There are 20 messages totalling 1063 lines in this issue.
Topics of the day:
1. FTPMail, Agora, etc. statistics
2. Opening directories (2)
3. Help ! ( mailing dlists ). (2)
4. FWD: English Plus Newsletter
5. The W95.CIH.1075 virus (2)
6. what is DHCP server ? (3)
7. FreeNet Service
8. In search of information (2)
9. files safe & files dangerous (2)
10. message subjects
11. The W95.CIH.1075 virus (Part 2)
12. FTP Files By Gophermail
13. image downloading ...
~~~~~~~~~~~~~~~ ACCMAIL Info (automatically generated) ~~~~~~~~~~~~~~
To UNSUBscribe: Send UNSUBSCRIBE ACCMAIL to [EMAIL PROTECTED]
To get the ACCMAIL FAQ: Send e-mail to "[EMAIL PROTECTED]"
and enter only this line in the BODY of the note:
send usenet/news.answers/internet-services/access-via-email
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
----------------------------------------------------------------------
Date: Tue, 6 Apr 1999 06:01:27 +0100
From: [EMAIL PROTECTED]
Subject: FTPMail, Agora, etc. statistics
FTPMail, Agora, etc. statistics for Mon 5 Apr 1999, posted Tue 6 Apr, 06:00 GMT/BST
Less than 1 hour
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
1-4 hours
None
4-10 hours
[EMAIL PROTECTED]
[EMAIL PROTECTED]
More than 10 hours
None
Response within 4 hours in at least 5 out of 7 recent tests
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
This data is generated automatically around 0600 GMT/BST most
days. The performance reported is dependant on many factors and your
experience may vary. You can also access this list:
On the Web at http://www.netservs.com/mrcool/stats.htm
By FTP at ftp://ftp.cix.co.uk/pub/net-services/stats.txt
Mail to [EMAIL PROTECTED] and say
"get file stats.txt" (no quotes)
Want this list every day? Send mail to [EMAIL PROTECTED] and in the
body of your message put "join statistics" (no quotes)
No liability is accepted for inaccuracies. Mirroring, links to and
copying of this entire file (not extracts) is permitted until further
notice.
Slow downloads? Try Mr. Cool!
See http://www.netservs.com/mrcool/
Copyright Net Services 1999.
------------------------------
Date: Tue, 6 Apr 1999 11:26:48 +0800
From: "Richard Glenn R. Aceron" <[EMAIL PROTECTED]>
Subject: Opening directories
Crossposted to Accmail and Help-net
Hello,
I am using the princeton bitftp for this:
open ftp.discovery.com
cd DCOLpress
Then there are two directories in there, namely:
SiteGrabs and
Titanic98
Now the question is:
Can I open these two directories in just one e-mail message?
--
Richard Glenn R. Aceron
[EMAIL PROTECTED]
"'Tis better to be silent and be thought a fool, than to speak and remove
all doubt." - =|:-)=
------------------------------
Date: Tue, 6 Apr 1999 08:07:05 GMT
From: Adrian Moisei <[EMAIL PROTECTED]>
Subject: Help ! ( mailing dlists ).
Hello !
I desperately need to find some adresses of mailing lists from
my country.
Can someone help me ?
Thanks.
Adrian.
------------------------------
Date: Tue, 6 Apr 1999 13:19:00 +0200
From: Frits Westra <[EMAIL PROTECTED]>
Subject: FWD: English Plus Newsletter
<< From Newjour >>
English Plus Newsletter
http://englishplus.com/news/
English grammar, spelling, writing, and vocabulary. Emphasis on
communication problems and solutions. Occasionally includes entrance
exams like the SAT, ACT, and GRE. English Plus publishes software to
assist with English grammar, spelling, and entrance exams. Free.
Request monthly e-mailed issue from [EMAIL PROTECTED] Archived
issues at http://englishplus.com/news/.
Contact:
Editor, James Bair
Email: [EMAIL PROTECTED]
------------------------------
Date: Tue, 6 Apr 1999 18:17:32 +0500
From: Rajan <[EMAIL PROTECTED]>
Subject: The W95.CIH.1075 virus
Hi!
A friend of mine recently had a problem with his HD and so called in the
repair-crew. They say (after a lot of research) that his PC is infected
with the W95.CIH.1075 virus which has zapped his BIOS. I'd read in this
Digest sometime back about the CIH virus but have lost the reference. Does
anyone know what the W95.CIH.1075 virus is? Can a virus destroy the BIOS?
How does one prevent an infection (I have Norton Anti-Virus with latest
virus signatures - am I safe?) and how does one get rid of it and repair
the BIOS?
Any help would be appreciated.
Thanks in advance.
Rajan
6-4-99
------------------------------
Date: Tue, 6 Apr 1999 12:48:33 +0800
From: SSI Cheng Ning <[EMAIL PROTECTED]>
Subject: what is DHCP server ?
hi,guys
now I have a question , I don't know whether it is an correct station for
post it .
Some one tell me they setup LAN by DHCP mode, I don't meaning of DHCP ?
Would someone explain to me or send describe to me .
thanks .
ncheng
------------------------------
Date: Tue, 6 Apr 1999 02:53:48 -0400
From: Tech <[EMAIL PROTECTED]>
Subject: FreeNet Service
Hey for anyone interested..
Download NetZero's software from www.netzero.com
they are a freenet service to get connected you must
first download their software.. they make a business
the same way Juno does.
Also check out this cool bbs.. they offer you mostly
everything.. irc,telnet,ftp,email,mud,etc.. for free
you must be in the 516 area.. else long distance call
to connect and what not.. #465-7200 check it out today!
The system is called the Point Blank BBS..
If you are aslo interested in obtaining a free shell
account on a Unix system.. i think its a SunOS..
then telnet to:
cyberspace.org
set up a new account by login in as "help"
afterwards you create a new account... you get your
own web space, email, web accessibility, etc..
so your email address would be:
<newuser>@grex.cyberspace.org
they even have conferencing system.. pisco something..
check it out at your own risk!
good day!
p.s.
if anyone knows the new # for telenet dial-up look up.. please email me.
thanks a lot!
------------------------------
Date: Mon, 5 Apr 1999 18:20:05 +0000
From: "MSc. Ing. Felix Juan Dominguez (Dpto Quimica"
<[EMAIL PROTECTED]>
Subject: In search of information
Hi ALL,
They can tell me if they know places where to locate information has
more than enough chemical engineering that can descend using the Email
or list of discussion about this thematic.
Thank you in advance.
_________________________________________________________________
MSc. Felix Juan Dominguez Alonso
Colect. de Analisis de Proceso
Facultad de Ing. Quimica
Universidad de Matanzas
Autopista a Varadero Km 3
Matanzas CP
Cuba
Tel: (53)(52) 61432
Fax: (53)(52) 51301
E.mail [EMAIL PROTECTED]
_________________________________________________________________
------------------------------
Date: Tue, 6 Apr 1999 12:18:12 -0700
From: "Gerald E. Boyd" <[EMAIL PROTECTED]>
Subject: Re: Help ! ( mailing dlists ).
At 08:07 AM 4/6/1999 GMT, Adrian Moisei wrote the following:
> I desperately need to find some adresses of mailing lists from
>my country.
> Can someone help me ?
To: [EMAIL PROTECTED]
Subject: [leave blank]
Body of message
search Romania
This should return about 20 mailing lists about or located in Romania
I checked CataList, the official catalog of LISTSERV lists, by country
but found no Romanian lists.
--
Gerry Boyd -- [EMAIL PROTECTED]
------------------------------
Date: Wed, 6 Apr 1983 19:46:42 +0800
From: [EMAIL PROTECTED]
Subject: files safe & files dangerous
dear accmailers:
I've heard about the recent incident of Melissa virus. thank god, my
computer didn't contract it, 'cause I've always felt paranoid when
receiving *.exe, *.com, *.bat or *.doc files. if someone sent me an
email with a *.doc attachment, I would politely ask him to send me a
*.txt file instead, 'cause "I don't have ms-word on my computer". ;-)
somehow, I still wonder if the *.exe, *.com, *.bat and *.doc files are
all those we need to be careful about. is there any other kind of files
which are also potentially dangerous?
I believe a *.txt file is absolutely safe. are there any other kind of
files which belong to this category? what about *.hlp, *.jpg, *.htm...
files? are they also absolutely safe?
I know the reason why files like *.doc are potentially dangerous is
that they sometimes contain macros. is there a way to turn off the
macro function in ms-word so to make opening a *.doc file a safe thing
to do?
so, here are my three questions:
1) what are those potentially dangerous files?
2) what are those absolutely safe files?
3) is there a way to turn off macro functions (or other similar
functions) in our utility softwares like ms-word or excel?
thank you!
s. li
------------------------------
Date: Tue, 6 Apr 1999 12:45:35 -0700
From: "Gerald E. Boyd" <[EMAIL PROTECTED]>
Subject: Re: Opening directories
At 11:26 AM 4/6/1999 +0800, Richard Glenn R. Aceron wrote the following:
>Crossposted to Accmail and Help-net
>I am using the princeton bitftp for this:
>
> open ftp.discovery.com
> cd DCOLpress
>
>Then there are two directories in there, namely:
>
>SiteGrabs and
>Titanic98
>
>Now the question is:
>
>Can I open these two directories in just one e-mail message?
Yes, In fact you can open as many as you want up to 15,000 lines of
directory listings.
To: [EMAIL PROTECTED]
Subject: [leave blank]
Body of message:
open ftp.discovery.com
cd DCOLpress
dir
dir SiteGrabs
dir Titanic98
quit
You will recieve back a listing that looks (in part) like:
> open ftp.discovery.com
>> OPEN FTP.DISCOVERY.COM
<<< Connecting to FTP.DISCOVERY.COM 198.147.11.12, port 21
<<< 220-Serv-U FTP-Server v2.2 for WinSock ready...
<<< 220-Welcome To...
<<< 230 User ANONYMOUS logged in
[snip]
> cd DCOLpress
>> CD DCOLpress
>>> CWD DCOLpress
<<< 250 Directory changed to /dcolpress
> dir
>> dir ( DISK
>>> PORT 128,112,129,99,99,31
<<< 200 PORT Command OK
>>> LIST
<<< 150 Opening data connection
<<< 226 Transfer complete
total 6
-rwxr-xr-x 1 User Group 1677320 Mar 17 16:04 dcolhomeim.bmp
-rwxr-xr-x 1 User Group 1677320 Mar 17 16:06 forum.bmp
-rwxr-xr-x 1 User Group 1677320 Mar 17 16:06 forum2.bmp
-rwxr-xr-x 1 User Group 1677320 Mar 17 16:04 imhome.bmp
drwxr-xr-x 1 User Group 0 Aug 11 1998 SiteGrabs
drwxr-xr-x 1 User Group 0 Aug 21 1998 Titanic98
> dir SiteGrabs
>> dir SiteGrabs ( DISK
>>> PORT 128,112,129,99,99,35
<<< 200 PORT Command OK
>>> LIST SiteGrabs
<<< 150 Opening data connection
<<< 226 Transfer complete
total 20
-rwxr-xr-x 1 User Group 220110 Aug 11 1998 animals.jpg
-rwxr-xr-x 1 User Group 211518 Aug 11 1998 cybertalk.jpg
-rwxr-xr-x 1 User Group 309161 Aug 11 1998 discovery.jpg
-rwxr-xr-x 1 User Group 191794 Aug 11 1998 earth.jpg
-rwxr-xr-x 1 User Group 244047 Aug 11 1998 expeditions.jpg
-rwxr-xr-x 1 User Group 259271 Aug 11 1998 features.jpg
-rwxr-xr-x 1 User Group 346862 Aug 11 1998 homepage.jpg
-rwxr-xr-x 1 User Group 45240 Aug 11 1998 logoblk.gif
-rwxr-xr-x 1 User Group 7376 Aug 11 1998 logored.gif
-rwxr-xr-x 1 User Group 227722 Aug 11 1998 mindgames.jpg
-rwxr-xr-x 1 User Group 307310 Aug 11 1998 montserrat.jpg
-rwxr-xr-x 1 User Group 200706 Aug 11 1998 mydiscovery.jpg
-rwxr-xr-x 1 User Group 246853 Aug 11 1998 news.jpg
-rwxr-xr-x 1 User Group 177207 Aug 11 1998 picture.jpg
-rwxr-xr-x 1 User Group 226616 Aug 11 1998 poll1.jpg
-rwxr-xr-x 1 User Group 237034 Aug 11 1998 poll2.jpg
-rwxr-xr-x 1 User Group 226927 Aug 11 1998 poll3.jpg
-rwxr-xr-x 1 User Group 228305 Aug 11 1998 science.jpg
-rwxr-xr-x 1 User Group 215773 Aug 11 1998 search.jpg
-rwxr-xr-x 1 User Group 258606 Aug 11 1998 shopping.jpg
> dir Titanic98
>> dir Titanic98 ( DISK
>>> PORT 128,112,129,99,99,36
<<< 200 PORT Command OK
>>> LIST Titanic98
<<< 150 Opening data connection
<<< 226 Transfer complete
total 4
-rwxr-xr-x 1 User Group 488525 Aug 12 1998 bow.jpg
-rwxr-xr-x 1 User Group 8386041 Aug 12 1998 hull.jpg
-rwxr-xr-x 1 User Group 414022 Aug 11 1998 piece-a.jpg
-rwxr-xr-x 1 User Group 430516 Aug 11 1998 piece-b.jpg
> quit
>> CLOSE
>>> QUIT
<<< 221 Goodbye...
--
Gerry Boyd -- [EMAIL PROTECTED]
------------------------------
Date: Tue, 6 Apr 1999 00:32:54 +0300
From: Esmail <[EMAIL PROTECTED]>
Subject: message subjects
would accmailers please be more careful what they put in the subject field of the
emails they send, it would be easier to organize
and read when the mail arrives to all subscribers. put a brief description but for
gods sake dont put 'help me'. thanks >> keep up
the good work.
Zakir Esmail
Nairobi, Kenya
[EMAIL PROTECTED]
http://www.geocities.com/Colosseum/Court/9404/ >> My Site + Arsenal Desktop Theme!
http://www.carhirekenya.com >> Central Rent a Car - Kenya!
------------------------------
Date: Tue, 6 Apr 1999 15:08:06 -0700
From: "Gerald E. Boyd" <[EMAIL PROTECTED]>
Subject: Re: The W95.CIH.1075 virus
At 06:17 PM 4/6/1999 +0500, Rajan wrote the following:
>A friend of mine recently had a problem with his HD and so called in the
>repair-crew. They say (after a lot of research) that his PC is infected
>with the W95.CIH.1075 virus which has zapped his BIOS. I'd read in this
>Digest sometime back about the CIH virus but have lost the reference.
Does
>anyone know what the W95.CIH.1075 virus is? Can a virus destroy the BIOS?
>How does one prevent an infection (I have Norton Anti-Virus with latest
>virus signatures - am I safe?) and how does one get rid of it and repair
>the BIOS?
First off, latest information from Symantec
Norton AntiVirus Special SupportNow! Bulletin
July 24, 1998
In this new issue: Last modified Mar-19-99 13:25
1.0 W95.CIH.1075 Alert
1.1 How to protect your system
2.0 UNSUBSCRIBING
3.0 IF YOU ENCOUNTER AN INTERNET ERROR WITH YOUR BROWSER...
This is a special Symantec SupportNow! Bulletin that provides the
latest information about the W95.CIH.1075 virus, and what you can do
to wipe it off of your system.
1.0 W95.CIH.1075 Alert
W95.CIH
VirusName: W95.CIH
Aliases: PE_CIH
Infection Length: ~1K
Area of Infection: Windows 95 Portable Executable (PE) files
Likelihood: Rare
Region Reported: ?
Characteristics: EXE, Windows, Memory Resident
Target Platform: Windows 95
Target Date: 26th of the month
Description:
W95.CIH is a virus that infects Windows 95 executables (files with .EXE
extension). When an infected program is run, the virus goes memory
resident. W95.CIH then infects new files when they are opened (e.g. when
they are run or copied). This means that an infected system must be
rebooted from a clean system disk before scanning with NAV, or any
anti-virus product -- if this is not done, the virus will infect every
file that the anti-virus product scans.
Infected files are the same size as the original files, due to W95.CIH's
unique mode of infection: First, it looks for empty, unused spaces in
the file; then, it breaks itself up into smaller pieces, and hides in
these unused spaces. NAV is able to repair an infected file by looking
for these viral pieces and removing them from the file.
W95.CIH has a destructive payload that is triggered on the 26th of the
month; this payload may cause the entire contents of the system's hard
drive to be lost.
For information on other viruses, please visit our Virus Encyclopedia
at: http://www.symantec.com/avcenter/vinfodb.html
1.1 How to protect your system
Use LiveUpdate or download the latest definitions from:
ftp://ftp.symantec.com/public/english_us_canada/antivirus_definitions/
norton_antivirus/
and update your Norton AntiVirus virus definitions to include detection
of W95.CIH.1075.
You may encounter a situation after installing Norton AntiVirus where
you reboot and receive the error, "The file NAVW32.EXE has been
altered." You can not start Norton AntiVirus. Uninstalling and removing
all traces of Norton AntiVirus does not solve the problem; the same
error occurs each time you install.
A virus developed specifically for Windows 98 called W95.CIH.1075 is
known to affect the Norton AntiVirus scanner immediately after
installation. Download the rebuilt NAVC10.EXE that contains W95.CIH.1075
detection and repair from:
ftp://ftp.symantec.com/public/english_us_canada/products/norton_antivi
rus/ver3_win3x/scanner/navc10.exe
Instructions
1.ABSOLUTELY DO NOT scan an infected system from a DOS window. W95.CIH
goes memory resident and infects upon opening files, for example, when
copying or reading. This means that you cannot scan with NAVC in the
login script or NAVC will spread the virus to all W32 files on
infected systems. Use of NAVC requires a clean boot as specified in
this document.
2.Make a folder (directory) called C:\NAVC. At a command prompt type:
MD C:\NAVC [Enter]
3.Download the file NAVCNEW.EXE into the new folder C:\NAVC.
4.Power down, and then boot to a command line from a known clean boot
disk.
5.Change to the C:\NAVC directory by typing:
C: [Enter]
CD C:\NAVC [Enter]
6.At the C:\NAVC> prompt, type:
NAVCNEW [Enter]
This will extract the necessary files to that directory.
7.At the same C:\NAVC> prompt, type:
NAVC /doallfiles /repair [Enter]
This scans the entire system. Any occurrences that are not repaired by
NAVC should be sent in as a sample to SARC at:
http://www.sarc.com/
NOTE: The scan may take a while.
[snip]
The original CIH answer that I posted 28Aug98
==============
W95.CIH is a virus that infects 32-bit Windows 95/NT executables (files
with an .EXE extension), however it will only run on Windows 95. When
an infected program is run, the virus goes memory resident. W95.CIH
then infects new files when they are opened (e.g. when they are run or
copied). This means that an infected system must be rebooted from a
clean system disk before scanning with NAV, or any anti-virus product --
if this is not done, the virus will infect every file that the
anti-virus product scans.
W95.CIH does not infect Windows 3.x executable files.
W95.CIH has a destructive payload. Some variants of the virus activate
on April 26th or June 26th, while other variants will activate on the
26th of every month. This virus will attempt to modify or corrupt
certain types of Flash BIOS. We believe that the likelihood is that
most computers will not be susceptible to this attack. This information
has been corroborated by researchers from the IBM Watson Research
Center.
===========
Another note from Symantec:
Introduction
The KILL_CIH tool is designed to safely detect and remove all known
strains of the W95.CIH virus (known strains as of August 3rd, 1998) from
memory under Windows 95 and Windows 98 (the W95.CIH virus cannot infect
Windows NT systems). If the tool is run before the virus has infected
the system, it will also "inoculate" the computer's memory to prevent
the W95.CIH virus from infecting the system until the next system
reboot.
*NOTE* If you are already infected with the W95.CIH virus, run the
KILL_CIH tool first before attempting to update your anti-virus
definitions or scan your system. If you attempt to scan with an
anti-virus product without first running this tool, you run the risk of
causing your infection to spread. Once you have used this tool, you can
safely update your Norton AntiVirus definitions and scan your machine.
The KILL_CIH tool will not detect or remove the W95.CIH virus from
files; it will only disable the virus in memory so that an anti-virus
program can remove the infection without inadvertently spreading the
virus. You can obtain a freeware version of Norton AntiVirus to detect
and remove the virus from files on the Symantec web site at:
http://www.symantec.com/nav/navc.html
This CIH removal tool can be run from either the DOS command line or
from a login script, allowing an administrator to automate the
disinfection process. This means that an administrator does not have to
go to each workstation on their network and reboot from a clean floppy
in order to clean the computer. After using this tool, you should update
your virus definitions and then start a complete scan of the computer
with an anti-virus program such as Norton AntiVirus. This will eliminate
the virus and repair any damaged files. The tool itself is designed to
avoid infection by the virus and can safely be run without becoming
infected if the virus is already resident on a computer.
Download
KILL_CIH.EXE
File name: KILL_CIH.EXE
File size: 24K
KILL_CIH.TXT
File name: KILL_CIH.TXT
File size: 5K
W95.CIH Background
CIH is a virus that infects 32-bit Windows 95/98/NT executable files.
When an infected program is run, the virus will infect the computer's
memory. CIH then infects new files when they are opened. Some variants
of the virus activate on April 26th or June 26th, while other variants
will activate on the 26th of every month. This virus will attempt to
modify or corrupt certain types of Flash BIOS, software that initializes
and manages the relationships and data flow between the system devices,
including the hard drive, serial and parallel ports and the keyboard. By
overwriting part of the BIOS program, the virus can keep a computer from
starting up when the power is turned on.
The virus infects by first looking for empty, unused spaces in the file;
then, it breaks itself up into smaller pieces, and hides in these unused
spaces. Norton AntiVirus is able to repair an infected file by looking
for these viral pieces and removing them.
Usage
To use the KILL_CIH tool, use any *one* of the following methods:
1.Double click on the file from your desktop or Explorer.
2.Run KILL_CIH.EXE from a DOS box.
3.Use the "Run" command from the Windows Start menu.
4.Place the KILL_CIH.EXE in a standard login script.
After running this tool, update your virus
definitions and initiate a scan with Norton
AntiVirus or another anti-virus product that is
capable of removing the W95.CIH virus from files.
The KILL_CIH.EXE program requires no command line arguments. It will
display one of several different messages upon completion:
"The W95.CIH virus was found in memory. The
W95.CIH virus has been successfully disabled.
You can now run the Norton AntiVirus to remove
any infections from files."
This message is displayed if any
strain of the W95.CIH virus is found in
the computer's memory. The tool has
disabled the virus in memory and will
prevent it from causing damage to the
system or infecting any additional
files. At this point, it is safe to run
Norton AntiVirus or another anti-virus
program to remove the virus from the
system.
"The W95.CIH virus was not found in memory."
This message is displayed if no
known strains of the W95.CIH virus
are found in memory. The tool has
inoculated the computer and will
prevent the virus from infecting system
memory if an infected file is run during
the remainder of the computer
session (until reboot). At this point, it
is safe to run Norton AntiVirus or
another anti-virus program to remove
the virus from the system.
"Warning: This Windows NT system cannot be
infected by the W95.CIH virus."
This message will be displayed if the
tool is used under Windows NT. There
is no harm in doing this and the
program will exit normally after
displaying this message.
Troubleshooting
If you have any problems with this tool, please contact Symantec
technical support for more details.
--
Gerry Boyd -- [EMAIL PROTECTED]
------------------------------
Date: Tue, 6 Apr 1999 15:28:31 -0700
From: "Gerald E. Boyd" <[EMAIL PROTECTED]>
Subject: Re: The W95.CIH.1075 virus (Part 2)
At 06:17 PM 4/6/1999 +0500, Rajan wrote the following:
>A friend of mine recently had a problem with his HD and so called in the
>repair-crew. They say (after a lot of research) that his PC is infected
>with the W95.CIH.1075 virus which has zapped his BIOS. I'd read in this
>Digest sometime back about the CIH virus but have lost the reference.
Does
>anyone know what the W95.CIH.1075 virus is? Can a virus destroy the BIOS?
>How does one prevent an infection (I have Norton Anti-Virus with latest
>virus signatures - am I safe?) and how does one get rid of it and repair
>the BIOS?
This answer discusses what I have found out concerning Flash BIOS
destruction by WIN.CIH virus:
Some machines have hardware write protection for the BIOS (via a jumper
on the motherboard) but most don't, and although there are software
calls to write protect the BIOS, these are easily circumvented. Again
depending on the BIOS author and the computer or motherboard
manufacturer (refer to the documentation) it may be possible to backup
the BIOS, and if you know what you're doing you may be able to recover
from this situation, but in most instances erasure of the BIOS is likely
to be catastrophic and require the machine or motherboard being returned
to the manufacturer or replaced.
What is a Flashable BIOS?
All PCs contain a chip called a BIOS chip. This is a ROM (Read Only
Memory) or a PROM (Programmable Read Only Memory) chip containing
software that is essential to boot your PC. The BIOS software contained
on this chip is the software that is immediately executed when you turn
on your PC and provides the low-level access to your disk, video, and
keyboard. It reads your configuration from the CMOS configuration memory
and then loads the boot programs from your hard disk (or floppy). If
this BIOS software is damaged, there's a good chance that your PC will
be unable to boot (even from floppy) or recognize the hardware attached
to it. On older PCs (pre-Pentium) the BIOS is almost always a ROM (Read
Only Memory) chip and can not be reprogrammed. On newer PCs, this chip
is usually a PROM (Programmable Read Only Memory). This type of chip can
be rewritten. Sometimes the chip can be rewritten by software running on
the PC itself. Such chips are usually referred to as "flashable" BIOS
chips. The chip can be "flashed" or rewritten by special software
running on the PC.
There is no single standard way to write to a flashable BIOS chip.
Different commands must be used for different types of these chips. The
CIH virus knows how to overwrite the contents the 430TX compatible
chips. If this happens, the PC will be unbootable, until the chip is
reprogrammed or replaced.
I also found this:
For the Award Modular BIOS, I have written a program to restore your
control over the BIOS
Virus Protection. You can download it here; it is called VIRWARN (5.4
KB ZIPfile).
The program is now at version 1.2 (10/10/97) and comes with a text-file
with more information.
URL for file: http://web.inter.nl.net/hcc/J.Steunebrink/virwrn12.zip
VIRWARN is unable to control the Virus Warning feature on non-Award
BIOSs, but it will allow you to test for an active Virus Warning on all
BIOS brands.
Note that with Windows 95/98 running the BIOS Virus Warning does not
work because this OS uses its own protected mode diskdriver and the
BIOS harddisk interface is not used anymore (except in safe or
compatibility mode).
On the issue of Boot Sector Virus protection in Windows 95 you may like
to read the Microsoft Knowledge Base article: Q143281.
URL of Knowledge Base article:
http://support.microsoft.com/support/kb/articles/Q143/2/81.asp
--
Gerry Boyd -- [EMAIL PROTECTED]
------------------------------
Date: Tue, 6 Apr 1999 15:37:57 -0700
From: "Gerald E. Boyd" <[EMAIL PROTECTED]>
Subject: Re: FTP Files By Gophermail
At 12:09 PM 4/6/1999 +1100, Artem A. Vasiliev wrote the following:
>is it possible to get files by gophermail from FTP server that _requires
>password_?
Not that I know of. Or maybe I should say, I don't know how to do it if
is at all possible...
--
Gerry Boyd -- [EMAIL PROTECTED]
------------------------------
Date: Tue, 6 Apr 1999 15:50:40 -0700
From: "Gerald E. Boyd" <[EMAIL PROTECTED]>
Subject: Re: files safe & files dangerous
At 07:46 PM 4/6/1983 +0800, [EMAIL PROTECTED] wrote the following:
>so, here are my three questions:
>1) what are those potentially dangerous files?
EXE and COM and MS-Word DOC files (Not other word-processing DOC files).
Also Excel spreadsheets (XLS).
>2) what are those absolutely safe files?
Any image file (JPG, GIF, etc), movie files (MOV, etc), video files,
sound files, Postscript Printer (PS) files, Adobe Acrobat (PDF) files,
animation files (ANI, ANN, ANS, etc), font files, etc. Just about
everything except COM, EXE, DOC and ZIP infected. BAT files are easily
enough checked if you know DOS command so I never worry about these.
>3) is there a way to turn off macro functions (or other similar
>functions) in our utility softwares like ms-word or excel?
What you really want to do is disable the autolaunch facility in your
browser.
The autolaunch facility has various names but is the facility that
allows you to click on a link and open (launch) a program associated
with that file type. For example, clicking on a link containing a PDF
file type automatically launches Adobe Acrobat Reader (which happens to
be a safe activity -- no viruses in PDF files).
--
Gerry Boyd -- [EMAIL PROTECTED]
------------------------------
Date: Tue, 6 Apr 1999 16:02:34 -0700
From: "Gerald E. Boyd" <[EMAIL PROTECTED]>
Subject: Re: what is DHCP server ?
At 12:48 PM 4/6/1999 +0800, SSI Cheng Ning wrote the following:
>now I have a question , I don't know whether it is an correct station for
>post it .
>Some one tell me they setup LAN by DHCP mode, I don't meaning of DHCP ?
>Would someone explain to me or send describe to me .
Actually the question is inappropriate as written. If you had asked
where you could get the information by E-mail then it would be
appropriate.
However, I forgive you as I understand what you want (:>)
DHCP FAQ
This FAQ contains answers to many general questions about DHCP, as well as
specific implementation information
http://web.syr.edu/~jmwobus/comfaqs/dhcp.faq.html
Windows NT Server: Dynamic Host Configuration Protocol and Windows
Internet Naming Service
http://www.microsoft.com/win32dev/netwrk/dhcpwins.htm
dhcp.org - Resources for DHCP
http://www.eg.bucknell.edu/~droms/dhcp/
--
Gerry Boyd -- [EMAIL PROTECTED]
------------------------------
Date: Tue, 6 Apr 1999 16:21:20 -0700
From: "Gerald E. Boyd" <[EMAIL PROTECTED]>
Subject: Re: In search of information
At 06:20 PM 4/5/1999 +0000, MSc. Ing. Felix Juan Dominguez (Dpto
Quimica wrote the following:
>They can tell me if they know places where to locate information has
>more than enough chemical engineering that can descend using the Email
>or list of discussion about this thematic.
American Chemical Society home page
http://www.acs.org/
Visit our one-stop website for chemical professionals in industry,
academe, and
government worldwide. You'll also find resources for educators,
students, and
individuals who want reliable, accurate information about the
chemistry-related
sciences and ACS.
The producer of the world's largest and most comprehensive databases of
chemical information invites you to visit. The CAS databases, CHEMICAL
ABSTRACTS (CA) and REGISTRY, now include about 14 million abstracts of
chemistry-related and patent literature and nearly 18 million substances.
You might want to retrieve the main web page using an Agora and the
"deep" command because this site has plenty of pages.
To get a list of mailing lists realted to Chemical Engineering,
To: [EMAIL PROTECTED]
Subject: [leave blank]
Body of the message:
search chemical engineering
You should receive about 7 related mailing lists.
The following Usenet Newsgroup...
sci.engr.chem -- all aspects of chemical engineering.
The FAQ is located at:
http://www.cis.ohio-state.edu/hypertext/faq/usenet/engineering/cheme-faq
/faq.html
--
Gerry Boyd -- [EMAIL PROTECTED]
------------------------------
Date: Tue, 6 Apr 1999 16:23:31 -0700
From: "Gerald E. Boyd" <[EMAIL PROTECTED]>
Subject: Re: image downloading ...
At 03:49 PM 4/5/1999 -0400, Pedro J. Mendoza wrote the following:
>is there any service that allows to download a web page including images
>and others mm files ... ?
www4mail servers... Get all the help files and servers listing:
http://www.geocities.com/CapitolHill/1236/www4help.html
http://www.geocities.com/CapitolHill/1236/servers.html
--
Gerry Boyd -- [EMAIL PROTECTED]
------------------------------
Date: Wed, 7 Apr 1999 01:16:38 +0200
From: Uzi Paz <[EMAIL PROTECTED]>
Subject: Re: what is DHCP server ?
> Date: Tue, 6 Apr 1999 12:48:33 +0800
> From: SSI Cheng Ning <[EMAIL PROTECTED]>
> To: [EMAIL PROTECTED]
> Subject: [ACCMAIL] what is DHCP server ?
>
> hi,guys
> now I have a question , I don't know whether it is an correct station for
> post it .
Well, it is not accessing the Internet via e-mail, but since the moderator
of Accmail approved it, I guess that it is within the limits of the
broader scope for Accmail.
(BTW, a mailing list which is definitly appropriate for such questions is
Help-Net).
> Some one tell me they setup LAN by DHCP mode, I don't meaning of DHCP ?
> Would someone explain to me or send describe to me .
I guess that he meant that the LAN (Local Area Network) uses DHCP
(Dynamic Host Configuration Protocol) with a share network resources;
mainly dynamical IP-addresses , that are dynamically allocated to the
hosts inside the LAN (generally, inside a subnet).
Basically RFC1531 defines DHCP, but there were many extensions to it, and
I do not really know their details.
Uzi
------------------------------
End of ACCMAIL Digest - 5 Apr 1999 to 6 Apr 1999 (#1999-97)
***********************************************************
