MERCEDES-LACKEY Digest 2284 Topics covered in this issue include: 1) Three puppies!!!!!(lab)4/29/00 by Syara3-+AT+-aol.com 2) Re: Happy99.EXE and Artisans by Brooke Alexander 3) Happy99.EXE by "MJade" 4) Re: Baron Valdemar by TrinityWch-+AT+-aol.com 5) Re: Happy99.EXE and Artisans by "Robert Martin" 6) RE: Happy99.EXE and Artisans by Lyn Belzer 7) Re: By the Sword by Malkav18-+AT+-aol.com 8) kero/fluff/etc by Sarah 9) Re: sending stuff - virus warning by winged_wolf-+AT+-juno.com 10) Re: Return of Vanyel by winged_wolf-+AT+-juno.com 11) Re: Baron Valdemar & "Happy99.exe" by winged_wolf-+AT+-juno.com ---------------------------------------------------------------------- Date: Mon, 1 May 2000 20:11:00 EDT From: Syara3-+AT+-aol.com To: mercedes-lackey-+AT+-herald.co.uk Subject: Three puppies!!!!!(lab)4/29/00 Message-ID: <34.4964013.263f7714-+AT+-aol.com> Kero probably took classes on Valdemaran history. I think she may have taken a comprehensive test. She probably got more refined instruction on her Gifts and the Truth Spell. Syara ------------------------------ Date: Mon, 01 May 2000 20:11:00 -0700 From: Brooke Alexander To: mercedes-lackey-+AT+-herald.co.uk Subject: Re: Happy99.EXE and Artisans Message-ID: <390E4744.4FC7CD20-+AT+-telerama.com> Hi Amber! Oddly enough my sister's name is Amber as well, weird! But yes, i have that CD and I think it's fantastic!!! I also bought the CD with Kerowyn's tale on it and thought it was great as well. Great songs and the singer is fantastic, I think her name was Meg Davis? I haven't listened to it for a while but it's really really good also. I love the 2nd song on HHH(Heralds, Harpers, Havoc) though. That's my fave. Thanks, Brooke TantrisandRolan-+AT+-aol.com wrote: > Thank you so much....that will help a ton! > > Does anyone have the CD called Heralds, Harpers and Havoc? > It's the cd for all the songs in the back of Arrow's Fall, it just got here > today and I think it's an awesome cd! > > Amber ------------------------------ Date: Mon, 1 May 2000 21:52:09 -0700 From: "MJade" To: Subject: Happy99.EXE Message-ID: <001301bfb3f2$2e1be1e0$1a564ed8-+AT+-flynndj> Hi hi :) Happy99 is an email attachment file that basically only affects your mail program. It then attaches itself to a blank message and sends itself in addition to messages you send to other people. So really the person who has it doesn't even know they have it unless someone tells them. It just proliferates (is that the right word) by riding on email to other's computers. It doesn't do anything else, and it's relatively easy to fix, there are some sites on the net that can help. Here is a following excerpt, but remember, if you just deleted and didn't run the file, you should be fine... but here are instructions in case you did : HAPPY99.EXE is a newly discovered internet worm known as W32/Ska. Detection is available using the latest .DATs for VirusScan V4 Updates and HRLYDATS for VirusScan 3 HAPPY99 travels on its on course and does not propogate as a virus on the host machine, other than to send itself to others. The original file HAPPY99.EXE was coded by a virus author known as "Spanska", known for a number of viruses that infect PE type files. HAPPY99.EXE was distributed onto newsgroup servers and other places. Users would run the file and unknown to them, it would send out copies of the worm to anyone they sent email to. It only works if the user is using an SMTP agent with their email. When you run HAPPY99.EXE, it displays fireworks - a distraction - as it drops SKA.EXE and SKA.DLL onto the hard drive. It then makes a backup copy of the WSOCK32.DLL as WSOCK32.SKA. SKA.EXE hooks calls to SMTP mail and also newsgroup posting by NNTP protocol. By hooking these calls, SKA.EXE can send itself again as HAPPY99.EXE as an attachment to emails and posting to newsgroups. Also HAPPY99 (W32/Ska) keeps a log of emails sent to users in a file called "liste.ska". Removal is more or less a manual process: Boot to MS-DOS (WSOCK32.DLL cannot be changed under Windows) REName WSOCK32.DLL to WSOCK32.BAD (or delete it) REName WSOCK32.SKA to WSOCK32.DLL DELete SKA.EXE, SKA.DLL, LISTE.SKA The above is sufficient to stop the worm from working. Restart Windows The worm also creates the registry entry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ska.exe ="Ska.exe Using REGEDIT, you can delete this entry. If you don't, Windows will ignore it. I hope this helps, I got it from http://www.togethersweb.com/virusinfo.html eRin (list newbie) mjade-+AT+-mjade.com ----- Original Message ----- From: "Nicole" To: Sent: Monday, May 01, 2000 4:03 PM Subject: Re: Happy99.EXE and Artisans > "Heyla Listsibs!" > "HEEEEELP MEEEEE!" > "Sheka, I down-loaded it, saved it and opened it, what can I tell you? I'm stupid! > Anyway, I deleted it right after opening it and nothings gone wrong on Windows 95 > my Norton Anti-Virus didn't do anything either! So, what does the virus do if it > does get into your system? (So I can check manually to see if something's wrong!)" > > "Sooo, what are we going to do about this little problem and the person who sent > it? (dalley-+AT+-gateway.net)" > > ~Nicole (Mage of Creation/Storm-Rider) Chosen of Companion D'faindes > > ------------------------------ Date: Mon, 1 May 2000 22:24:13 EDT From: TrinityWch-+AT+-aol.com To: mercedes-lackey-+AT+-herald.co.uk Subject: Re: Baron Valdemar Message-ID: <44.33af1ee.263f964d-+AT+-aol.com> In a message dated 5/1/00 9:59:58 AM Eastern Daylight Time, jkazos-+AT+-vt.edu writes: << I don't think there's any plans for one, though I think it would make an excellent addition (as a historical chronicle, or some such) to an Eastern Empire story in the future. >> Actually, I would love to see a trilogy on the eastern empire and Baron Valdemar's story would make a great story. Just imagine the political struggle he faces within the empire that leads him to make the decision to leave and the people that chose to follow him because of what a great man he was. Yet, I doubt he was perfect, might even have been very much a part of what the empire was all about. Unfortunately, I keep on picturing Baron Valdemar as being similar to Moses leading the hebrews out of Egypt. LOL. -- Trinity ------------------------------ Date: Mon, 1 May 2000 22:32:34 -0400 From: "Robert Martin" To: Subject: Re: Happy99.EXE and Artisans Message-ID: <001501bfb3de$ad82b800$1939bacc-+AT+-rmartin3.ptdprolog.net> Basically, as far as I know, it e-mails itself to everyone in your Micro$oft address book. Not really a file muncher or drive cruncher, but annoying all the same. http://www.macafee.com or www.nai.com both have in their list of viruses this particular one. It's also called Ska99 as well as Happy99. If Norton doesn't find it, you may need to update your virus list on Norton. Or, there are actually instructions on how to correct and clean the virus without the virus scan. Tristaan (posting from home so no neat sig this time) ***I'm out of my mind, but feel free to leave a message.*** -----Original Message----- From: Nicole To: rmartin3-+AT+-ptd.net Date: Monday, May 01, 2000 6:58 PM Subject: Re: Happy99.EXE and Artisans >"Heyla Listsibs!" >"HEEEEELP MEEEEE!" >"Sheka, I down-loaded it, saved it and opened it, what can I tell you? I'm stupid! >Anyway, I deleted it right after opening it and nothings gone wrong on Windows 95 >my Norton Anti-Virus didn't do anything either! So, what does the virus do if it >does get into your system? (So I can check manually to see if something's wrong!)" > >"Sooo, what are we going to do about this little problem and the person who sent >it? (dalley-+AT+-gateway.net)" > >~Nicole (Mage of Creation/Storm-Rider) Chosen of Companion D'faindes > > ------------------------------ Date: Tue, 2 May 2000 08:51:01 -0400 From: Lyn Belzer To: "'mercedes-lackey-+AT+-herald.co.uk'" Subject: RE: Happy99.EXE and Artisans Message-ID: Nicole wrote: >"Sooo, what are we going to do about this little problem and the person who sent >it? (dalley-+AT+-gateway.net)" Given the wonderfully informative post that eRin wrote on the virus (welcome aboard, by the way, eRin), nothing. Dalley was probably infected and didn't know it. Automatically attatching itself to list-bound email messages is the way the virus propigates itself, apparently. HOWEVER, Dalley, you HAVE been working on a way to rid yourself of it, RIGHT? <*low growl*> Zhai'helleva-- --Icewolf (who also enjoyed Disney's "The Happiest Millionaire") ------------------------------ Date: Tue, 2 May 2000 12:17:44 EDT From: Malkav18-+AT+-aol.com To: mercedes-lackey-+AT+-herald.co.uk Subject: Re: By the Sword Message-ID: <9a.43fbb2a.264059a8-+AT+-aol.com> of course she did !! and she was the on;y herald to actually like Albrich.... And she is too lifebonded, but she's too stubborn to ever admit it like Silverfox... ------------------------------ Date: Tue, 2 May 2000 13:25:19 -0700 (PDT) From: Sarah To: mercedes-lackey-+AT+-herald.co.uk Subject: kero/fluff/etc Message-ID: <5651315.957299119437.JavaMail.imail-+AT+-magic.excite.com> Heyla Listsibs Happy May!! Spring has sprung here in the good ole south of england and today I actually got my shorts out of the closet (ack no cupboard... argh) and after applying a duster managed to fit into them!!! yayay but that was only after a loooooooong day at school in a black school uniform wishing i was still on easter hols! On the Kero/lifebonded thing I can't decide if they were or weren't. it never actually *said* anything ::ducks under rain of ppl throwing textevd my way with *suggestion* of a lifebond:: in the books about them being lifebonded. but I really liked Eldan, and Kero too for that matter. She always seemed to me to be the practical "think before i go charging off into battle" type. I guess By The Sword has to be one of my favourites (along with LHM, Arrows, Winds, Storms.....) of all time. On another line... i found the MLML website and it seems incredibly old. i didn't recognise any names etc. and was wondering if whoever held the key to it was still on the list. if not could we (i would be willing to provide the site and time if people sent me their suggestions) set up another one? with things like the birthdays list, the misty awards, the "You Know When You've Been Reading Too Much Mercedes Lackey When...." list and such. i dunno, just a stray thought bumping around the cobwebs. Oh and Lady Brynn sends her most deepest regrets but hotmail is playing silly buggers and is not recieving any list mail. she is gonna have six fits at her computer and see what she can do. until then she has passed on her enchanted bucket #2 TM to me on loan until she gets back onlist. Sorry so short, I hafta go practice my bassoon (for those who don't know, it's a big musical instrument) now. Zhai'helleva Moonstalker :) She'enedra to Brynn Short term carrier of the enchanted bucket #2 TM "Friends, however distant, are always present." - Cicero _______________________________________________________ Get 100% FREE Internet Access powered by Excite Visit http://freelane.excite.com/freeisp ------------------------------ Date: Tue, 2 May 2000 13:28:49 -0600 From: winged_wolf-+AT+-juno.com To: mercedes-lackey-+AT+-herald.co.uk Subject: Re: sending stuff - virus warning Message-ID: <20000502.142636.-262767.11.Winged_Wolf-+AT+-juno.com> On Mon, 1 May 2000 16:02:52 +0100 (BST) "Mark Severson" writes: > The attachment happy99.exe IS a virus. I recall receiving it last > year - I > did not open it then, I deleted it. I recall reading about the > Happy99 > virus either from email or in the news. > > Mark Severson Also, don't be overly harsh on the person who sent it--that person did NOT send the virus knowingly. Happy99 is self-propagating--so the fact that they sent it means that they were simply a victim of the virus. --Winged Wolf http://www.crosswinds.net/~wingedwolf/index.html "Pardon me while I burst into flames...I've had enough of the world and its' peoples' mindless games. So pardon me while I burn, and rise above the flame, pardon me, pardon me...don't ever be the same..." --Incubus ________________________________________________________________ YOU'RE PAYING TOO MUCH FOR THE INTERNET! Juno now offers FREE Internet Access! Try it today - there's no risk! For your FREE software, visit: http://dl.www.juno.com/get/tagj. ------------------------------ Date: Tue, 2 May 2000 13:15:44 -0600 From: winged_wolf-+AT+-juno.com To: mercedes-lackey-+AT+-herald.co.uk Subject: Re: Return of Vanyel Message-ID: <20000502.142636.-262767.8.Winged_Wolf-+AT+-juno.com> Found a reference while re-reading Storm Warning. Seems that according to Florian, Vanyel, Yfandes, and Stefan already had something in mind, but had to hurry to get into the right "placement", so they could not meet Karal and An'Desha on the moonpath. That suggests they are not only coming back, but coming back pretty quickly. (No need to hurry just to take a rest, after all). Need was the one who said she might or might not come back, but she was taking a long rest first. Florian also implied he was coming back, and within Karal's lifetime. --Winged Wolf http://www.crosswinds.net/~wingedwolf/index.html "Pardon me while I burst into flames...I've had enough of the world and its' peoples' mindless games. So pardon me while I burn, and rise above the flame, pardon me, pardon me...don't ever be the same..." --Incubus ________________________________________________________________ YOU'RE PAYING TOO MUCH FOR THE INTERNET! Juno now offers FREE Internet Access! Try it today - there's no risk! For your FREE software, visit: http://dl.www.juno.com/get/tagj. ------------------------------ Date: Tue, 2 May 2000 13:25:57 -0600 From: winged_wolf-+AT+-juno.com To: mercedes-lackey-+AT+-herald.co.uk Subject: Re: Baron Valdemar & "Happy99.exe" Message-ID: <20000502.142636.-262767.10.Winged_Wolf-+AT+-juno.com> On Mon, 1 May 2000 15:29:09 +0100 (BST) Lyn Belzer writes: > Okay, listsibs, we have a *VERY* angry wolf on our hands. > > DO NOT attempt to open or execute the file named "Happy99.exe" that > was > attached to the message "Baron Valdemar." It set off all kinds of > lovely > alarms in my anti-virus program. > > PLEASE scan any files you send to the list through an anti-viral > program > FIRST. > > A grumbling- > -Icewolf Oh, is that what it was? (I use Juno, the file doesn't come through on Juno). Happy99 is fairly well known virus--if any of you DID download this file, it will take over your e-mail program and send a copy of itself to anyone you send a letter to. Normally the pattern is that your e-mail is sent, then another e-mail is sent to the same person, which has the virus attached. In that way, Happy99 works like Melissa. I've also heard some versions will bring up a fireworks graphic on your computer. So if you downloaded it, warn anyone you've sent mail to in the meantime, and hunt it down and get rid of it. This virus propagates like Melissa--the diabolical side of it is, you get a file that appears to be coming from a trusted friend, making you much more likely to download it. Like Melissa, it doesn't work with ALL e-mail programs--Not through Juno nor aol, for example. --Winged Wolf http://www.crosswinds.net/~wingedwolf/index.html "Pardon me while I burst into flames...I've had enough of the world and its' peoples' mindless games. So pardon me while I burn, and rise above the flame, pardon me, pardon me...don't ever be the same..." --Incubus ________________________________________________________________ YOU'RE PAYING TOO MUCH FOR THE INTERNET! Juno now offers FREE Internet Access! Try it today - there's no risk! For your FREE software, visit: http://dl.www.juno.com/get/tagj. ------------------------------ End of MERCEDES-LACKEY Digest 2284 **********************************