- NZNOG - lists.nznog.org

w95.fix2001 worm infection os doing the rounds...
by Chris Wedgwood 27 Jan '00

27 Jan '00

I couldn't really think of a better place to send this... A couple of days ago we noticed some of our customers seem to have been infected by the w95.fix2001 worm. In brief, this is a small windows executable that infects '95 and '98 machines when run (yes, some people do run executables without checking...). It watches for outgoing email and send copies of itself to the addresses it sees there from <admin__(a)local.domain> with a message-id of <Fix2001(a)microsoft.com>; under some circumstances it will replace command.com with malicious code that will toast the hard-disk when next booted. Note, this is not a new worm, most anti-virus vendors should have been able to detect this since mid-September 1999, but obviously, not everyone runs AV software. For more details, please see: http://www.symantec.com/avcenter/venc/data/w95.fix2001.html Now, as I mentioned, it has been doing the rounds -- grep you maillogs for (or the message ID) admin__ and you should see it if it has come you way, certainly before we put a `block' in (see below) I saw a number of incoming messages to our customers and several outgoing to people at other NZ ISPs. Blocking this is pretty easy if you assume nobody actually uses admin__(a)some.domain as an email address, below is what our sendmail guru Olof <oolsson(a)clear.co.nz> did here to block it, which is working very well -- I hope this is of some use to someone. ###################################################################### # CLEAR Net CHECK_MAIL rule set ###################################################################### Scheck_mail # Canonify R$* $: $>3 $1 # Temporary fix to stop w95.fix2001 (remove this one at some stage) R admin__ <@ $* > $* $#error $@ 5.7.1 $: "Mail refused due to worm infection; refer to http://www.symantec.com/avcenter/venc/data/w95.fix2001.html" -cw -- Chris Wedgwood chris.wedgwood(a)clear.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

[announcement] NZ-REGISTRARS project
by Joe Abley 25 Jan '00

25 Jan '00

Warning: of only tangential operational significance http://www.patho.gen.nz/nz-registrars/ I am trying to coordinate some open discussion about an automated interface between registrar and registry, such as might be used by an ISP or web hosting company to manage new domain registration and domain deletion, and to manage modifications of the register. There are many different ways of doing this with gTLD and ccTLD registries at the moment, and no agreed standard approach. This project is an attempt to allow interested parties to build a specification for an interface that will meet their specific needs. This project is not endorsed by ISOCNZ or Domainz, although it is to be hoped that if we can reach good agreement within the industry about what our requirements are, ISOCNZ might listen. The NZ-REGISTRARS mailing list is a technical forum; the idea is to avoid politics and grandstanding as far as possible. The intent is to produce a comprehensive design, and stable, flexible running code, nothing more. A rapid summary of the potential features of the interface under discussion: + a strict XML representation for all transactions between registry and registrar + a choice of transport for exchanging transaction elements (e.g. e-mail, CORBA, DCOM, HTTP, whois) + batch and real-time transaction support + full version history/modification log for all records + strong authentication + compatability shims to allow transactions and query results to be accepted and presented in foreign formats, e.g. RIPE-181, NSI whois, NSI e-mail templates, Domainz whois, Domainz web-based query, Domainz e-mail channel template All are welcome. Details of the little bit of work done so far can be found at http://www.patho.gen.nz/nz-registrars/ Joe --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

.nz registry lame delegations
by 2Day Operations 17 Jan '00

17 Jan '00

Does anybody have any ideas on how to stop the .nz registry delegating names to ones name servers when they are not authoratative nor permission obtained for their use? This happens when they "reinstate" a domain after it has been suspended, usually for non payment of registration fees. I've tried asking them privately, but they dont seem to understand. It was not so much of an issue when it only happened once or twice a month, but it is far more regular now. regards Peter Mott Chief Enthusiast 2Day.com -/- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

8 12

RFC2142 support at Domainz
by Joe Abley 16 Jan '00

16 Jan '00

Absolutely my last word on this (I promise). This message does contain operational content. Patrick has confirmed by private mail that all the mailbox names specified in RFC 2142 are now supported by Domainz. Those operators who have expressed concern that the "4service" address and its friends give them the heebie-jeebies are free to use corresponding mailbox names from RFC 2142. Joe --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Just in case, I'm away next week
by Geoff Thompson 16 Jan '00

16 Jan '00

Hello All, Not that I'm expecting any problems next week, but just in case someone emails me directly, rather than using the official channels : I'm away next week (17 Jan till 21 Jan), so please use the official email addresses to get hold of someone that can help you. They are : 4service(a)domainz.net.nz soa(a)waikato.ac.nz Regards, Geoff Thompson. ---------------------------------- Geoff Thompson <geofft(a)waikato.ac.nz> University of Waikato, Hamilton, New Zealand Ph: (07) 838 4748 Random Quote of the Minute : And now for something completely the same. ---------------------------------- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

14 21

Re: Just in case, I'm away next week
by Lin Nah 14 Jan '00

14 Jan '00

I had to delurk for this... Standardisation of email addresses. One of the good reasons behind RFC2142 seems to have been lost here. With the standard mailboxes specified, it ensures that when I email those email addresses, I can expect the emails to land in the mailbox of the people who are in charge of that particular task. Patrick O'brien did a search of the database and came up with the "username" statistics. That is fine that they don't use the standard addressing as they are specifying their own. The idea behind the standardised mailboxes is that if all else fails emailing that particular username should work. For example if someone in that datbase was named as joe(a)domainname.co.nz had left and the domain name didn't update it. SHould I wish to contact the technical contact (who was joe(a)domainname.co.nz) and it bounced because joe had left, I can then send it to postmaster or one of the other admin addresses. I often have to contact administrators regarding abuse like spam, DOS attacks etc. As long as I know the domain name, I don't have to think about it. I should be sure that if I emailed abuse(a)domainame, the email will get to the person who handles it. Whether abuse is an actual mailbox or an alias that points to someone else's mailbox or a .forward in some account is immaterial to me. It becomes a problem is we have to contact a domain's administrative contact and the email to abuse@ (or postmaster@ or soa@ etc) bounces and we have no other means of finding out the email address since finger does not work, there is no whois available for that country (or gtld), or no website for that domain. Only avenue is to traceroute and contact their upstream provider hoping that they will be able to forward that. This is why if people do know about RFC2142 and do try to adhere to the compulsory bits of it, it would make life easier for everyone. So in the case of domainz, I don't mind the 4service as long as the equivalent required username is also available. just my 2b worth Lin ps Oscar Abley's webpage http://patho.gen.nz/~oscar --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

The Maori Net -- contact details?
by Chris Wedgwood 13 Jan '00

13 Jan '00

Does anyone know how to get hold of someone from The Maori Net? Preferably Kamera Raharaha, but I'll settle for anyone right now. I have an operational issue I want to talk to them about and their voice-mail is full... -cw -- Chris Wedgwood chris.wedgwood(a)clear.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

[m.arnott@domainz.net.nz: [NewZ-Flash] Pending Changes to Domainz Systems - Registrar Workshops]
by Joe Abley 13 Jan '00

13 Jan '00

FYI ----- Forwarded message from Maria Arnott <m.arnott(a)domainz.net.nz> ----- X-Authentication-Warning: titan.actrix.gen.nz: majordomo set sender to owner-newz-flash(a)list.actrix.gen.nz using -f From: Maria Arnott <m.arnott(a)domainz.net.nz> To: "'newz-flash(a)domainz.net.nz'" <newz-flash(a)domainz.net.nz> Subject: [NewZ-Flash] Pending Changes to Domainz Systems - Registrar Workshops Date: Fri, 14 Jan 2000 09:25:47 +1300 X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211 Precedence: bulk Dear list members, You are probably aware of the changes that are in the air for Domainz. Domainz is in the process of putting together workshops to brief Registrars on pending changes to Domainz' systems. Domainz is targeting Internet Service Providers and Webdesigners to enable them to understand and plan for changes to their systems when they interface with the new Domainz' registration system. The workshops will provide a briefing session giving an overview of the Systems Redevelopment including an application walk-through and familiarity session. Of particular importance to ISP's and Webdesigners will be how the changes may impact their systems for submission of requests to Domainz' registration service. We anticipate that the workshops will commence in early February. If you'd like to be kept informed or wish to express your interest in attending a workshop in your area, please email m.arnott(a)domainz.net.nz and in your subject header type 'Workshops'. My Regards, Maria Arnott Voice: 04 473 4567 Fax: 04 473 4569 email: m.arnott(a)domainz.net.nz web: www.domainz.net.nz - To unsubscribe to the newz-flash mailing list send a message to majordomo(a)domainz.net.nz with the keyword unsubscribe as the message plus the mailing list name. i.e.unsubscribe newz-flash ----- End forwarded message ----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

soa@waikato.ac.nz
by Patrick O'Brien 10 Jan '00

10 Jan '00

Peter, I've spoken with Waikato, who acknowledge receipt of one email to soa(a)waikato from you yesterday mid-morning. As I understand it that email was for information purposes only, and did not require an operational actions in the .nz Register. If the other e-mails that you say were sent to Waikato are to do with operations of the .nz Register, then can I ask that you forward them direct to me in this instance. Typically we would expect to see enquiries being sent to, 4service(a)domainz.net.nz If those other e-mails have nothing to do with the operations of the .nz Register, then I'll bow out and let you liaise with your normal contacts at Waikato. My regards, Patrick -----Original Message----- From: owner-nznog(a)list.waikato.ac.nz [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of 2Day Operations Sent: Tuesday, January 11, 2000 3:17 PM To: nznog(a)list.waikato.ac.nz Subject: soa(a)waikato.ac.nz Has anybody experienced any difficulty getting responses from above recently? We have sent a couple of messages to the address in the last week or so and dont appear to get an answer. When Rex was on board we got a reply within minutes on most days. Perhaps that alias is no longer monitored? regards Peter Mott Chief Enthusiast 2Day.com -/- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

soa@waikato.ac.nz
by 2Day Operations 10 Jan '00

10 Jan '00

Has anybody experienced any difficulty getting responses from above recently? We have sent a couple of messages to the address in the last week or so and dont appear to get an answer. When Rex was on board we got a reply within minutes on most days. Perhaps that alias is no longer monitored? regards Peter Mott Chief Enthusiast 2Day.com -/- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2