the source is the same domains), is;

Company: Soletto Group, S.A.
aka: Nextcard Ltd, Netlink Network Corp
ICO Reg. Number: Z2140425
Support: support.uk@soletto.net
Phone Support: 02071939823

Contrary to their UK phone number, they're not UK based, they're actually in Panama;

Soletto Group S.A.
ADR Tower, 8th floor,
Samuel Lewis Avenue, and 58th Street,
Obarrio Urbanization,
Panama City
PA
Phone: +507.6022067111 (voice) +507.111111

Check your bills for any reference to this name, or indeed, any other name you do not recognize, and report it both to your local police force, and to the credit/debit card company.

I'm continuing to monitor them, both for new domains, and incase they popup elsewhere (we already know they're using OVH aswell), and I'll update you when further information comes to light.

References:

WARNING: Malware, scams and RedStation (AS35662, 81.94.192.0/20)
http://hphosts.blogspot.com/2010/05/warning-malware-scams-and-redstation.html

Legitimate Software Typosquatted in SMS Micro-Payment Scam
http://ddanchev.blogspot.com/2009/07/legitimate-software-typosquatted-in-sms.html

Site owners: Are you listening?

I come across hundreds of malicious sites each day, both compromised sites, and bad guys sites, and send hundreds of abuse reports each day for them.

This morning, I received a rather strange e-mail from one of the hosting companies I'd sent an abuse report to, an e-mail with the following content;

Hello

Can you give me the ticket number of the tickets you have opened regarding the past?

"It is a little frustrating that I have been asking for help and opening tickets
about this IP get blacklisted and you folks check it out and say there is
nothing wrong."

I have looked through your history and unable to find anything.

Thank you.

The problem of course, is that the host had actually meant to send this to the site owner, and not to myself (and because of this, I'm not going to mention either the affected site, or the hosting company, as it was a genuine mistake on the hosts part).

The issue here, is that the site owner has obviously had his site taken offline by his host, on more than one occasion, and a quick look at the sites source code quickly told me why - he/she is STILL running WordPress 2.8. This version of WordPress is now VERY out dated, and very insecure, and is the cause of the sites constantly getting compromised.

This points to the "post of the bleedin obvious" that we keep reading - site owners are not taking care of their sites, and keeping the software they're running, up to date. In this case however, the site owner is building sites for other people. If he/she can't even keep his own site up to date and secure, how on earth are his customers going to know whether or not their sites are secure?

Now for the rest of the "post of the bleedin obvious" - a message to ALL site owners out there, that are reading this. If you're not ensuring any software your websites server is running, is kept up to date, then your site is seriously at risk of being compromised. This does not just cover any CMS/blog software, but server-side stuff such as PHP/MySQL/Apache etc etc, and for those that don't have server access, make sure you're hounding your hosts to keep this stuff up to date for you (there's no excuse for their not doing so, and if they refuse or say they can't - move the site to a new host).

If your site is compromised, and you need help, feel free to come over to the Malware Domain List forums, and we'll help you out (for free of course);

[INFO] My website has been hacked, what do I do?
http://www.malwaredomainlist.com/forums/index.php?topic=3122.0