There are 17 messages totalling 557 lines in this issue.
Topics of the day:
1. FTPMail, Agora, etc. statistics
2. malicious person -- now what ?????
3. How to decode
4. what�s is the better format : UUE or Mime Base64
5. Usenet Hosts
6. Who sent the "Happy99.exe"
7. thank before leaving list
8. ACCMAIL Digest Posting time
9. Infested ACCMAIL Digest
10. Happy99
11. Happy99.Exe - what to do about it
12. Problem with decoding files.
13. which usenet groups are moderated ? (2)
14. a forwarding e-mail wanted
15. ACCMAIL Digest - 12 Mar 1999 to 13 Mar 1999 (#1999-73)
16. Happy '99 scare
~~~~~~~~~~~~~~~ ACCMAIL Info (automatically generated) ~~~~~~~~~~~~~~
To UNSUBscribe: Send UNSUBSCRIBE ACCMAIL to [EMAIL PROTECTED]
To get the ACCMAIL FAQ: Send e-mail to "[EMAIL PROTECTED]"
and enter only this line in the BODY of the note:
send usenet/news.answers/internet-services/access-via-email
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
----------------------------------------------------------------------
Date: Tue, 16 Mar 1999 06:01:19 GMT
From: [EMAIL PROTECTED]
Subject: FTPMail, Agora, etc. statistics
FTPMail, Agora, etc. statistics for Mon 15 Mar 1999, posted Tue 16 Mar, 06:00 GMT/BST
Less than 1 hour
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
1-4 hours
None
4-10 hours
[EMAIL PROTECTED]
More than 10 hours
[EMAIL PROTECTED]
[EMAIL PROTECTED]
Response within 4 hours in at least 5 out of 7 recent tests
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
This data is generated automatically around 0600 GMT/BST most
days. The performance reported is dependant on many factors and your
experience may vary. You can also access this list:
On the Web at http://www.netservs.com/mrcool/stats.htm
By FTP at ftp://ftp.cix.co.uk/pub/net-services/stats.txt
Mail to [EMAIL PROTECTED] and say
"get file stats.txt" (no quotes)
Want this list every day? Send mail to [EMAIL PROTECTED] and in the
body of your message put "join statistics" (no quotes)
No liability is accepted for inaccuracies. Mirroring, links to and
copying of this entire file (not extracts) is permitted until further
notice.
Slow downloads? Try Mr. Cool!
See http://www.netservs.com/mrcool/
Copyright Net Services 1999.
------------------------------
Date: Mon, 15 Mar 1999 19:54:43 PST
From: "Jerel D. Arbaugh" <[EMAIL PROTECTED]>
Subject: Re: malicious person -- now what ?????
}Date: Sat, 13 Mar 1999 14:35:18 -0800
}From: "Gerald E. Boyd" <[EMAIL PROTECTED]>
}
}
}I don't think it was done on purpose as the person posting the message
}appears to be the moderator and approved the posting. They might have
}missed it.
}
}I myself got one of these attachments to a posting for approval to this
}list. However, I deleted it before approving as I didn't think you
}would all be to happy with me if I let that virus slip through (:>)
}
Any time that you get one of these, you should E-mail back the source,
telling them that they appear to be infected by the happy99 internet
worm, and referring them to the site that shows how to remove it.
>From my understanding, it only sends itself once to each address,
however I do not know how it keeps track, and I do not do W9x, so...
--
| [EMAIL PROTECTED] Jerel.
---
------------------------------
Date: Mon, 15 Mar 1999 21:59:46 PST
From: "Jerel D. Arbaugh" <[EMAIL PROTECTED]>
Subject: Re: How to decode
}Date: Sun, 14 Mar 1999 20:27:06 +0500
}From: Aziz Sabirov <[EMAIL PROTECTED]>
}
}Hello accmailers,
}
}I received binary file in 12 parts from FTP server. When I sent a
request
}to this server to get this file I put a command UUENCODE.
}
}I've got UU-DECODE 5.24 FOR PC. by Richard Marks.
}Help lines for this program say that there should be BEGIN END words
}in uuencoded files but I didnt find them. All parts were sent to me
}as plain text messages not attachments and beginnings look like this:
}
}The following line should contain ASCII characters 0x20-0x5F:
} !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_
}
The begin line should be at this point IN THE FIRST PART ONLY.
}M@MC!6/#Q!U5I7M%[3=@#A-Z%.]+/YY5'LM]`JTZ2Z602N*+?/I[Q20?FFG&2*
}M"CH_D71NZ^U>"S"UF]XPB-Q<YQ,9I[:L)N*VRKBG56DV:S:5+L$K?CIPPR+V*
}
The end should be at the end OF THE LAST PART ONLY.
}Could somebody provide me with a procedure to decode this program?
}
}Thanks in advance
}Aziz.
}
If you put them together in one file, then make sure that all parts are
in the correct order. I do not know that decoder, but some will not sort
parts, while others must be told to sort parts.
--
| [EMAIL PROTECTED] Jerel.
---
------------------------------
Date: Mon, 15 Mar 1999 21:41:59 PST
From: "Jerel D. Arbaugh" <[EMAIL PROTECTED]>
Subject: Re: what�s is the better format : UUE or Mime Base64
}Date: Sat, 13 Mar 1999 16:13:59 -0400
}From: chiriko <[EMAIL PROTECTED]>
}
}Hi accmailers .
}Sometimes I use any of the www4mail servers . This kind of servers have
}the property of retrieving binary , text and html files . The server
}converts any file larger than 300k into a Mime Base 64 atachment . But
}the user can get any web document uuencoded with the command XUUENCODE
}. As far as I know any uuencoded file is 33% larger the original . I
}suppose that any Mime Base 64 file is larger than the source , but how
}large is it really ? The answer to this question would let me decide
}which format is more efficient and , therefore , more economic in terms
}of memory size . If any could give a clue about this question ( a url
}could be useful too ) I would appreciate it .
}
}Thanks .
}
}------------------------------
It is mostly a trade off.
UUE: A one line header, + 2 or 3 characters per 45 bytes of original file
+ 4/3 of the original file + optional checksums.
MIME: Many line on header + 1 or 2 characters per 45 bytes of original
file + 4/3 of the original file. I do not think it has a checksum
option.
ZIP files have their own internal check sums, so that is a wash for them.
The one byte fewer per 60 encoded bytes in MIME vs the multi-line
headers in MIME. It's a trade off.
On the other hand, I have seen few decoders that do MIME multi-part as
well as the better UU decoders.
BTW: The general rule used is 35% larger for encoded files. The extra 1
2/3 % covers the other overhead.
--
| [EMAIL PROTECTED] Jerel.
---
------------------------------
Date: Tue, 16 Mar 1999 06:50:40 -0600
From: Lloyd Colston <[EMAIL PROTECTED]>
Subject: Re: Usenet Hosts
> Does anyone know of other hosts? Is there a list available somewhere?
>
> Many thanks for your help!
There is one list at http://www.route001.se/wolfeye/usenet/
>
Lloyd Colston Excellence is not an accident
Pryor, OK USA social worker, writer, editor
KC5FM Home page http://www.Lloyd.Colston.com/
Offering low cost communication WORLDWIDE
------------------------------
Date: Tue, 16 Mar 1999 09:00:54 +0100
From: Frank Pradel <[EMAIL PROTECTED]>
Subject: Who sent the "Happy99.exe"
Anyone who tries to spoil a good thing like this ACCMAIL list by sending viruses or
trojan horses like HAPPY99 has to be banned from
the list immediately!
If <[EMAIL PROTECTED]> did so, try to find its Postmaster and ask him to do something
against it.
Best regards
Frank Pradel
------------------------------
Date: Tue, 16 Mar 1999 10:57:35 +0000
From: Saeed Azizieh <[EMAIL PROTECTED]>
Subject: thank before leaving list
Hello
Today I am going to leave both lists, accmail and helpnet .
But before that I want to thank all of those people who replied Q's
of not just me but all members.
All of their advices were helpful and I learned many things.
I wish a long healthy (and wealthy!) life for all of them.
I wish to be a member again in infinite future time; in a better day.
Saeed
------------------------------
Date: Tue, 16 Mar 1999 10:45:22 PST
From: "Jerel D. Arbaugh" <[EMAIL PROTECTED]>
Subject: Re: ACCMAIL Digest Posting time
}Date: Tue, 16 Mar 1999 00:23:33 +0600
}From: K Sethu <[EMAIL PROTECTED]>
}Subject: ACCMAIL Digest Posting time (was : ACCMAIL Digest - 12 Mar 1999
to 13
} Mar 1999 (#1999-73))
}
}In ACCMAIL Digest #1999-74, a message posted by Avi Ben Zev was :
}
}>Date: Sat, 13 Mar 1999 19:14:23 +0200
17:14:23 GMT
}>From: Avi Ben Zev <[EMAIL PROTECTED]>
}>Subject: Re: ACCMAIL Digest - 12 Mar 1999 to 13 Mar 1999 (#1999-73)
}>MIME-Version: 1.0
}>Content-Type: text/plain; charset="us-ascii"
...
}>
}>>Gerry Boyd -- [EMAIL PROTECTED]
}>>Date: Sat, 13 Mar 1999 12:21:09 -0500
17:21:09 GMT
}>>From: Patricia <[EMAIL PROTECTED]>
}>>Subject: malicious person -- now what ?????
}>
}...SnipxSnip.....
}
...
}
}Is it so that the same day's digest gets posted to different groups of
}subscribers at different times, that I didn't know of ?
}
Some people are getting individual messages, that come out when the
posting is approved, not waiting for the digest. This is why you will
often find a message answered in the same digest.
}I did not get happy99.exe attachment with my #1999-73 digest. I also did
not
}find in my HD, the ska.exe and ska.dll files which are supposedly caused
by the
}happy99 virus as informed in the ACCMAIL Digest - 28 Feb 1999 to 1 Mar
1999
}(#1999-61) . Is it really true that this virus came out to all of us
with the
}#1999-73 digest?
}
}
}K. Sethu
}
See my other posts on this: I only saw a begin line for it, not the worm
itself, though that begin line likely truncated the digest for some
readers.
--
| [EMAIL PROTECTED] Jerel.
---
------------------------------
Date: Tue, 16 Mar 1999 10:25:53 PST
From: "Jerel D. Arbaugh" <[EMAIL PROTECTED]>
Subject: Re: Infested ACCMAIL Digest
}Date: Mon, 15 Mar 1999 08:45:18 -0000
}From: Gerald England <[EMAIL PROTECTED]>
}
}it would appear that the mail containing the happy99 virus
}which was sent to the list will now be in the archives.
}
This is getting strange: The only copy of happy99 that I have seen on
this list, was a begin line for the UU-encoded worm, with no body. Did I
miss a digest?
--
| [EMAIL PROTECTED] Jerel.
---
------------------------------
Date: Mon, 15 Mar 1999 21:50:03 PST
From: "Jerel D. Arbaugh" <[EMAIL PROTECTED]>
Subject: Re: Happy99
}Date: Sun, 14 Mar 1999 01:37:14 EST
}From: [EMAIL PROTECTED]
}
}Warning - the Accmail Listserver has just sent out the happy99.exe with
the
}latest digest - it must be infected itself - DO NOT TRY TO EXECUTE IT.
}
No, it only included the begin ### happy99.exe header, no file.
Also, I do not think AOL runs the listserv under WIN9x or NT. If they
use a UNIX box, then it is not vulnerable.
--
| [EMAIL PROTECTED] Jerel.
---
------------------------------
Date: Tue, 16 Mar 1999 20:15:07 +0500
From: Rajan <[EMAIL PROTECTED]>
Subject: Happy99.Exe - what to do about it
Hi!
I had been reading about the Happy99.Exe Worm and one came with ACCMAIL
Digest - 12 Mar 1999 to 13 Mar 1999 (#1999-73)!
Of course I never opened it - the Norton Anti-Virus (with Feb '99 virus
signatures up-date) detected it and I could delete it - NAV can't "repair"
it though.
I had posted something on Happy99.Exe on ACCMAIL and it was in the digest a
few days ago. For those interested in doing something about getting rid of
this go to:-
http://www.3inet.com/
They have a batch file called clean99.bat which is supposed to detect and
bust this worm. For those using Win 3.1/95/98/ -- the batch file is to be
run in DOS mode ie. boot in DOS mode and run it.
Hope the one on this list who has the Happy99.Exe worm runs this and gets
rid of it! (Remember, once it is in your PC you will not know that it keeps
sending copies of itself along with your email as an attachment). What
other damage it does I don't know.
Rajan
16-3-99
------------------------------
Date: Tue, 16 Mar 1999 16:46:54 +0300
From: "Dr. Abdul Azeem." <[EMAIL PROTECTED]>
Subject: Problem with decoding files.
Hi List,
I have downloaded a binary file from a HTTP server using the server
[EMAIL PROTECTED] It came in 5 zipped files, numbered as
ITSDiag_zip4.zip
ITSDiag_zip1.zip
ITSDiag_zip2.zip
ITSDiag_zip3.zip
ITSDiag_zip.zip.
The 5 parts all have the same name actually - "ITSDiag_zip.zip" but
they
are named 1, 2, 3 and 4 as they are put in the attachment directory. How do
I combine them ? Have these files been decoded and then split and zipped ?
Can someone throw some light on this problem ?
Thanks in advance,
Dr. A. Azeem.
------------------------------
Date: Mon, 15 Mar 1999 23:59:35 -0400
From: chiriko <[EMAIL PROTECTED]>
Subject: which usenet groups are moderated ?
Hy accMailers .
I guess which usenet gorups are moderated . Where can I find any
information regarding this matter ? If any can give me a clue I'm be
grateful .
Thanks .
------------------------------
Date: Tue, 16 Mar 1999 00:00:03 -0400
From: chiriko <[EMAIL PROTECTED]>
Subject: a forwarding e-mail wanted
Hy everybody .
As we know wireworm.com is not accepting more users . Does any know a
free-forwarding e-mail ? Any information regarding this matter will be
useful .
Thanks .
------------------------------
Date: Wed, 17 Mar 1999 02:11:41 +0600
From: [EMAIL PROTECTED]
Subject: Re: ACCMAIL Digest - 12 Mar 1999 to 13 Mar 1999 (#1999-73)
At 08:51 15-03-99 +0100, you wrote:
>>Date: Sun, 14 Mar 1999 12:24:57 -0800
>>From: "Gerald E. Boyd" <gboyd>
>>
>>At 07:14 PM 3/13/1999 +0200, Avi Ben Zev wrote the following:
>>
>>>You have also just sent to the ENTIRE list the happy99.exe virus.
>>>I checked and erased it just now.
>>
>>Gads, did I do this stupid moronic thing?
>
>No, Gerald, you didn't. There are just some dumb mail readers which take
>the line "begin 644 Happy99.exe" from the middle of an e-mail, disregard
>that no code at all is following, and pretend there were a program file.
>
How big is 'Happy99.exe'? I got it with my ACCMAIL posts - size 1kb.
Sen
------------------------------
Date: Tue, 16 Mar 1999 14:58:37 PST
From: Lucian Skyeclathde <[EMAIL PROTECTED]>
Subject: Re: which usenet groups are moderated ?
>From: chiriko <[EMAIL PROTECTED]>
>Date: Mon, 15 Mar 1999 23:59:35 -0400
>Approved-By: [EMAIL PROTECTED]
>Message-ID: <[EMAIL PROTECTED]>
>
.
>
>I guess which usenet gorups are moderated . Where can I find any
>information regarding this matter ?
>
>.
>
>
Dear Chiriko:
It is not at all difficult to obtain a large list of such moderated
newsgroups.
The Usenet server at MIT carries more than 10,000 newsgroups.
To obtain a list of which among them are moderated, send the following:
TO: [EMAIL PROTECTED]
SUBJECT: list .*moderated
BODY:
finger [EMAIL PROTECTED]
Best of luck with the moderated newsgroups.
Sincerely,
Lucian Skyeclathde
Get Your Private, Free Email at http://www.hotmail.com
------------------------------
Date: Tue, 16 Mar 1999 16:09:17 -0500
From: Jose LLufrio <[EMAIL PROTECTED]>
Subject: Happy '99 scare
Hello, everybody.=20
Please relax and examine things cooly before screaming "devil".
I missed the Happy '99 virus on the March 12 posting as did David Ames.
And I agree with Dietmar Schindler that it was just the line "begin 644 =
Happy99.exe" that caused many to think it was the virus program itself.
How many readers didn't notice that there was no code after that, and =
that it was not an attachment, which is the usual way for this =
"trojan-like" to propagate.
This seems to be like not mentioning the devil for fear it might appear.
Good luck to all, and keep cool.
Jose Llufrio
<[EMAIL PROTECTED]>
------------------------------
End of ACCMAIL Digest - 15 Mar 1999 to 16 Mar 1999 (#1999-76)
*************************************************************
