RE: [Mac-NT] "Happy99.exe" virus comments

Harris Meyers(HarrisM[at]npcconsult.com)
Thu, 3 Jun 1999 14:55:04 -0700

WinMac Digest #331 - Thursday, June 3, 1999

  NT4 and remote access through dial up networking
          by "Willy Rivet" <wrivet@qouest.net>
  Re(2): Choosing a WinMac server
          by "Roger" <tornberg@geo.su.se>
  Spontaneous Client Disconnects
          by "Michael H. Martel" <martelm@quark.vsc.edu>
  Flashing Question Mark
          by "Kimmey, Dennis" <DKIMMEY@IGC.com>
  Re: Flashing Question Mark
          by "Daniel L. Schwartz" <expresso@snip.net>
  "Happy99.exe" virus comments
          by "Daniel L. Schwartz" <expresso@snip.net>
  RE: [Mac-NT] "Happy99.exe" virus comments
          by "Harris Meyers" <HarrisM@npcconsult.com>

Subject: NT4 and remote access through dial up networking
From: "Willy Rivet" <wrivet@qouest.net>
Date: Wed, 2 Jun 1999 21:55:53 -0400
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

Does anyone know of a way to have an NT server wait for a user login (MAC or
PC) via regular telephone lines? Are there any alternatives to PCAnywhere? I
am interested in one since I need to remotely log onto a NT4 server in the
event that it loses it's TCP/IP connection it usually has. This server is
offsite from our office and is acting as a gateway to an Internet backbone
and uses Multilink PPP modems to achieve this.

When logon is successful, I need to be able to access the desktop and dial
up networking so I can have the modems reconnect to the backbone...

Can PC anywhere be active (waiting for a call) even though there has been no
active login at the NT server itself? If so, how can I set it up? Currently
we have the services auto-dial our MPPP modems automatically on startup even
though we have not actively logged onto the server. But if this fails, I
need to be able to access the box irregardless of the state of the MPPP and
TCP/IP connection.

Any ideas??

William Rivet
Qouest.net Tech Support
Shawville, Quebec Canada

support@qouest.net
http://www.qouest.net

Subject: Re(2): Choosing a WinMac server
From: "Roger" <tornberg@geo.su.se>
Date: Thu, 3 Jun 1999 06:18:04 +0200
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"

Thanks for your suggestions Dan:
Couldn't tell what code page I am using on the PC, however I suppose I am
using the default settings of Win95B. Got the international versions (i.e.
not some only swedish versions) of MacOS 8.6, ASIP 6.2, Win95B, WinNT4(sp4)
and even the darned keyboard on the Mac G3 B/W server :)
After I updated to MacOS 8.6 and ASIP 6.2 I was able to copy the file with
both a space and swedish characters both to and from both of the above
windowsclients and the ASIP machine :) Of course the file with a 36
character filename failed.

And thanks for your suggestions too John:
If these are well know issues for people who know the more technical stuff
it should have been noted on the apple site somewhere. ASIP is supporsed to
be "easy to set up and simple to administer". I think Apple give its
presumtive buyers, the low-end of us who know a bit more than the average
user, the wrong picture. We see "Native support for Windows clients...SMB
something" and think, hey all of our problems are solved, but its not.

Having updated to Mac OS 8.6 and ASIP 6.2 my world looks somewhat brighter.

/Roger

Subject: Spontaneous Client Disconnects
From: "Michael H. Martel" <martelm@quark.vsc.edu>
Date: Thu, 03 Jun 1999 08:31:47 -0400
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Hello!

I have and Alpha 4/266 w/128mb's ram running NT 4.0. Over the holiday
weekend I upgraded the machine to SP4 w/ie 4.01 and the MDAC kit for Y2k
compliance. I then installed SP5 on top of that.

The only non Microsoft products on the machine are DiskKeeper 4.0 and
Netshield 4.0.2 . Netshield was a recent addition, while DiskKeeper has
been there from the beginning.

By the end of the holiday weekend the machine looked like this :

        NT 4.0 SP5
        Netshield 4.0.2
        DiskKeeper 4.0
        Providing File and Print services to Mac and PC Users
        Seeding Router for the AppleTalk network.

All of a sudden now, my Mac users and PC Users are getting spontaneously
dropped from the server. The server appears to be fine at the console. I
can ping it, and browse the shares, but I can't access shares. The Mac's
try and browse the server and just sit there, with the spinning clock.

On Tuesday when it stopped working, I removed the Seed Routing and put it
back on the machine it had been on before. Rebooted the server and
verified that the right router was seeding the network.

On Wednesday it did it again. This time I uninstalled Netshield and
rebooted. I noticed that while shutting down, two machines that had been
trying to browse shares on the server all of a sudden were able to. This
leads me to think that some service was hung (not the file service
obviously, since I could access the shares just fine!).

I'm hoping that it was Netshield, I really don't want to back out SP5 ...

There are no messages in the event log that help. The only ones are about
timing out Macintosh clients.

Has anybody seen anything like this ?

Thanks!

Michael

-- 


  -------------------------------o--------------------------------
  Michael H. Martel              | Vermont State Colleges        
  mailto:martelm@quark.vsc.edu   | Technical Support Specialist
  http://probe.vsc.edu/~michael  | PH:802-241-2535 FX:802-241-3363








Subject: Flashing Question Mark
From: "Kimmey, Dennis" <DKIMMEY@IGC.com>
Date: Thu, 3 Jun 1999 12:48:09 -0400 
MIME-Version: 1.0
Content-Type: text/plain


Help! Help!


One of our Mac users was transferring files from her Mac (PowerMac 7600/120
OS 8.5.1) to an NT 4.0 SP3) Server when it suddenly flashed a message to the
effect "an error of type [a number she can't remember] has occurred]", then
displayed the disk icon with a flashing question mark inside it.


I tried booting with a Disk Tools 8.5.1 disk, but it gave me a dialog box
asking if I wanted to initialize the hard drive. Same thing when I booted
from an external hard drive containing a universal install of the Mac OS.


Unfortunately the last full backup was done in November. Does anyone have
any ideas how the data can be saved or know of a good data recovery company?


Thanks!
- Dennis




Subject: Re: Flashing Question Mark
From: "Daniel L. Schwartz" <expresso@snip.net>
Date: Thu, 03 Jun 1999 16:05:46 -0400
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable




	Although not really WinMac oriented, I'll try to help. Try booting from a
Norton Utilities 4.0.x CD and run Norton Disk Doctor.


	Since the machine is a 7600, it shipped with MacOS 8.0 or 8.1; and a
*possible* problem could have occurred when you upgraded to 8.5/8.5.1 and
did not update the disk drivers.


	Another possibility is that in the General Controls Control Panel you (or
she) unchecked "Warn about improper shutdown." In MacOS 8.5, this launches
Disk First Aid, which will help - But not fully prevent - file system
corruption.


	Cheers!
	Dan


At 12:48 PM 6/3/99 -0400, you wrote:
>Help! Help!
>
>One of our Mac users was transferring files from her Mac (PowerMac 7600/120
>OS 8.5.1) to an NT 4.0 SP3) Server when it suddenly flashed a message to=
 the
>effect "an error of type [a number she can't remember] has occurred]", then
>displayed the disk icon with a flashing question mark inside it.
>
>I tried booting with a Disk Tools 8.5.1 disk, but it gave me a dialog box
>asking if I wanted to initialize the hard drive. Same thing when I booted
>from an external hard drive containing a universal install of the Mac OS.
>
>Unfortunately the last full backup was done in November. Does anyone have
>any ideas how the data can be saved or know of a good data recovery=
 company?
>
>Thanks!
>- Dennis




 -----------------------------------------------------------------


	<mailto:expresso@snip.net>=20
=09
	ALTERNATE: <mailto:expresso@workmail.com>


		Webmaster for	<http://www.Faulknerstudios.com>,
					<http://www.BrakeAndGo.com>


->	NEW! Sign up for the Mac-NT Mailing list at:
 <http://www.onelist.com/subscribe/Mac-NT>


	This message is =A9Copyright 1999 by Daniel L. Schwartz, and
may not be reproduced except in its entirety.


 -----------------------------------------------------------------




Subject: "Happy99.exe" virus comments
From: "Daniel L. Schwartz" <expresso@snip.net>
Date: Thu, 03 Jun 1999 17:14:09 -0400
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable




	All:


	I'm QUITE sure that John Mullett did not *intentionally* send the
"Happy99.exe" virus to the AlphaNT mailing list.


	Let this just serve as a warning that even amongst experts, accidents DO
happen. And, they can happen even amongst Mac and AlphaNT users using
SoftWindows, FX!32, and (especially) VirtualPC.


	In any case, especially in light of Michael Martel's AlphaNT system
difficulties, take a look at Sophos SWEEP.
 <http://www.sophos.com>. It's pretty much universal, and can detect Mac
virus' (including the AutoStart 9805 worm) on NT and NetWare servers.


	[Note to moderator of WinMac list: Does your LISTSERV software strip off
attachments? Please let us ALL know!]


	Yours truly,
	Dan


DISCLAIMER: I HAVE NO FINANCIAL INTEREST IN SOPHOS, YADA YADA YADA...




 -----------------------------------------------------------------


	<mailto:expresso@snip.net> 
	
	ALTERNATE: <mailto:expresso@workmail.com>


		Webmaster for	<http://www.Faulknerstudios.com>,
					<http://www.BrakeAndGo.com>


->	NEW! Sign up for the Mac-NT Mailing list at:
 <http://www.onelist.com/subscribe/Mac-NT>


	This message is ©Copyright 1999 by Daniel L. Schwartz, and
may not be reproduced except in its entirety.


 -----------------------------------------------------------------




Subject: RE: [Mac-NT] "Happy99.exe" virus comments
From: "Harris Meyers" <HarrisM@npcconsult.com>
Date: Thu, 3 Jun 1999 14:55:04 -0700
MIME-Version: 1.0
Content-Type: text/plain;	charset="iso-8859-1"
Content-Transfer-Encoding: Quoted-Printable


For more information on Happy99, see


	http://www.symantec.com/avcenter/venc/data/happy99.worm.html


It appears that once you are infected, anyone you send
e-mail to will automatically receive a second e-mail message
with the worm attached.  This causes the virus to spread
fairly quickly.


	Harris


_____________________________________________________
| Harris Meyers              HarrisM@npcconsult.com  |
| NPC Consulting             Voice: (408) 260-2742   |
| http://www.npcconsult.com  FAX:   (408) 241-9013   |
| Networking, Productivity, and Curriculum for K-12  |
| education...                                       |
| Advancing intelligent use of technology in schools |
\____________________________________________________/


> -----Original Message-----
> From: Daniel L. Schwartz [mailto:expresso@snip.net]
> Sent: Thursday, June 03, 1999 2:14 PM
> To: AlphaNT@alphant.com
> Cc: winmac@xerxes.frit.utexas.edu; Mac-NT@onelist.com
> Subject: [Mac-NT] "Happy99.exe" virus comments
>
>
> From: "Daniel L. Schwartz" <expresso@snip.net>
>
>
> 	All:
>
> 	I'm QUITE sure that John Mullett did not *intentionally* send the
> "Happy99.exe" virus to the AlphaNT mailing list.
>
> 	Let this just serve as a warning that even amongst experts,
> accidents DO
> happen. And, they can happen even amongst Mac and AlphaNT users using
> SoftWindows, FX!32, and (especially) VirtualPC.
>
> 	In any case, especially in light of Michael Martel's AlphaNT system
> difficulties, take a look at Sophos SWEEP.
>  <http://www.sophos.com>. It's pretty much universal, and can detect Mac
> virus' (including the AutoStart 9805 worm) on NT and NetWare servers.
>
> 	[Note to moderator of WinMac list: Does your LISTSERV
> software strip off
> attachments? Please let us ALL know!]
>
> 	Yours truly,
> 	Dan
>
> DISCLAIMER: I HAVE NO FINANCIAL INTEREST IN SOPHOS, YADA YADA YADA...
>
>
>  -----------------------------------------------------------------
>
	<mailto:expresso@snip.net>


	ALTERNATE: <mailto:expresso@workmail.com>


		Webmaster for	<http://www.Faulknerstudios.com>,
					<http://www.BrakeAndGo.com>


->	NEW! Sign up for the Mac-NT Mailing list at:
 <http://www.onelist.com/subscribe/Mac-NT>


	This message is ©Copyright 1999 by Daniel L. Schwartz, and
may not be reproduced except in its entirety.


 -----------------------------------------------------------------


------------------------------------------------------------------------
With more than 18 million e-mails exchanged daily...
http://www.onelist.com
...ONElist is THE place where the world talks!
------------------------------------------------------------------------
Welcome to the Mac-NT Mailing List!










*                    Windows-MacOS Cooperation List                 *

This archive was generated by hypermail 2.0b2 on Thu Jun 03 1999 - 17:04:21 PDT