[Fwd: [Fwd: Net Alert: WinNuke]]

From: Dale M. Wheeler (dalemw@teleport.com)
Date: Thu Mar 19 1998 - 13:41:38 EST

Fellow Listmembers:

We have gotten a lot of hoaxes about viruses, etc...this one is not !!

My FTP server got "nuked" last night, as part of the nuking of all
the Multnomah machines over the past several days. Evidently, even if
you are online via dial up they can crash you through WinSock in
Win95. Here's the basic info and addresses...the page has more
info as well. I just downloaded and installed this on all of my
machines...I'd suggest you do likewise.

Forwarded message follows:

>H-Net normally discourages the dissemination of virus alerts, because
>in almost every case the supposed virus is a hoax or has already been
>thwarted by upgraded software and new antivirus programs. However, the
>Chronicle of Higher Education reports this week that attacks upon
>computers through the internet, so-called "WinNuking," have been
>occurring with increased frequency in the past months, and that news
>about a free patch protecting against win-nuking has not been widely
>disseminated to universities.
>These "attacks" are not viruses. Instead, they exploit a bug in
>Windows 95/NT's networking system by forcing a shutdown/reboot of the
>affected computer. The attacker sends a code to the host computer's IP
>address, (obtained in chat rooms, or through visits to web pages), that
>confuses Win95/NT and forces the shutdown. The attacks themselves do
>not erase data, but they do force the user to reboot (and therefore
>lose unsaved data) and disconnect from the network. Versions of the
>attacks have different names, such as "teardrop," "ping o'death," "land
>attack," etc., which operate on the same basic rationale and exploit
>the same flaw in the operating system.
>Microsoft has developed a Win95/NT fix for this bug, which can be
>downloaded free from Microsoft. A sensible, readable, explanation of
>the situation, along with instructions and direct download links to
>Microsoft to obtain patches for Win95 and versions of WinNT, can be
>found at:


>The patch itself is 968K. It will install quickly, and does fix the bug.
>Microsoft's security bulletin on the "teardrop" variant of the attack
>is at


>Subscribers interested in tracking virus hoaxes will find the Computer
>Virus Myths site useful:


>Dr. Peter Knupfer
>Associate Director
>H-Net: Humanities & Social Sciences Online
>Voice: 785-532-5824




Dale M. Wheeler, Ph.D.
Research Professor in Biblical Languages Multnomah Bible College
8435 NE Glisan Street Portland, OR 97220
Voice: 503-251-6416 FAX:503-254-1268 E-Mail: dalemw@teleport.com

This archive was generated by hypermail 2.1.4 : Sat Apr 20 2002 - 15:39:14 EDT