warning

BTW JRO...

Just used a wonderful newsreader known to many as "tin" which retrieved a
copy or rather two at least of you posting that virus file to this ng..

Unless of course you either allowed someone to use your mail program
without your knowledge or consent, or have a poor memory, I may just
consider sending a little note to *your* postmaster... and as for mine..
well I'll deal with it when the situation arrives... rest assured the
Pentagon prob. wouldn't care to much... If they had, I wouldn't be typing
this right now.

a simple apology may suffice, provided that nothing untoward happens to my
person.


"Garth"
http://www.student.comp.brad.ac.uk/~gward/
"If only everything in life was as reliable as God" 
 

'Garth' wrote:
> 
> BTW JRO...
> 
> Just used a wonderful newsreader known to many as "tin" which retrieved a
> copy or rather two at least of you posting that virus file to this ng..
> 
> Unless of course you either allowed someone to use your mail program
> without your knowledge or consent, or have a poor memory, I may just
> consider sending a little note to *your* postmaster... and as for mine..
> well I'll deal with it when the situation arrives... rest assured the
> Pentagon prob. wouldn't care to much... If they had, I wouldn't be typing
> this right now.
> 
> a simple apology may suffice, provided that nothing untoward happens to my
> person.
> 
> "Garth"
> http://www.student.comp.brad.ac.uk/~gward/
> "If only everything in life was as reliable as God"
> 
Garth,Do a altavista-USEnet search on happy99.exe and you will see
that the virus is posted to a lot of places...it modifies winsock.dll
(the gateway between client programs and the internet for windows
systems) to attach a uuencoded version of the "worm" to anyemail
or usenet post the infected user sends...It also seems to do some
tricks with the headers from what i have seen...I am not sure about
 that..but Johnny did not send them on purpose,He was a victim,and
because of circumestances,you look like the culprit that sent it to him.
As far as how you got involved i dont know,but If you read the warning
and the followup to it that was posted thismorning,you would see how
this "virus"/"worm" works and can cause a lot of confusion....Also just
to make thing more fucked up,Johnny had told me this morning that he saw
the posts that look like he sent the virus and he said that he had not 
sent the posts that are inquestion in the first place...Could you provide
headers for these posts?I would like  see them......and if it can be so
lets take this to email,instead of a.a-a....


    Be Cool,
      Krogg.


-- 


|"""""<`.THE PRINCE ,'>"""""""""""""""""""""""""""""""""""|
|      `.`/""""""\,','            my sig is too big,      |
|SEE HIS (  /   \ \' SEE HIS      but its really cool.    |
| FACE    \/<> <>\/   SMILE                               |
|         /   W   \          Visit my ascii art site:     |
|       ,'\_|||||_/`.  http://www.gtcom.net/~krogg/ascii/ |
|     ,','   |||   `.`.     kro...@gtcom.net    |
|____<,' TIME TO DIE `.>____Remove no.to.spam to reply____|

On Tue, 16 Feb 1999, Krogg wrote:
> 'Garth' wrote:
<snip>
> > a simple apology may suffice, provided that nothing untoward happens to my
> > person.
> > 
> > "Garth"
> > http://www.student.comp.brad.ac.uk/~gward/
> > "If only everything in life was as reliable as God"
> Garth,Do a altavista-USEnet search on happy99.exe and you will see
> that the virus is posted to a lot of places...it modifies winsock.dll
> (the gateway between client programs and the internet for windows
> systems) to attach a uuencoded version of the "worm" to anyemail
> or usenet post the infected user sends...

So it would seem we're both in the wrong, or not... my point was that I
hadn't posted the virus, and nor did I intend to... I admit fault in that
I thought JRO had posted the virus to the ng.  However I'm not happy that
JRO, at time of writing, has not apologies for assuming the same.  If JRO
had done as you suggest I do, then they would know that I can't, for
certain, have been the original sender..

> As far as how you got involved i dont know,but If you read the warning

I am a semi-lurker... I attempted to do an ascii as far back as
December... mainly 'cause I'm terrible at getting things from brain onto
screen :-(

<snip>
> sent the posts that are inquestion in the first place...Could you provide
> headers for these posts?I would like  see them......and if it can be so
> lets take this to email,instead of a.a-a....

I'm not sure... DejaNews is/wasn't able to show may indication of how to
do it... however, i've still got the messages that I managed to extract
from tin..

I'm posting this to the ng, mainly 'sos they know I apologised.

0
.\
 /_

kneeling in hope of forgiveness.

"Garth"
http://www.student.comp.brad.ac.uk/~gward/
"If only everything in life was as reliable as God" 
 

'Garth' wrote:
[snip]
> 
> I'm posting this to the ng, mainly 'sos they know I apologised.
> 
> 0
> .\
>  /_
> 
> kneeling in hope of forgiveness.
> 
> "Garth"
> http://www.student.comp.brad.ac.uk/~gward/
> "If only everything in life was as reliable as God"
> 

 Garth,
I think i know how it happend,but i need to know one more thing.Whats
 up with the redirect that you did...I dont understand what that is
or how it happend...How did you come to redirect JRO's post...?

Also,i cant find anyof JRO's posts in dejanews that had the attachment,
I think they arent keeping posts with the "X-Spanska: Yes" header in 
them...or someone has canceled them...At anyrate...Its not important.



I hope you and Johnny see the error...and move on...You 2 arent the only
people that have suffered....

And to anyone else....the trojan dont attach to the email or post you
send,it makes another post with the same headers...

This page has the best info i have seen so far.
http://www.datafellows.com/v-descs/ska.htm

Alt.ascii-art.....please forgive us for this thread...



-- 


|"""""<`.THE PRINCE ,'>"""""""""""""""""""""""""""""""""""|
|      `.`/""""""\,','            my sig is too big,      |
|SEE HIS (  /   \ \' SEE HIS      but its really cool.    |
| FACE    \/<> <>\/   SMILE                               |
|         /   W   \          Visit my ascii art site:     |
|       ,'\_|||||_/`.  http://www.gtcom.net/~krogg/ascii/ |
|     ,','   |||   `.`.     kro...@gtcom.net    |
|____<,' TIME TO DIE `.>____Remove no.to.spam to reply____|

On Wed, 17 Feb 1999, Krogg wrote:
<snip>
>  Garth,
> I think i know how it happend,but i need to know one more thing.Whats
>  up with the redirect that you did...I dont understand what that is
> or how it happend...How did you come to redirect JRO's post...?

my e-mail proggy (Pine) has a bounce command, all it does is sends the
message that was posted back to the sender... although it does require a
correct address.
 
> Also,i cant find anyof JRO's posts in dejanews that had the attachment,
> I think they arent keeping posts with the "X-Spanska: Yes" header in 
> them...or someone has canceled them...At anyrate...Its not important.

Neither did I... although a quick use of another mail program (tin)
managed to Identify the messages... and the threads invloved with them..

I'll send a copy of the mentioning files.

"Garth" - 'scuse the poor grammer, I'm half-awake.
http://www.student.comp.brad.ac.uk/~gward/
"If only everything in life was as reliable as God"