- NZNOG - lists.nznog.org

Re: [NZNET] RE: Virus alert
by Mark Foster 01 Oct '02

01 Oct '02

On Wed, 2 Oct 2002 01:52:46 +1200 (NZST), Lin Nah <lin(a)darkmere.gen.nz> wrote : > Having said all that, I will admit that I work for an ISP that sets up > its customers on Outlook or OE. I think most of us know why that > happens. If you don't you can email me for a longer spiel 8) > Should we be doing more to educate our users? The answer would be yes. > I would like to find out what other NZ ISPs are doing in this area > with the hope of learning what works and what won't. A small clarification, I nearly posted this yesterday but it didnt seem appropriate or required at the time... Im one of the helpdesk team at the ISP Lin also works for. Our helpdesk is familiar with Outlook Express but that doesnt mean we're close minded about it. We regularly support clients who use other mailing software and as long as the software is reasonably generic we manage. We dont force our clients to use OE, but we do suggest it to our clients *because its there*. The differentiation is important, and stereotyping against helpdesk types isnt going to help. We all start somewhere. :-) I run Eudora in Sponsored mode and find it more than adequate - never caught anything through that, and I have never run resident antivirus either. (I manually scan my system from time to time using F-Prot for DOS.) Prior to using Eudora I used Netscape Messenger (4.x) and found this was also pretty good, although the limitation to only one mailbox is what forced me to migrate. Now that Netscape 7 is out I may consider switching back soon.... I think most ISP helpdesks crewed by reasonable people will accept that their clients dont *have* to use Outlook Express, and the only reason they may encourage their clients to use it is that especially for the less-than- technically-savvy sort, OE is easy to setup, and provided with all versions of Windows from 98 upward. If you work for an ISP and you dont have support staff familiar with a broader range of email clients than Outlook and Outlook Express, I would seriously suggest some more training is in order: Eudora, Netscape Messenger and Pegasus come to mind as alternatives, but theres obviously a lot more. </end rant> Mark. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: [NZNET] RE: Virus alert
by Donald Neal 01 Oct '02

01 Oct '02

I'm not really happy that this sort of posting meets the AUP, which talks about discussion between operators. There are cetainly announcements which may be of value to the list, but these seem to me to be characterised by not being present on a routine basis in other forums. I think that to allow announcements of this kind would have an unacceptable effect on the signal to noise ratio of the list. Unless people particularly want to see these here, I intend in future to treat them as outside the AUP. - Donald Neal NZNOG List Administrator > E-Secure-IT has just received this field report: > > While it does all the normal mass mailing stuff, own smtp engine, > harvests address lists etc this one did something really weird that > I've never seen before- it sent a postscript print job to > every printer > it could find. > > The scary thing was it even picked up printers attached to parallel > ports and which were not shared and sent the print job to them too. > I know it tries to access network shares, but looks like it tries to > access print q's also, be interested to see if anyone else has > seen this? > > FYI can confirm that NAV sigs of 30/9 do detect and clean. > > Arjen > www.e-secure-db.us ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------ - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

The New Zealand Network Operators' Group
by Donald Neal 01 Oct '02

01 Oct '02

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. This posting, or one like it, is sent to all subscribers each month. Operators' Contact List See http://www.usenet.net.nz/noc/ for operational contact details for most New Zealand ISP's. These are intended for use by other network operators rather than by most customers. Auckland Peering Exchange See http://www.ape.net.nz/ for details of the Auckland Peering Exchange and those connected there. About This Mailing List This list has around 370 subscribers, increasing by a few each month. You may only post to the list from an address subscribed to one of the lists described below. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by an employee of Telecom NZ Ltd. Neither of these organisations, nor the administrator, is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ Any message sent to the list will be archived and made available on the web automatically. Changes are not made to the archive on request, though the administrator remains happy to assist the Office of the Privacy Commissioner should any complaint be laid with that office. Subscribing to the List To subscribe to the NZNOG list, send email to majordomo(a)list.waikato.ac.nz, where the body of the message reads subscribe nznog Digest Mailing List If you don't wish to receive postings as they are sent, you can instead subscribe to the nznog-digest mailiing list, on which all postings are sent out in a single "digest" every couple of days. Post-only Mailing List An address from which you wish to post, but which will not receive messages from the list, may be subscribed to nznog-postonly. You will presumably want to have another address subscribed to the main nznog list. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------ - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: [NZNET] RE: Virus alert
by Arjen De Landgraaf 01 Oct '02

01 Oct '02

E-Secure-IT has just received this field report: While it does all the normal mass mailing stuff, own smtp engine, harvests address lists etc this one did something really weird that I've never seen before- it sent a postscript print job to every printer it could find. The scary thing was it even picked up printers attached to parallel ports and which were not shared and sent the print job to them too. I know it tries to access network shares, but looks like it tries to access print q's also, be interested to see if anyone else has seen this? FYI can confirm that NAV sigs of 30/9 do detect and clean. Arjen www.e-secure-db.us - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Updated ASN allocation to ARIN
by Rob Thomas 01 Oct '02

01 Oct '02

Hi, NZNOG folks. [ Apologies to those of you who have seen this post in other fora. ] A range of ASNs have been allocated to ARIN as of September 2002. The range is 26624 - 27647. You may wish to adjust your filters. The definitive list can be found here: http://www.iana.org/assignments/as-numbers I have updated my bogus ASN monitoring to reflect these changes. You can see the list of networks that leak bogus ASNs here: http://www.cymru.com/BGP/asnbogusrep.html Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty); - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: [NZNET] RE: Virus alert
by Joe Abley 01 Oct '02

01 Oct '02

[I keep trying to redirect this noise somewhere else. Seems like some peoples' mail clients don't respect standard headers, or something] On Tue, Oct 01, 2002 at 04:47:16PM +1200, James Spooner wrote: > Are you in fact an expert on car safety, or do you buy/travel in a car based > on what you know about car safety? I'm no expert. > If in fact you do, does this not make you a parallel to someone using > windows and outlook express, who 'should know better'. > > Why do you think you travel in a particular car, is it perhaps because it's > available and it gets you from A to B? Sure. I don't make a habit of travelling in cars which are not licenced to drive on the road, though, and that affords me some safety without needing first-hand, expert knowledge of the dangers involved. > I think that the Car vs Computer parallel in fact works in favour of windows > in this case Joe. I don't follow you. There are safeguards set up to ensure people don't drive in unsafe cars, regardless of how little they personally know about car safety. There are no safeguards set up to encourage people not to use unsafe mail clients. The regular virus bulletins could say "as with this other large list of security problems, this one can be avoided simply by using a different mail client", but they don't. ISPs could stop shipping OE, or could find ways to encourage users to install different mail clients, but they don't. > Check my headers if you wonder which client I use :) So why do you use it? Joe - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 6

RE: Virus alert
by Arjen De Landgraaf 30 Sep '02

30 Sep '02

Hi Joe, We could state that in our advisories, However, wouldn't it be on the same line as: Avoid car accidents, disable all petrol and diesel? Personally I would love to have the death rate on the road reduced to 0. If this is realistically achievable right now is another question. The reality is that Microsoft and all its products are a very large part of the global business world right now. Just as unsafe cars. We can make them somewhat safer by awareness and vigilance, just as driving a car. That is not to say that we don't agree with you, but the other side of the coin is that there are plenty of "non-windows" threats around; SSL, apache etc also have their own vulnerabilities. Arjen -----Original Message----- From: Joe Abley [mailto:jabley(a)automagic.org] Sent: Tuesday, October 01, 2002 3:40 PM To: Arjen De Landgraaf Cc: 'Simon Byrnand'; nznog(a)list.waikato.ac.nz Subject: Re: Virus alert On Tue, Oct 01, 2002 at 03:16:57PM +1200, Arjen De Landgraaf wrote: > From www.e-secure-it.us > > DETAILED DESCRIPTION OF BUGBEAR, HOW TO RECOGNISE AND FIRST AID KIT. It continues to amazme me that the preventative measure "do not use microsoft e-mail clients", or even "do not use windows" is never suggested as part of these bulletins. I think ISP and IT helpdesks of the world would do everybody a big favour if they just stopped supporting mail clients which make it so trivial to execute encapsulated scripts. "I propose that we deploy Microsoft Outlook". "You're fired. Never insult us with your presence again." Mmm. "I have a problem with my e-mail." "Does it say Outlook Express at the top of the window?" "Yes." <click> brrrrrrr Reply-To set :) Joe - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 8

RE: [NZNET] RE: Virus alert
by Darryl Munro 30 Sep '02

30 Sep '02

On Tue, Oct 01, 2002 at 03:58:36PM +1200, Arjen De Landgraaf wrote: > Hi Joe, > > We could state that in our advisories, > However, wouldn't it be on the same line as: > > Avoid car accidents, disable all petrol and diesel? >No; I think it would be more along the lines of "do not drive vehicles >which are unsafe". LOL or could we also say "do not do those drugs as they are unsafe" > The reality is that Microsoft and all its products are > a very large part of the global business world right > now. Just as unsafe cars. We can make them > somewhat safer by awareness and vigilance, > just as driving a car. >Not quite. We reduce the problem of unsafe cars by passing laws which >seek to enforce minimum standards for cars. If nobody took any steps to >get unsafe cars off the road, more people would die. The same could be said of the Internet, as more and more countries pass legislation on what is and isn't acceptable use of this medium. If nobody took any steps to pass and police these laws then more software vulnerabilities would be discovered and exposed by, what can arguably be explained as the biggest pain in our collective IT butt, Hackers, or did I mean developers that move from the standard to claim their own. >If the most popular car on the road had a defect which routinely caused >people to die, I don't think people would say "the reality is that the >car in question has a large market share, so it's really not practical >to encourage people not to drive it." Fix the defect and do a recall on the car in question, it is not a question of practicality more one of morality, and we all know that practicality and morality are clouded when it comes to the bottom line. Darryl Joe - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Virus alert
by Arjen De Landgraaf 30 Sep '02

30 Sep '02

>From www.e-secure-it.us DETAILED DESCRIPTION OF BUGBEAR, HOW TO RECOGNISE AND FIRST AID KIT. Bugbear / Tanatos This virus is written in MSVC and packed with UPX. It shuts down anti-virus and firewall software designed to block out intruders and can spread by dropping copies of itself into folders on shared networks, which are commonly used at corporations and large organizations. The worm's most interesting feature is a Trojan horse component called PWS-Hooker that secretly watches every keystroke on an infected computer, and stores the captured information on the computer in encrypted form. The data can be accessed later by the virus writer or anyone else who happens upon the infected computer, or it can be e-mailed to the author. Bugbear might be spreading because it is cleverly crafted and difficult to spot with the naked eye. It arrives in a victim's e-mail inbox with a subject line chosen randomly from dozens of possibilities, including: Possible message subject lines include the following (however, other random subject lines are also possible): 25 merchants and rising Announcement bad news CALL FOR INFORMATION! click on this! Correction of errors Cows Daily Email Reminder empty account fantastic free shipping! Get 8 FREE issues - no risk! Get a FREE gift! Greets! Hello! Hi! history screen hmm.. I need help about script!!! Interesting... Introduction its easy Just a reminder Lost & Found Market Update Report Membership Confirmation My eBay ads New bonus in your cash account New Contests new reading News Payment notices Please Help... Re: $150 FREE Bonus! Report SCAM alert!!! Sponsors needed Stats Today Only Tools For Your Online Business update various Warning! wow! Your Gift Your News Alert The message body varies and may contain fragments of files found on the victim's system. The attachment name also varies, but may contain the following strings: Card Docs image images music news photo pics readme resume Setup song video The actual infected file arrives as an attachment, which also has a random name. And Bugbear's first task, upon infection, is to disable all installed antivirus software. It's throwing a lot of things at people to see if it can find something to slip under the radar. Once activated, the virus shuts down scores of vital processes used by Windows and by antivirus software, records user keystrokes, opens a backdoor to the infected machine for use by attackers, and attempts to mail copies of itself out to other users, randomly generating new subject lines and virus executable names as it does W32/Bugbear-A is an internet worm which spreads via SMTP and also attempts to spread via network shares. The worm copies itself to the Windows system folder as a file with a random four-letter name and an EXE extension and adds to the following registry entry to run this file on the next reboot: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce W32/Bugbear-A also drops a copy of itself in the Windows start up folder so that is run on system restart. The worm drops a randomly-named DLL file, which is related to logging keystrokes, in the Windows system folder. It can also terminate certain firewall and antivirus programs. How to recognise: The virus file is attached to e-mails with a wide variety of subject lines : Attachment Length: 50,688 bytes (UPXed) or 50,664 bytes The subject line, name of the attachment and text in the body of the message can vary, and the attachment name typically has a double extension, such as .xxx.pif, .xxx.scr etc IF YOU ARE INFECTED: Symptoms: Method Of Infection This virus spreads over the network (via network shares) and by mailing itself (using it's on SMTP engine). It attempts to terminate the process of the following security programs: ACKWIN32.exe F-AGNT95.exe ANTI-TROJAN.exe APVXDWIN.exe AUTODOWN.exe AVCONSOL.exe AVE32.exe AVGCTRL.exe AVKSERV.exe AVNT.exe AVP32.exe AVP32.exe AVPCC.exe AVPCC.exe AVPDOS32.exe AVPM.exe AVPM.exe AVPTC32.exe AVPUPD.exe AVSCHED32.exe AVWIN95.exe AVWUPD32.exe BLACKD.exe BLACKICE.exe CFIADMIN.exe CFIAUDIT.exe CFINET.exe CFINET32.exe CLAW95.exe CLAW95CF.exe CLEANER.exe CLEANER3.exe DVP95_0.exe ECENGINE.exe ESAFE.exe ESPWATCH.exe FINDVIRU.exe FPROT.exe IAMAPP.exe IAMSERV.exe IBMASN.exe IBMAVSP.exe ICLOAD95.exe ICLOADNT.exe ICMON.exe ICSUPP95.exe ICSUPPNT.exe IFACE.exe IOMON98.exe JEDI.exe LOCKDOWN2000.exe LOOKOUT.exe LUALL.exe MOOLIVE.exe MPFTRAY.exe N32SCANW.exe NAVAPW32.exe NAVLU32.exe NAVNT.exe NAVW32.exe NAVWNT.exe NISUM.exe NMAIN.exe NORMIST.exe NUPGRADE.exe NVC95.exe OUTPOST.exe PADMIN.exe PAVCL.exe PAVSCHED.exe PAVW.exe PCCWIN98.exe PCFWALLICON.exe PERSFW.exe F-PROT.exe F-PROT95.exe RAV7.exe RAV7WIN.exe RESCUE.exe SAFEWEB.exe SCAN32.exe SCAN95.exe SCANPM.exe SCRSCAN.exe SERV95.exe SPHINX.exe F-STOPW.exe SWEEP95.exe TBSCAN.exe TDS2-98.exe TDS2-NT.exe VET95.exe VETTRAY.exe VSCAN40.exe VSECOMR.exe VSHWIN32.exe VSSTAT.exe WEBSCANX.exe WFINDV32.exe ZONEALARM.exe TROJAN: Port 36974 open Existence of the following files (* represents any character): %WinDir%\System\****.EXE (50,688 or 50,684 bytes) %WinDir%\******.DAT %WinDir%\******.DAT %WinDir%\System\******.DLL %WinDir%\System\*******.DLL %WinDir%\System\*******.DLL This worm emails itself to addresses found on the local system. The worm copies itself to the Windows system folder as a file with a random four-letter name and an EXE extension and adds to the following registry entry to run this file on the next reboot: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce When run on the victim machine it copies itself to %WinDir%\System as ****.EXE (where * represents random character). For example in testing: Win98 : C:\WINDOWS\SYSTEM\FYFA.EXE 2k Pro : C:\WINNT\SYSTEM32\FVFA.EXE The following Registry key is set in order to hook next system startup: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion RunOnce "%random letters%" = %random filename%.EXE (Win9x) The worm copies itself to the Startup folder on the victim machine as ***.EXE (where * represents random character), for example: Win98 : C:\WINDOWS\Start Menu\Programs\Startup\CUK.EXE 2k Pro : C:\Documents and Settings\(username)\Start Menu\Programs\Startup\CYC.EXE Trojan component The worm opens a port on the victim machine - port 36794 and searches for various running processes, stopping them if found. The list of processes includes many popular AV and personal firewall products. This remote access server allows an attacker to upload, and download files, run executes, and terminate processes. It drops a DLL on the victim machine - keylogger related. This DLL is detected as PWS-Hooker.dll. Network share propagation The worm attempts to copy itself to the Startup folder of remote machines on the network (as ***.EXE - described above). Outgoing messages look to make use of the Incorrect MIME Header Can Cause IE to Execute E-mail Attachment vulnerability (MS01-020) in Microsoft Internet Explorer (ver 5.01 or 5.5 without SP2). FIRST AID KIT: AS EMERGENCY MEASURE - Remove, Disable or encrypt all local email addresses (addressbook etc) TO PREVENT FROM SPREADING (BEFORE YOU ARE INFECTED) INCOMING EMAILS: Filter on attachment length 50,688 bytes (UPXed) or 50,664 bytes Filter out attachments, especially .pif, .scr (By the way, you should filter out all attachments anyway) Nail down your Network shares - it replicates itself through them. Make sure all USER PC's have IE updated with latest security patches It takes advantage of a known vulnerability in Microsoft's Internet Explorer versions 5.01 and 5.5 that allows attackers to embed malicious code in the header of an improperly formatted HTML message that could cause e-mail clients such as Outlook to automatically launch attached executable files. Microsoft addressed the issue in Service Bulletin MS01-020 and issued a patch for the vulnerability in March of 2001. Trojan: Port 36974 open - CHECK ON THIS PORT!!!! Existence of the following files (* represents any character): %WinDir%\System\****.EXE (50,688 or 50,684 bytes) %WinDir%\******.DAT %WinDir%\******.DAT %WinDir%\System\******.DLL %WinDir%\System\*******.DLL %WinDir%\System\*******.DLL FURTHER INFORMATION ON PWS-HOOKER: Type: Zoo Trojan Horse Infection Length: variable Systems Affected: Windows 3.x, Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me Trojans in this family can record your keystrokes and store this information in encrypted form. The Trojan sends this encrypted file and the IP address of the compromised computer to email addresses that are defined by the hacker. The following is a description of a specific PWS.Hooker.Trojan variant that can be dropped by the W32.Badtrans.gen(a)mm worm. When the Trojan runs, it does the following: It copies itself as C:\%System%\Kern32.exe. NOTE: %System% is a variable. The Trojan locates the \Windows\System folder (by default this is C:\Windows\System or C:\Winnt\System32) and copies itself to that location. It also drops C:\%System%\Hksdll.dll. This file is a component of, and is detected as W32.Badtrans.gen(a)mm. The Trojan adds the value kernel32 C:\%System%\kern32.exe to the registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce This causes the Trojan to run then next time that you start Windows. Arjen de Landgraaf www.e-secure-db.us www.e-secure-it.us -----Original Message----- From: Simon Byrnand [mailto:simon(a)igrin.co.nz] Sent: Tuesday, October 01, 2002 3:14 PM To: nznog(a)list.waikato.ac.nz Subject: Virus alert For those that havn't noticed yet, a new virus has just come out which is spreading extremely rapidly. Depending on what antivirus software you use its called "W32.Bugbear(a)mm" (Norton Antivirus) or "I-Worm.Tanatos" (Kaspersky) - it may go under different names on other scanners. Both Norton and Kaspersky have only added detection of it in the last 12 hours AFAIK, and it looks like it has been in the wild in NZ at least 24 hours before updates to most scanners were able to detect it. (On topic bit :) The thing that's interesting about this particular virus is that it actively scans netblocks for machines listening on port 137 (Windows file/printer sharing) using simple incremental scans, so its quite easy to spot machines that are infected. Apparently it also sends information about the compromised machine to a pre-defined email address, and also opens a backdoor listening on TCP port 36794. As well as that, it uses the I-Frame exploit to automatically infect machines with unpatched versions of Outlook Express, and has the ability to automatically close all commonly used virus scanners whenever you try to run them. Based on the massive flood of this virus we've seen today it looks like a Klez killer has arrived..... (its outnumbering Klez by about 16 to 1 in our stats today) More info: http://securityresponse.symantec.com/avcenter/venc/data/w32.bugbear(a)mm.ht… Regards, Simon Byrnand iGRIN Internet - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Virus alert
by Simon Byrnand 30 Sep '02

30 Sep '02

For those that havn't noticed yet, a new virus has just come out which is spreading extremely rapidly. Depending on what antivirus software you use its called "W32.Bugbear(a)mm" (Norton Antivirus) or "I-Worm.Tanatos" (Kaspersky) - it may go under different names on other scanners. Both Norton and Kaspersky have only added detection of it in the last 12 hours AFAIK, and it looks like it has been in the wild in NZ at least 24 hours before updates to most scanners were able to detect it. (On topic bit :) The thing that's interesting about this particular virus is that it actively scans netblocks for machines listening on port 137 (Windows file/printer sharing) using simple incremental scans, so its quite easy to spot machines that are infected. Apparently it also sends information about the compromised machine to a pre-defined email address, and also opens a backdoor listening on TCP port 36794. As well as that, it uses the I-Frame exploit to automatically infect machines with unpatched versions of Outlook Express, and has the ability to automatically close all commonly used virus scanners whenever you try to run them. Based on the massive flood of this virus we've seen today it looks like a Klez killer has arrived..... (its outnumbering Klez by about 16 to 1 in our stats today) More info: http://securityresponse.symantec.com/avcenter/venc/data/w32.bugbear(a)mm.ht… Regards, Simon Byrnand iGRIN Internet - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: domain renewal fee
by Donald Neal 24 Sep '02

24 Sep '02

> From: Andy Gardner [mailto:andy(a)navigator.co.nz] > Sent: Wednesday, 25 September 2002 08:59 > To: nznog(a)list.waikato.ac.nz > Subject: RE: domain renewal fee > > > At 8:52 AM +1200 9/25/02, Donald Neal wrote: > >Discussion of the value of InternetNZ's involvement with > ICANN looks to me > >to be way outside that policy. > > Not when you consider that ICANN is attempting to dictate > policy to APNIC. Discussion of APNIC: In Discussion of InternetNZ's air fares/hotel bills: Out - Donald Neal ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------ - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: domain renewal fee
by Donald Neal 24 Sep '02

24 Sep '02

> From: Juha Saarinen [mailto:juha(a)saarinen.org] > Sent: Wednesday, 25 September 2002 08:47 > To: DPF > Cc: nznog(a)list.waikato.ac.nz > Subject: Re: domain renewal fee [...] > > Hummm... $73,423 is the actual figure, so each meeting costs just over > $18,000, or $9,000 per person. > > Are the meetings worth that kind of expenditure? Could subscribers please remember that the AUP for this list reads in part: 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. ... 7. Postings of a political, philosophical or legal nature are discouraged. Discussion of the value of InternetNZ's involvement with ICANN looks to me to be way outside that policy. I believe any operational content of this thread has now been exhausted. - Donald Neal ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------ - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Re: domain renewal fee
by Juha Saarinen 24 Sep '02

24 Sep '02

On Tue, 24 Sep 2002, Keith Davidson wrote: > While I assume this was a little tongue in cheek, it should be noted > that the amount spent by InternetNZ on ICANN travel is less than 50 > cents per domain name per year. Oh no... you mean the rest ($91.50) is blown on gerbil-fuelled orgies and Bonzai Buddy licenses? No wonder .nz names are so expensive! ;-) -- Juha Saarinen - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

Re: domain renewal fee
by David Farrar 24 Sep '02

24 Sep '02

> On Tue, Sep 24, 2002 at 05:32:25AM +0000, David Farrar wrote: > > > Afternoon, > > > > > > Just wondering if anyone knows why the annual renewal fee has gone up > > > for .nz domains? Got a piece of a tree in the mail the other day > > > mentioning that renewals have gone up a few bucks a year. Granted other > > > costs have gone down, but for those who already have domains are going > > > to wear the punch. > > > > The issue is slightly complex. At present the .nz registry is with DOMAINZ and > > they have a range of fees depending if you are an accredited provider or if you > > register direct through their website. DOMAINZ is also the sole Registrar. > > > > I've heard the palava about the SRS coming online for a trial month, > then going live, however, where's the complexity which causes the > renewal fee to go up by 10 bucks a year? The renewal fee isn't going up by $10 a year. DOMAINZ at present charge what I would call a combined registry/registrar fee of $44 (or $74 for new customers) for those who register directly through them. Under the SRS the registry fee will be $24 and each registrar will charge their own registrar fee on top of that. DOMAINZ have signalled their prices and services, other registrars will vary no doubt. The idea behind the SRS is that registrants will be able to choose the registrar which offers what they want - price will be a factor in this but so will other considerations such as service, billing terms, bundling of other services etc. >I could justify keeping a couple of lines in a text file for a year for a few >hot breakfasts, but not the increase the fee's gone up to. You are right that the variable cost of registering a domain name is very low. There have been significant costs involved in setting up the SRS, consultation on business and technical rules etc and that is why the registry fee has been set at $2/month to cover depreciation etc. A major cost is actually paying for DNS Name Server Operations incidentially. I personally hope that after a short while this fee will track downwards once costs of running the new registry are known as opposed to projections. DPF - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

10 11

RE: domain renewal fee
by Steven Heath 24 Sep '02

24 Sep '02

On 24 Sep 2002, at 22:04, John Rothlisberger wrote: > Steven Heath wrote: > > >Street price is about $40 in NZ... street price for a .com is about > >$15 US... I dont really see a great deal of price difference. > > You obviously haven't heard of GoDaddy (http://registrar.godaddy.com/) > - USD$8.95 for a .com, .net or .org domain. Go daddy, go! Actually I have and also at least one .nz provider selling at $29.95 NZ. I was just using 'street price' which is $40 NZ or $15 US for .com. The wholesale .com cost is $6.. godaddy sells for $2.95 higher than their buy cost. Cant see that going in long term. SPH - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Re: domain renewal fee
by Andy Linton 23 Sep '02

23 Sep '02

On Tue, 24 Sep 2002, Keith Davidson wrote: > I'd wait anyway, until after the SRS rolls out - and see what kind of deal > you could strike with a Registrar. Yes, that's fine but this year I've just had to renew my registration with the incumbent and I'm kind of stuck with that until August next year. andy - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: domain renewal fee
by Juha Saarinen 23 Sep '02

23 Sep '02

On Tue, 24 Sep 2002, Keith Davidson wrote: > You pay $92 per domain name? I can cut you a deal for a 20% discount for > you if you want to swap name agents?? No, I can't afford .nz names being a broke and unbribed hack. Current Fees($NZ) New Domain Name Fee $44 New Nameholder Fee $30 New Secondary DNS Fee $18 Exclusive of GST Too expensive by the looks of it. > InternetNZ does not use Bonzai Buddy as the purple clashes with the > office decor. > > The orgies continue unabated of course... OK, I've got first dibs on this story. All your gerbil multimedia is belong to me. -- Juha Saarinen - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 2

Re: domain renewal fee
by David Farrar 23 Sep '02

23 Sep '02

> Afternoon, > > Just wondering if anyone knows why the annual renewal fee has gone up > for .nz domains? Got a piece of a tree in the mail the other day > mentioning that renewals have gone up a few bucks a year. Granted other > costs have gone down, but for those who already have domains are going > to wear the punch. The issue is slightly complex. At present the .nz registry is with DOMAINZ and they have a range of fees depending if you are an accredited provider or if you register direct through their website. DOMAINZ is also the sole Registrar. InternetNZ is 90% through implementing a shared registry system which will go live later this year. Only Registrars will be able to access the registry and there will be a standard fee of $2+GST per month per name. DOMAINZ will continue as a registrar offering registration services. From late this year there will also be other competing registrars whom you can choose to register through, if you so wish. There will no doubt be a variety of prices charged, lenths of terms available and other choices such as bundling of services etc. DPF - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

domain renewal fee
by Chris Hellberg 23 Sep '02

23 Sep '02

Afternoon, Just wondering if anyone knows why the annual renewal fee has gone up for .nz domains? Got a piece of a tree in the mail the other day mentioning that renewals have gone up a few bucks a year. Granted other costs have gone down, but for those who already have domains are going to wear the punch. Cheers, Chris - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

newzealand.com UDRP attempt coming up!
by Andy Gardner 23 Sep '02

23 Sep '02

http://arbiter.wipo.int/domains/cases/2002/d0600-0799.html Check out case D2002-0754 newzealand.com We're not told who is attempting to get the name. They keep all the case details secret until the decision is made, and then you only get to see what the "arbitor" decides you NEED to see. Perhaps a journalist here might like to contact the current name holder and ask him? It would be interesting to find out exactly who thinks they have enough rights over the term "New Zealand" to be allowed to wrestle it out of someone elses hands via the UDRP. Once they've got newzealand.com I guess nz.com will be their next target. -- Andrew P. Gardner barcelona.com stolen, stmoritz.com stays. What's uniform about the UDRP? We could ask ICANN to send WIPO a clue, but do they have any to spare? Get active: http://www.tldlobby.com - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 2

NZNOG conference 2003
by Chris Hellberg 17 Sep '02

17 Sep '02

Roger, I've lost the origional email about the conference, but what I'd like to see next year is someone involved from the early days of the NZ interweb. Somone who flicked the switch on the 4K8 link to NZ, or who ran the origional NZ DNS or similar would be interesting - grey hair types preferred ;) Cheers, Chris - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

11 17

Mail blip today?
by Simon Lyall 16 Sep '02

16 Sep '02

Did anybody else see a big jump in mail volume (as in bits/second) between 4pm and 5pm today? I think it was a combination of mailouts by travel.co.nz's (90-something kilobytes) and finewineonline.co.nz (1.6 Meg of "I accidentally included our logo" ) but it might be something else I missed that was affecting only us. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: NZNOG conference 2003
by Frank March 16 Sep '02

16 Sep '02

> -----Original Message----- > From: Don Stokes [SMTP:don(a)daedalus.co.nz] > Sent: Tuesday, 17 September 2002 16:41 > To: nznog(a)list.waikato.ac.nz > Subject: Re: NZNOG conference 2003 > > Some of the ex-DSIR people might be fun to have along -- these folks > were doing serious vendor-independent networking back when nobody much > else knew what it was, and developed the Ace/Network Dynamics/Securicor > 3net/Allied Telesyn routers which many ISPs used for many years. > The key guy at Allied Telesyn is the General Manager, Geoff Peck. He was deeply involved in all of the above which evolved out of the DSIR National Computer Network developments in the late 70s. Frank March Specialist Advisor, IT Policy Group Ministry of Economic Development, PO Box 1473, Wellington, NZ Ph: (+64 4) 474 2908; Fax: (+64 4) 471 2658 Any opinions expressed in this message are not necessarily those of the Ministry of Economic Development. This message and any files transmitted with it are confidential and solely for the use of the intended recipient. If you are not the intended recipient or the person responsible for delivery to the intended recipient, be advised that you have received this message in error and that any use is strictly prohibited. Please contact the sender and delete the message and any attachment from your computer. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Peering at APE
by Craig Whitmore 15 Sep '02

15 Sep '02

Can people peering with Orcon Internet (AS17746 192.203.154.66) at APE, please peer with 192.203.154.67 as well with the same prefix-list as the 1st. Also if you wish to MSDP and/or MBGP peer please let me know. Please let me know when/if you have set this up. Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: BGP Private ASes
by Andy Linton 12 Sep '02

12 Sep '02

I'm pleased to see this thread generate lots of discussion and I've thought some more about my position on this. I think the community should look at a number of things: 1) I think from postings from Philip Smith, Joe Abley, myself (and others) it's clear there is a mechanism for applying for globally unique ASNs and it is possible to get them assigned where need can be demonstrated. There may be an additional cost associated with this. Clearly such an ASN can be used anywhere on the net including Citylink or the APE. This should be the preferred option for anyone who wants to peer in whatever form with more than one other entity. Private ASNs should be reserved for use between two entities. This may well cover Simon's WIX route reflectors. Perhaps ISPs, telcos, and other organisations like Citylink should create mechanisms (if they don't already have them) to enable their customers to obtain ASN numbers from APNIC where those customers need an ASN. (My cynical mind makes me suspect that there may be some resistance to this as it may be perceived that customers are using this to avoid charging, connect to another provider etc. Please prove me wrong! Public declarations on this list might help.) 2) Additionally there is a mechanisms also identified in previous postings for obtaining IPv4 address space for multihoming. Explore those mechanisms if you *need* address space. 3) It would be good if we could work together to make the WIX model work efficiently. Some larger providers might wish that there were only larger providers peering at the WIX. That clearly isn't the case so it would be good to see them sit down with Simon Blake and work out how to get efficient and redundant peering working. 4) Ditto the APE. 5) If people want address the related but separate problem of using RPSL and the routing registry mechanism to express their public policy (and automatic generation of filter lists etc) then start trying to understand policy in terms of the provisions of RFC2622 and RFC2650. I'm happy to work on this with people when I get back to NZ in November. Others have said the same but I'll let them put their hands up. If you intend to do this please strongly consider using the APNIC service coming shortly. I posted yesterday that the service was hosted in Brisbane and mirrored at RIPE. They are also investigating the deployment of redundant services using anycast on four separate continents. How redundant do you need the service to be? andy - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0