Need help? Call 800-511-MACS (6227)

Home



Subject: Tech Tails #210: Recognizing Scam Mail, Handy Shareware Applications, Get Out of a Freeze
Date: March 16, 2004
In this issue: Rough and Tumble Russ Get Out of a Hard Freeze Shareware
Alley How to Recognize Scam-Mail


Hello Tech Fans!

Well, it had to happen sooner or later. I was out skiing on Sunday, it
was nice and warm (low 40s), so when I got home, I figured I'd take my
motorcycle out for a spin (to coin a phrase). I fired it up and took it
to the gas station to inflate the front tire. So far, so good.

I went back to the apartment and decided to go to an empty parking lot
to get back into practice with low-speed maneuvering. I was having a
blast, motoring around no higher than 20 MPH, just getting back into
the feel of things. I started to get comfortable. Too comfortable. I
decided to take a corner a bit too aggressively, and the rear tire hit
a patch of gravel and swung out to the left.

Bang! Scrape! The bike slid out from under me, and I slid away from the
bike.

The bike lay on its side idling. The first thing I did was get up and
inspect the bike for damage. The right front turn signal cover was
shattered. Oh well, those are easy to replace. The back of the bike
seemed OK. The clutch lever felt a little squishy, but I can readjust
that. I hopped back on the bike and motored back to the apartment to
inspect my wounds.

Strangely, after the crash the bike seemed more lively (for a while,
the bike had lost its explosive acceleration, but now it's back, in
spades).

I got into the apartment to find my ski jacket shell had a gaping hole
in the sleeve, but the liner was OK. My jeans have a large rip in the
left pocket, but aside from a pair of lightly skinned knees, I'm fine.
Funny, that wipeout didn't seem so bad. I've always been so afraid of
them.

Now I just need to fix the bike. Looks like I'll need to readjust the
clutch lever, put in a new turn signal bulb and a new turn signal lens,
and, since the explosive acceleration's back, it'll probably be worth
repairing the bike. (I was contemplating getting a newer used bike this
year, but perhaps I can push it off for another year.)

Hopefully, this is my first and last crash. Thanks to the right safety
equipment, I came out of it no worse for wear. If I'd had a pair of
leather chaps on, my jeans wouldn't even be damaged. That'll be my next
investment, and I can get a replacement Columbia shell from a ski
store.

As long as you have the right protective gear and don't overestimate
your own skill or the conditions (as I did on Sunday), you should be
fine. I chalk it up as a learning experience. Just make sure you wear
the proper safety equipment when you ride. It'll save your life.

+-------------------------------------------------+

My computer just froze up, what now!?! by Troy Kingsbury
(Troy@Smalldog.com)

I often have to tell people how to get their computers to restart after
freezing. More often than not, I have to do some research to find that
reset button. Well, I ran across a real keeper of an Apple Knowledge
Base article called. "Desktop Macintosh: Power, Reset, and Interrupt
Buttons, Part 2"  (Article # 85225):

http://docs.info.apple.com/article.html?artnum=86225

It does a nice job of helping you find those buttons in most computers
made after 1997. If you have a computer from before that time, you can
look up your reset in the Apple Knowledge Base by typing "Desktop
Macintosh: Power, Reset, and Interrupt Buttons." This finds article
#14117. Thinking I was onto something here, I used logic and tried to
look up portable reset buttons but was unable to find anything. Than I
remembered that the PMU is different on a laptop because it uses two
different power sources .

With this new knowledge I was able to find some useful links. The first
one was how to reset the PMU on the older PowerBooks up to the PB 5300
model. To find that link, type in "PowerBook: Resetting Power
Management Unit (PMU)" (Article #58416). For the newer PowerBooks and
iBooks up to and including the 17-inch Powerbook, use this link.
"PowerBook and iBook: Resetting Power Management Unit (PMU)" (Article #
14449):

http://docs.info.apple.com/article.html?artnum=14449

The PMU on Apple’s laptops controls numerous functions. From the Apple
Knowledge Base Article:

"The Power Manager is an integrated circuit that is usually on the
logic board of the PowerBook and iBook. As the name implies, it is
responsible for power management of the computer. It controls
backlighting, hard disk spin down, sleep and wake, some charging
aspects, trackpad control, and I/O as far as looking at the serial port
and modem so it does not sleep when connected.

"Over time, the settings in the Power Manager may become unusable,
which can result in operational anomalies with the computer. Examples
would be not turning on, not waking from sleep, not charging the
battery, or not seeing the AC Adapter, among others.

"Resetting the PMU is not intended for resolution of a stall or
situation in which the computer is non-responsive. A PMU reset should
not be necessary except as a last resort in cases where a hardware
failure of the power management system is suspected. Performing a PMU
reset returns the iBook and PowerBook hardware, including NVRAM, to
default settings and forces the computer to shut down.

"For most situations, a restart is sufficient. If the computer has
stopped responding, try these steps, in order, until the computer
responds:

"1. Force Quit (Option-Command-Escape)

"2. Restart (Control-Command-Power)

"3. Force Shut Down (press the power button for ten seconds)

"Only perform a PMU reset on the computer if none of the above steps
resolved the situation. If this is the case, see instructions at links
above on locating the reset button or key combination for your model of
iBook or PowerBook.

"Warning: Resetting the Power Manager on any PowerBook or iBook will
permanently remove a RAM disk, if present, and all of its contents."

+--------------------------------------------------+

Shareware Alley by Duane Letourneau (Duane@Smalldog.com)

I don't use a lot of shareware. Sometimes a client will come in and his
entire user interface is radically altered due to a shareware program
that he has installed. Then I can't recognize which icon is for which
application and have to search to find the shutdown command in the
Apple menu.

The shareware I do use (and buy) provides some simple functions with
little or no eye candy:

Wincent Colaiuta's excellent Synergy app is a prime example. Synergy
installs itself as a System Preference and is an extension to iTunes
that allows me global access to iTunes volume, previous and next
tracks, pause, and play. I can be in any application and press the
proper keys for the iTunes functions I want to perform. It's a great
little app. The eye candy includes buttons for previous and next
tracks, pause, and play in the menu bar, and a pop-up window that lists
the track name, album, and album cover.

http://wincent.org

Panic makes a great little newsreader called Unison. I helped a client
with her newsgroup needs and, after trying five different apps, Unison
came out on top based on the Finderlike interface and method of
presenting different group types. Panic also makes Audion MP3 jukebox
software and Transmit 2, an FTP client.

http://www.panic.com

Here in Waitsfield, our inexpensive, high-speed, business-class
Internet connections are neither inexpensive nor high speed. There are
times when we have to download very large files from Apple, and that
can really bottle up the all-important web traffic. Presenta Software's
iGetter is a good app for keeping download speeds at a reasonable
level. Easy to use out of the package and highly customizable, iGetter
has solved my needs since I started looking for an app like this two
years ago. Here's what Presenta says about their software:

"iGetter is a full featured download manager and accelerator. With
iGetter you can get the most out of your Internet connection (dial-up,
wireless, cable, DSL, T1 etc.).

"iGetter can greatly improve the speed of your downloads using
segmented (accelerated) downloading. In addition it allows auto resume
on broken downloads, queue filtering by various criteria, scheduling
downloads for low traffic periods, auto redial on broken connection,
auto hang-up and shut down on completion, and much more."

http://igetter.net

Like I said, I don't use a lot of shareware. If there's an
above-average app that you use and would like to tell me about, drop a
line.

+---------------------------------------------+

How to Recognize Scam-Mail by Russ White (Russ@Smalldog.com)

I know I've written a few articles on how to reduce spam and set up
e-mail filters. Yes, you guessed it, it's time for another one.

Most spam just fills your in box and annoys you, but in this week's
article, I'll deal with an insidious type of spam, the "scam-mail," a
spam whose sole purpose is to get you to supply your credit card number
so the scammer can make fraudulent purchases charged to your credit
card.

Most of these scammers have a clickable button in the e-mail that leads
to a very official-looking website, with bank logos and everything
(stolen from the bank's website), but in actuality, the website is run
by the scammer. If you enter your credit card number, you've just given
the spammer the ability to run up a huge bill of fraudulent purchases.

On 3/10/04, I received one of those "someone stole your credit
card/card number" spams--my very first scam-mail. I feel so special
now. ;) I knew it was a fake right away. After all, a quick scan of the
e-mail headers gave it away. Stupid, stupid spammer. You don't want to
cross me.

So, after I got a good laugh out of the e-mail, I forwarded a copy to
Earthlink's abuse department, Yahoo's abuse department, *AND* the Visa
credit card company. <evil grin> Hopefully, all three companies will
come down on the spammer like a ton of bricks (or something equally
heavy and unpleasant).

In case you don't know, here's how to determine a fraudulent e-mail:

First, you need to display all the e-mail headers. These sections tell
you from where the e-mail was sent. By default, most e-mail apps
(including Apple's Mail.app) do not display the headers, in order to
make the e-mail document look less confusing to the novice.

To turn on header display in Apple's Mail, go to the "Mail" menu,
select Preferences, and in the preferences window, select the Viewing
option. On the "show header detail" option, select "all." Mail will now
display all the necessary header information.

Yes, headers can be faked or spoofed, but it at least they give you
some place to start. What you want to look for in the headers are any
obvious discrepancies between where the e-mail came from and who sent
it. In the example below, if it was a legitimate e-mail, the return
path and received headers in asterisks (I added the asterisks for
emphasis) should be from Visa.com.

Pat O'Rourke has assisted me in modifying the headers to prevent
spammers from harvesting info from this article. Where you see "dot
com", it actually was .com.

He writes the following clarification:

"We got these header values from a spam we received and we have
modified the values so that if a spammer reads this, they wont be able
to harvest the address to use as an open relay. Windows users should do
their part and make sure that they have virus software installed with
current virus definitions so they won't unknowingly transmit spam. Or
better yet, switch to OS X. ;-) Why else would you be reading a
Mac-friendly newsletter?"

Here's the scam-mail in question, with modified headers:


From: Visa Service <security@visa-security Dot com> Subject; Visa
Security Update Reply-to:Visa Service <security@visa-security Dot com>
********Return-path; <Spoofed_address at yahoo Dot com> Received; from
postoffice.nospam.dot com ([unix socket]) by postoffice.nospam dot com
(Cyrus v2.1.13) with LMTP; Wed, 10 Mar 2004 18:42:46 -0500
********Received:from 42.123.XXX.XXX (Infected_user.mindspring Dot com
[42.123.XXX.XXX]) by ********postoffice.nospam dot com (Postfix) with
SMTP id DA887A77462 for <MacTech at nospam Dot ********com>; Wed, 10
Mar 2004 18:42:44 -0500 (EST)

Dear Sir/Madam,

We were informed that your card is used by another person or stolen. It
could happen if you have been shopping on-line, and someone got your
"Billing information" including your card number. To avoid and prevent
any billing mistakes and to refund your credit card, it is strongly
recommended to proceed filling in the secure form on our site and
applying for our Zero Liability program. This program is free and it
will help us to investigate this accident. Sincerely yours, Visa
Support Assistant, Alwin Desagun.


Look at the marked Return path and second received line. The spammer
appears to be using a Yahoo e-mail address and is sending it from the
Mindspring (Earthlink) servers. Somehow, I don't think the monolithic
Visa corporation is using a Yahoo account through Mindspring.

Now, you should simply ignore and delete most spam e-mails, but in the
case of scam-mail, you really should send copies to the abuse
departments of all the companies in question. They take fraud quite
seriously.

Now, let's compare the headers in the response I received from Visa:


From: "Visa.com Correspondence" <askvisa@visa dot com> Subject: 32PB
RE: I was sent a potential fraud e-mail Return path: <askvisa@visa dot
com> Recieved: from postoffice.nospam dot com ([unix socket]) by
postoffice.nospam dot com (Cyrus v2.1.13) with LMTP; Thu, 11 Mar 2004
15:32:51 -0500 Received: from visa dot com (portal3.visa dot com
[123.42.XX.X]) by postoffice2.nospam dot com (Postfix) with ESMTP id
2C07E3006E for <MacTech@nospam dot com>; Thu, 11 Mar 2004 15:32:51
-0500 (EST) Received: from ([42.42.XX.XXX]) by portal3.visa dot com
with ESMTP ; Thu, 11 Mar 2004 12:16:44 -0800 (PST) Received: by
sw720x001.visa dot com with Internet Mail Service (4.2.XXXX.XX) id
<GWLC5JR2>; Thu, 11 Mar 2004 12:16:44 -0800

Thank you for contacting Visa and questioning the suspicious e-mail you
received.

Our security department is investigating this matter and they are
working with the proper authorities to terminate this fraudulent
activity.

Visa has many safeguards and detection systems in place, but prompt
action by alert cardholders remains a very important method of stopping
deceitful activities. Should you receive further communication that you
deem questionable, please feel free to contact us immediately.

Please be reminded that U.S. and Canadian Visa cardholders are fully
protected by Visa's Zero Liability policy. This means that cardholders
pay nothing in the event of unauthorized card use.

We appreciate your bringing this matter to our attention.

VISA Webmaster


Notice that in this e-mail both the Return Path and Received match the
domain name. They all originate at Visa.com. This is a legitimate
e-mail.

Here are the links to the abuse departments of the companies in
question:

Yahoo		http://add.yahoo.com/fast/help/us/mail/cgi_spam
Earthlink		Junkmail@earthlink.net
Visa			askvisa@visa.com

Pat O'Rourke adds the following tip as well:

Use other tools to find and report open relays.

http://openrbl.org/

Take the IP address that the message was received from in this case:
42.123.XXX.XX and look up the machine to see if it is an open relay. In
this case, it is. From here you can do a couple of things.

First send an email to abuse@XXXX.com (where XXX equals the ISP), such
as abuse at mindspring dot com, and report the message. Be sure to
include the Internet header information so they can do their part and
notify the end user they are breaking the terms of their service
agreement. Spam is a real problem for ISPs in terms of wasted
resources, server capacity, and bandwidth, so ISPs want it stopped as
much as end users do.

Then nominate the machine relay for testing and black listing at
ORDB.org

http://www.ordb.org/submit/

+---------------------------------------------+

Specials!

Here are the specials for this issue of Tech Tails. They are valid
through March 22, 2004, or while on-hand supplies last. Be sure to use
the wag URLs when placing your order to get this special pricing.

+----------------+

Brand-new 12-inch iBook G3/800 128/30/CDROM/56K/AirPort - $749 Includes
Kensington Astro Pack in Gray

To order: http://www.smalldog.com/wag14115/attt

+----------------+

There's still time left! Turbo Tax for Tax Year 2003 - $49 Includes a
nip of Vermont Maple Syrup.

To order: http://www.smalldog.com/wag14022/attt

+----------------+

Canon PowerShot A310 Digital Camera (3.2 megapixel) with FREE SanDisk
32mb Compact Flash Card - $199

To order: http://www.smalldog.com/wag14116/attt

+----------------+

LaCie 80gb 7200RPM FireWire P3 Porsche - $125

To order: http://www.smalldog.com/wag14117/attt

+----------------+

Epson Stylus Photo 820 Silver 2880x720DP w/Olympus Digital Camera -
$185

To order: http://www.smalldog.com/wag14067/attt

+----------------+

Free shipping* on Mac OS X 10.3 Panther w/ Nip of Pure Vermont Maple
Syrup and iLife 2004 - $165

*Free Shipping via UPS 3-Day to Lower 48 States.

To order: http://www.smalldog.com/wag14118/attt

+----------------+

VillageTronic VTBook 32mb Cardbus Video Card - $245

The world's only 32 MB Graphics Card for notebooks connects additional
high-end Displays. All VGA, DVI, and ADC displays are supported.

To order: http://www.smalldog.com/product/45561/attt

+---------------------------------------------+

That's it for this week. Thank you once again for reading. Be sure to
pass on the specials and info to your friends and coworkers.

Troy Kingsbury, Duane Letourneau, and Russ White

+----------------------------------------------------------------------
-+ You are subscribed to TECH TAILS, a tech tips email newsletter from
Small Dog Electronics. To unsubscribe:   
http://www.smalldog.com/unsubscribe_n.html To add yourself:  
http://www.smalldog.com/subscribe.html If you  need  additional  help,
please contact: ListMaster@smalldog.com
+----------------------------------------------------------------------
-+ Check out our other newsletters:
http://www.smalldog.com/subscribe.html KIBBLES & BYTES -- our main Mac
newsletter EDS UP! -- news/info for the Mac educator MACWOMEN -- a 
biweekly  email newsletter focusing on Women and the Macintosh
+----------------------------------------------------------------------
-+ Small Dog Electronics "High Technology for Low Prices" 1673 Main
Street, Waitsfield, Vermont 05673 USA Phone: 802-496-7171 Toll Free:
800-511-MACS (6227) Fax: 802-496-6257  Email: sales@smalldog.com
<http://www.smalldog.com>
+----------------------------------------------------------------------
-+ TECH TAILS, SMALL DOG, SMALL DOG ELECTRONICS and HIGH TECHNOLOGY FOR
LOW PRICES are registered trademarks of Small Dog Electronics, Inc.
Entire contents Copyright 2004 Small Dog Electronics, Inc., Waitsfield,
Vermont USA - All Rights Reserved

V 10.10.10.10