On another list I read, there is notice of an email worm. It attaches, or
attempts to attach to all outbound emails. Patches winsock to do it.
--
Jay Thorne The Net Result System Services jay@result.com
http://net.result.com
Zoom 505 Effect page http://net.result.com/~jay
Zoom 5xx series Patch Database: http://net.result.com/~jay/db.html
attached mail follows:
Date: Mon, 8 Feb 1999 12:23:42 -0800 (PST)
From: David Lang
Subject: Re: DEC-Chip made by Intel ? happy99.exe
Message-ID:
happy99.exe is a e-mail worm, on a windows system, if you run it it gives
you a fireworks display and modifies your system to add itself as an
attachment to every e-mail address you send.
here is the message I got from CERT when I asked them about it.
- From cert@cert.org Mon Feb 8 12:22:38 1999
Date: Wed, 03 Feb 99 11:30:43 EST
From: "CERT(R) Coordination Center" <cert@cert.org>
To: David Lang <dlang@diginsite.com>
Cc: "CERT(R) Coordination Center" <cert@cert.org>
Subject: Re: [CERT-INFO#1947] possible fraudulant alert FW: Network Alert
(fwd)
David Lang <dlang@diginsite.com> writes:
>-----BEGIN PGP SIGNED MESSAGE-----
>
>Unlike most of this type that I see, this sounds like it is possible, have
>you heard anything about it?
>
>David Lang
>Senior Network Engineer, Digital Insight
>
David:
Please go to the following web page address to find out more about the
"Happy99.exe" message.
http://www.datafellows.com/v-descs/ska.htm
Rhonda Green
- --------------------------------------------------------------------------
CERT Coordination Center CERT* hotline: +1 412 268-7090
Software Engineering Institute Fax: +1 412 268-6989
Carnegie Mellon University Web: www.cert.org
Pittsburgh, PA 15213 FTP: info.cert.org/pub/
*Reg. U.S. Patent & Trademark Off.
- --------------------------------------------------------------------------
Good signature made 1999-02-03 16:32 GMT by key:
1024 bits, Key ID 2DE30EC1, Created 1994-03-31
"CERT Coordination Center <cert@cert.org>"
On Mon, 8 Feb 1999, Thomas Krause wrote:
> Date: Mon, 8 Feb 1999 12:39:32 +0100 (MET)
> From: Thomas Krause <tom@pluto.deh.de>
> To: Nigel Metheringham <Nigel.Metheringham@ThePLAnet.net>
> Cc: linux-tulip@cesdis1.gsfc.nasa.gov
> Subject: Re: DEC-Chip made by Intel ? happy99.exe
>
>
> Hello,
>
> I'm not sure, where the happy99.exe comes from.
> Please delete the message and do not open or
> execute the attachment!
> Maybe this is a virus which affects Netscape 4.5.
> Plese forgive me!
> This mail was send bye elm.
>
> Regards,
> Thomas.
>
>
> >
> >
> > tk@webmatic.de said (on the Linux Tulip list):
> > } begin 644 Happy99.exe
> >
> > I guess this wasn't intentional....
> >
> > Nigel.
> > --
> > [ Nigel.Metheringham@theplanet.net - Systems Software Engineer ]
> > [ Tel : +44 113 207 6112 Fax : +44 113 234 6065 ]
> > [ Real life is but a pale imitation of a Dilbert strip ]
> > [ We're recruiting http://www.theplanet.net/profile/recruit.htm ]
> >
> >
>
>
"If users are made to understand that the system administrator's job is to
make computers run, and not to make them happy, they can, in fact, be made
happy most of the time. If users are allowed to believe that the system
administrator's job is to make them happy, they can, in fact, never be made
happy."
- -Paul Evans (as quoted by Barb Dijker in "Managing Support Staff", LISA '97)
-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv
iQEVAwUBNr9H0D7msCGEppcbAQE41wf/fF1JQiFKbg4p40SYbtxm708hnrgJeo4n
bSO676PtZekiGAJneZeFWWipnsvs17eol0eILsCe5nmJA6BnHfdJmidQgk9V5Qef
3B8bYPesb0xj45jwAyqSw3YB11Ih89QmE/65ln1EdNAvAP6mZEABz8RA+owDsUPS
aWKvITW77kHWUsN/310sC884xm0kEnJEo7tC7jJPksceaEGqHBy3m25BUm3hengF
2e/d27eZ16VUVmBhADIPbCA1bVi4ZhyhHebMUZNaZQsom4t1KADetP16o9c25NuM
pRzvRuqQV2gyE/l5skVG02hZQ9Y+qW65TwtkWDIRLm7BVUlAZY7BVw==
=mbuU
-----END PGP SIGNATURE-----
VanLUG Email Archive