Return-Path: Received: (qmail 8312 invoked from network); 22 Mar 1999 20:21:15 -0000 Received: from magnus.plus.net.uk (HELO magnus.force9.net) (195.166.128.27) by medusa.plus.net.uk with SMTP; 22 Mar 1999 20:21:15 -0000 Received: (qmail 12258 invoked from network); 22 Mar 1999 20:24:08 -0000 Content-Type: text/plain; charset=iso-8859-1; format=flowed Content-Transfer-Encoding: 8bit Received: from post.thorcom.com (194.75.130.70) by magnus.plus.net.uk with SMTP; 22 Mar 1999 20:24:08 -0000 Received: from troy.blacksheep.org ([194.75.183.50] ident=root) by post.thorcom.com with esmtp (Exim 2.04 #3) id 10PBD8-0000v4-00; Mon, 22 Mar 1999 20:22:10 +0000 X-Priority: 3 X-MSMail-Priority: Normal Received: (from root@localhost) by troy.blacksheep.org (8.6.12/8.6.12) id UAA22061 for rsgb_lf_group-outgoing; Mon, 22 Mar 1999 20:17:35 GMT Received: from post.thorcom.com (root@post.unica.co.uk [194.75.183.70]) by troy.blacksheep.org (8.6.12/8.6.12) with ESMTP id TAA21849 for ; Mon, 22 Mar 1999 19:57:29 GMT Received: from post-20.mail.demon.net ([194.217.242.27]) by post.thorcom.com with esmtp (Exim 2.04 #3) id 10PAsG-00075q-00 for rsgb_lf_group@blacksheep.org; Mon, 22 Mar 1999 20:00:36 +0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Received: from [158.152.83.229] (helo=pagnell.demon.co.uk) by post-20.mail.demon.net with smtp (Exim 2.10 #2) id 10PAoZ-0003KQ-0K for rsgb_lf_group@blacksheep.org; Mon, 22 Mar 1999 19:56:48 +0000 Message-ID: Date: Mon, 22 Mar 1999 19:55:15 +0000 To: rsgb_lf_group@blacksheep.org From: "John W Gould" Subject: Re: LF: (no subject) In-reply-to: <199903221759.SAA24626@bluewin.ch> MIME-Version: 1.0 X-Mailer: Turnpike (32) Version 3.05 Sender: Precedence: bulk Reply-To: rsgb_lf_group@blacksheep.org In message <199903221759.SAA24626@bluewin.ch>, Baertschi writes > > a file Happy99.exe was included here > This message was sent to rsgb_lf_group, but strangely finished up in my normal mail account. I hope that it's not too late but this is the Happy99 Worm virus It modifies wsock32.dll to send itself as an attachment when a posting is made to USENET and othe Mail.... I am not sure, but it should be picked up on these "secondary" postings using a virus checker that operates all the time in the background. Grateful for any other information that members of the list may offer. -- John Gould, G3WKL G3WKL @GB7BEN.#43.GBR.EU g3wkl@pagnell.demon.co.uk