On Mon, 25 Jan 1999 19:31:06 +0100, "Rudy Velthuis" <rve### [at] gmxnet>
wrote:

>
>Marc Schimmler schrieb in Nachricht
><36AC83DB.C6D589EE@ica.uni-stuttgart.de>...
>>I mailed the newsadmin and asked him to remove the offending attachment!
>>
>>
>>Marc
>>--
>>Marc Schimmler
>
>(Now I hope I'm not sending multiples again)
>
>Dan Connely also did the same, so I suppose they're gone by now.
>
>For everyone (esp.Remco): scan for everything which looks like: liste.dat,
>ska.exe, ska.dll and happyXX.exe. The word "liste" makes me think this was a
>German program.

HM... It definitely appears to be doing _something_ : I also found a file
called c:\win98\system\liste.ska, which contains the 4 e-mail addresses
where I most recently send something to...

I better warn them!

And something else caught my eye: All of a sudden wsock32.dll has a
datestamp of today, and there also is a file called wsock32.ska
Which I find rather _suspocious_... And considering that it seems to be
able to intercept e-mail addresses in Eudora, it looks like this
SKA-thingey has taken over Winsock, the control center of your internet
access... That means that it could also be capable of e-mailing those
intercepted e-mail addresses to whoever it feels like without you knowing
about it, should the programmer wanted to do so... (And given the fact that
they are harvesting those e-mail addresses, that wouldn't surprise me in
the least!)

A re-install of Win98 didn't change anything for me...

Could anyone who's also running Win98 please give me the system dates and
filesize of their wsock32.dll?

The wsock32.ska file is different from the wsock32.dll file, even though
the filesize is identical... wsock32.ska has a more normal datestamp, so it
might be a backup copy of the original .dll...

Thanks in advance!
-- 
Marc van den Dikkenberg
--
The PowerBasic Archives -- http://www.xs4all.nl/~excel/pb.html
All Basic Code Archives -- http://come.to/abcpackets

Post a reply to this message