Maculous > A Phone Call From a Friend

A very good friend of mine who lives in the next state over called me last night wondering why he could not connect to any of my web sites. Right now they are spread across 2 dedicated servers as we wait for a client to finish migrating from our old server to this kick ass dual core server. I suggested there might have been a temporary routing problem between his ISP and the data center in Dallas where this server lives, and we went on to talk about other things.

This morning I had an email from him listing sites of mine he could not reach, he was just getting timeouts. Since I do tend to block IP addresses in my firewall that I see being used for nefarious reasons, I looked up his IP and verified that it was not blocked. But still he could not connect.

On a hunch I had him try doing an nslookup of one of my domains, and discovered to my great surprise that he was using a DNS server in Russia and it returned its own IP address for every domain name. In other words his Microsoft Windows computer had been hijacked, and all of his web access was being proxied through this Russian server. And the reason he could not access my sites is because I had already blocked this criminal enterprise in my firewall.

I did some research for him and found out that the particular malware his Windows box was infested with was likely installed when he received an email or visited a webpage with a maliciously crafted Windows MetaFile (.wmf) image. If he had been so foolish as to use Internet Explorer as his web browser or Outlook Express as his mail client then it would have been conveniently auto-installed for him as part of Microsoft’s “Rich Multimedia Experience” design philosophy.

I went on for some time about how he should reformat his C: and reinstall Winblows when he interrupted me and asked if he would have this kind of a problem with a Mac. And of course I answered quite honestly that he would not. He explained that a University where he was once employed was offering a great iMac educational deal, and when we ended our conversation his plan was to order an iMac tomorrow.

There’s one more friend who won’t need to call me for technical support anymore, and I know he will love his iMac. A happy ending, for sure.

Technorati Tags: get a mac, Windows, security, malware DNS exploits, Russia, OS X, Microsoft