Marc van den Dikkenberg wrote:
> 
> On Mon, 25 Jan 1999 19:31:06 +0100, "Rudy Velthuis" <rve### [at] gmxnet>
> wrote:
> 
> >
> >Marc Schimmler schrieb in Nachricht
> ><36AC83DB.C6D589EE@ica.uni-stuttgart.de>...
> >>I mailed the newsadmin and asked him to remove the offending attachment!
> >>
> >>
> >>Marc
> >>--
> >>Marc Schimmler
> >
> >(Now I hope I'm not sending multiples again)
> >
> >Dan Connely also did the same, so I suppose they're gone by now.
> >
> >For everyone (esp.Remco): scan for everything which looks like: liste.dat,
> >ska.exe, ska.dll and happyXX.exe. The word "liste" makes me think this was a
> >German program.
> 
> HM... It definitely appears to be doing _something_ : I also found a file
> called c:\win98\system\liste.ska, which contains the 4 e-mail addresses
> where I most recently send something to...
> 
> I better warn them!
> 
> And something else caught my eye: All of a sudden wsock32.dll has a
> datestamp of today, and there also is a file called wsock32.ska
> Which I find rather _suspocious_... And considering that it seems to be
> able to intercept e-mail addresses in Eudora, it looks like this
> SKA-thingey has taken over Winsock, the control center of your internet
> access... That means that it could also be capable of e-mailing those
> intercepted e-mail addresses to whoever it feels like without you knowing
> about it, should the programmer wanted to do so... (And given the fact that
> they are harvesting those e-mail addresses, that wouldn't surprise me in
> the least!)
> 
> A re-install of Win98 didn't change anything for me...
> 
> Could anyone who's also running Win98 please give me the system dates and
> filesize of their wsock32.dll?
> 
> The wsock32.ska file is different from the wsock32.dll file, even though
> the filesize is identical... wsock32.ska has a more normal datestamp, so it
> might be a backup copy of the original .dll...
> 
> Thanks in advance!
> --
> Marc van den Dikkenberg
> --
> The PowerBasic Archives -- http://www.xs4all.nl/~excel/pb.html
> All Basic Code Archives -- http://come.to/abcpackets

If you read this message: I've deleted the wsock32.dll and replaced it with the
wsock32.ska file (renaming it of course). I hope this works.

Perhaps this explains why my post to a dutch newsgroup on the server of my ISP
was rejected. I believe it has some huge filters/firewalls, whatever...
Could it be it detected a corrupt WSOCK, or perhaps some sort of ID in the
message? I'll give it a try...

Anyways, I don't think it's fair to blame Rudy Velthuis and I hope this thing
can be over soon.

Regards,

Remco

Post a reply to this message