1. WARNING!
------=_NextPart_000_000E_01BDF06E.FB78AAE0
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
That last program Nate sent, "snake.exe", will delete all Windows files =
on your computer.
DO NOT RUN THIS FILE!
Hopefully other Euphorians are smarter than me, and have already ignored =
the file.
-molasses
PS Now can we throw him off?
------=_NextPart_000_000E_01BDF06E.FB78AAE0
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD W3 HTML//EN">
<HTML>
<HEAD>
<META content=3Dtext/html;charset=3Diso-8859-1 =
http-equiv=3DContent-Type>
<META content=3D'"MSHTML 4.72.2106.6"' name=3DGENERATOR>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT color=3D#000000 size=3D2>That last program Nate sent,=20
"snake.exe", will delete all Windows files on your=20
computer.</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2>DO NOT RUN THIS FILE!</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2>Hopefully other Euphorians are =
smarter than me,=20
and have already ignored the file.</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2>-molasses</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2>PS Now can we throw him=20
------=_NextPart_000_000E_01BDF06E.FB78AAE0--
2. Re: WARNING!
------=_NextPart_000_0029_01BDEFFE.AE0C1140
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
molasses wrote:
> That last program Nate sent, "snake.exe", will delete all Windows=20
> files on your computer.=20
> DO NOT RUN THIS FILE!=20
=20
I'm sorry that Nate's actions have reached this level.
We might be able to ban his e-mail address from the list, but=20
I'm sure he'd get a free e-mail address from somewhere
and come back in disguise.
=20
If anyone wants to take legal action against Nate (i.e. his
parents), let me know. He apparently lives in the
same province of Canada as me, and there are very
few Brooman's in the phone book.
Regards,
Rob Craig
Rapid Deployment Software
http://members.aol.com/FilesEu/=20
=20
------=_NextPart_000_0029_01BDEFFE.AE0C1140
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD W3 HTML//EN">
<HTML>
<HEAD>
<META content=3Dtext/html;charset=3Diso-8859-1 =
http-equiv=3DContent-Type><!DOCTYPE HTML PUBLIC "-//W3C//DTD W3 =
HTML//EN">
<META content=3D'"MSHTML 4.71.1712.3"' name=3DGENERATOR>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT><FONT size=3D3>molasses<FONT =
color=3D#000000>=20
wrote:</FONT></FONT></DIV>
<DIV><FONT color=3D#000000><FONT size=3D3>> That last program Nate =
sent,=20
"snake.exe", will delete all Windows </FONT></FONT></DIV>
<DIV><FONT color=3D#000000><FONT size=3D3>> files on your=20
computer.</FONT></FONT><FONT size=3D3></FONT> </DIV>
<DIV><FONT color=3D#000000><FONT size=3D3>> DO NOT RUN THIS=20
FILE!</FONT></FONT><FONT size=3D3></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV></DIV>
<DIV><FONT color=3D#000000><FONT size=3D3></FONT></FONT><FONT =
color=3D#000000><FONT=20
size=3D3>I'm sorry that Nate's actions have reached this=20
level.</FONT></FONT></DIV>
<DIV><FONT color=3D#000000><FONT size=3D3></FONT></FONT>We might be able =
to ban his=20
e-mail address from the list, but </DIV>
<DIV>I'm sure he'd get a free e-mail address from somewhere</DIV>
<DIV>and come back in disguise.</DIV>
<DIV><FONT color=3D#000000><FONT size=3D3></FONT></FONT><FONT=20
size=3D3></FONT> </DIV>
<DIV>If anyone wants to take legal action against Nate (i.e. his</DIV>
<DIV>parents), let me know. He apparently lives in the</DIV>
<DIV>same province of Canada as me, and there are very</DIV>
<DIV>few Brooman's in the phone book.</DIV>
<DIV> </DIV>
<DIV><FONT color=3D#000000><FONT =
size=3D3>Regards,<BR> Rob=20
Craig<BR> Rapid Deployment=20
Software<BR> <A=20
/A></FONT></FONT><FONT=20
size=3D3></FONT> </DIV>
------=_NextPart_000_0029_01BDEFFE.AE0C1140--
3. Re: WARNING!
Hey, it only ran for a sec before i stopped it...i haven't shut my
computer off yet--should i reinstall windows or what?
snortboy
Molasses wrote:
>
>
> That last program Nate sent, "snake.exe", will delete all Windows
> files on your computer.DO NOT RUN THIS FILE! Hopefully other
> Euphorians are smarter than me, and have already ignored the
> file. -molasses PS Now can we throw him off?
4. Re: WARNING!
- Posted by Hawke <mdeland at NWINFO.NET>
Oct 04, 1998
-
Last edited Oct 05, 1998
> Robert Craig wrote:
> I'm sure he'd get a free e-mail address from somewhere
> and come back in disguise.
if he hasn't already...
>If anyone wants to take legal action against
>Nate (i.e. his parents), let me know.
IMHO, at the very _least_, his parents should be informed.
this might convince his parents to remove his net
access from their end, thereby solving the above issue.
to those that have had files deleted by this program:
first:make a backup of all other files that contain
data of 'worth'. anything with personal data,
emails you want saved, address books, bookmarks,
financial info, resume info, anything that has
worth to you. get it safe.
second:if it deleted any windows files, you can safely
reinstall windows from the setup disk, provided:
1> you haven't installed ie4. to my recollection,
there is an issue there. only a complete windows
removal before reinstall can deal with it.
2>you are not running custom shells and wotnot.
now, when i say reinstall here, i do not mean delete
everything and reinstall. that is a removal/reinstall.
that is different. you can simply run setup from the win9x
disk and windows will ask you questions, tell it that
you want to search for hardware yourself, and you want
a custom install. pick the hardware devices on the
next screen that closely matches your system. under
the custom settings, go thru each one, clicking additional
info/settings for each and selecting the ones you like.
this is the tricky part, because if you do not select
something that you actually do have, setup in it's
infinite wisdom will _uninstall_ that unselected item.
take your time here... if you use outlook/microsoft mail,
or any faxing from your machine, make sure you get
those _selected_ in the setup. "i already have that,
so i don't need to reinstall it" NO!... that is not
how to think of this... ok? :) "i have that so i need
to make sure it's selected" yes, that is how to think
about this...
third: try to do this *BEFORE* (as someone was asking) you reboot!!!
we know that many of you may have problems from this point,
getting&sending email... if you post twice by accident, we
will only lynch you, not shoot you, but just for this week :)
if i can help, i'm here... least for a bit... --Hawke'
5. Re: WARNING!
Gentlemen:
In order to avoid situations like the one generated by Nate, I'd like to
propose to take some preventive actions:
1. Never publish executable files in this list .
2. Send all the code through Robert, and share it via the Web page.
Regards,
Jesús Consuegra
6. Re: WARNING!
Robert said:
> I'm sorry that Nate's actions have reached this level.
> We might be able to ban his e-mail address from the list, but=20
> I'm sure he'd get a free e-mail address from somewhere
> and come back in disguise.
> =20
> If anyone wants to take legal action against Nate (i.e. his
> parents), let me know. He apparently lives in the
> same province of Canada as me, and there are very
> few Brooman's in the phone book.
Boy - what a rat!
I'd looked at his picture, and almost ran the snake program. I was
stopped, at the last instant, but recalling that there were a bunch of
messages with warnings about that program, and decided to read those
messages first - I'm sure glad that I did, since I do my internet
stuff at work and Nate's trojan horse would have done a lot of damage.
Thanks for the warnings!
I made a quick web search and found that Nate has a pile of
web-sites, and that his parents are on the net too, I think.
This is a comment on his website's guest page from his Mom perhaps?
Carol Brooman - 01/12/98 17:50:42
My Email:brooman at headwaters.com
Comments:
Done your homework yet Nate?
This looks like Dad.
David J. Brooman, B.A., B.TH., A.C.C.A., C.A.
Chartered Accounant
Box 121
Markdale, Ontario, NOC 1HO
Canada
Tel: 1-800-759-0095
Fax: (519)986-2488
E-Mail: brooman at bmts.com
http://homepage.usr.com/d/daverex/
Here is one of his web-sites:
http://www.angelfire.com/ny/brooman/
and another
and here's the address of a site for a "computer company" that he's
running: http://nateb.hypermart.net/
7. Re: WARNING!
Has any1 got an undelete program that works on a FAT32 fileing system.
--PatRat (Thomas Parslow)
-- ()___()
-- (o o)
-- =\O/=
-- Rat Software
-- http://www3.mistral.co.uk/billparsl/
-----Original Message-----
From: Noah Smith <nhs6080 at UNIX.TAMU.EDU>
To: EUPHORIA at cwisserver1.mcs.muohio.edu
<EUPHORIA at cwisserver1.mcs.muohio.edu>
Date: 05 October 1998 06:25
Subject: Re: WARNING!
>Hey, it only ran for a sec before i stopped it...i haven't shut my
>computer off yet--should i reinstall windows or what?
>
>snortboy
>Molasses wrote:
>
>
>>
>>
>> That last program Nate sent, "snake.exe", will delete all Windows
>> files on your computer.DO NOT RUN THIS FILE! Hopefully other
>> Euphorians are smarter than me, and have already ignored the
>> file. -molasses PS Now can we throw him off?
8. Re: WARNING!
Quick answer: Don't turn off your computer.
___________________________
When it comes to programming languages, Euphoria is a cut above -
matt1278 at juno.com and matt1421 at juno.com Euphoria programmer
Webbers: <A HREF="mailto:prezsoft at juno.com">prezsoft at juno.com</A>,
president of SoftCo.
Fluent in HTML, yet no internet. Knows DEBUG ASM.
___________________________________________________________________
You don't need to buy Internet access to use free Internet e-mail.
Get completely free e-mail from Juno at http://www.juno.com
Or call Juno at (800) 654-JUNO [654-5866]
9. Re: WARNING!
Undelete doesn't undelete what deltree demolished.
___________________________
When it comes to programming languages, Euphoria is a cut above -
matt1278 at juno.com and matt1421 at juno.com Euphoria programmer
Webbers: <A HREF="mailto:prezsoft at juno.com">prezsoft at juno.com</A>,
president of SoftCo.
Fluent in HTML, yet no internet. Knows DEBUG ASM.
___________________________________________________________________
You don't need to buy Internet access to use free Internet e-mail.
Get completely free e-mail from Juno at http://www.juno.com
Or call Juno at (800) 654-JUNO [654-5866]
10. Re: WARNING!
his virus can kill your DOS system ***INSTANTLY***, from what i heard. If
it deletes IO.SYS and MSDOS.SYS, then you lose all communication with
your computer, and youre computer loses all commication to you. And
MSDOS.SYS is one of the most important parts of your PC!
___________________________
When it comes to programming languages, Euphoria is a cut above -
matt1278 at juno.com and matt1421 at juno.com Euphoria programmer
Webbers: <A HREF="mailto:prezsoft at juno.com">prezsoft at juno.com</A>,
president of SoftCo.
Fluent in HTML, yet no internet. Knows DEBUG ASM.
___________________________________________________________________
You don't need to buy Internet access to use free Internet e-mail.
Get completely free e-mail from Juno at http://www.juno.com
Or call Juno at (800) 654-JUNO [654-5866]
11. Re: WARNING!
Stop making this a bigger deal than it is.
Computers are like cars, if you dont know how to use them, you shouldnt be
using them.
And Matt, dont say things that arent true. 1) It is not a virus.. 2) You do
not loose 'communication with your computer' .. you still have a full
functional BIOS, HD and OS, you're just missing some boot files. Big deal.
So, lets fix those PC's now.. you needed to install windows (and thus all
windows-programs!) Esspecially those who have only run it for a second. No
file that was currently in use by the system, could in any way be delete
(you would get an "file share error" or "disk acces violation") .. so you're
system (except the low-level boot files!) will start up as normal anyways.
Get your Windows start-up disk and type the following:
[ If you dont made a start-up disk (dumb!) then can get your CD-Rom disk (to
install win95/98) and press Shift-F8 when it boots up).. type: "path
C:\WINDOWS\COMMAND" ]
-- Part 1) Restoring DOS (win95/98 boot files as well)
a:\
attrib -h -r -s *.*
copy *.sys c:\
c:\
attrib +h +r +s *.sys
-- Part 2) Restoring crucial windows system files
copy c:\windows\backup c:\windows\system
-- Part 3) Restoring general purpose DLL's
First try out your programs, maybe it only deleted redunant DLL's.
If one or programs dont work due to one or two missing DLL's write down
their names, and either 1) email it to me: I'll be happy to send you those
files, If I do have them or you can 2) use ftpsearch or www.filez.com and
try to find the file on the net.
However if you are missing multiple files, and have a hard time finding
them. Perform the following steps: (you need a lot of HD for this)
1) pkzip inifiles.zip c:\windows\*.ini
2) pkzip progs.zip c:\progra~1\ -d -r
3) pkzip regs.zip c:\windows\system.dat c:\windows\user.dat
-Restart the system-
!! Re-install all the non-functioning software !!
And go to a clean DOS mode again (ie. through startup-disk or F8-Command
Prompt Only)
1) pkunzip inifiles c:\windows\
2) pkunzip progs.zip c:\progra~1\ -d
3) attrib -h -r -s c:\windows\user.dat c:\windows\system.dat
4) pkunzip regs.zip c:\windows\
5) attrib +h +r +s c:\windows\user.dat c:\windows\system.dat
-- This is a clean and working approuch. It will (when you have enough HD
space) be garanteed to work.
>his virus can kill your DOS system ***INSTANTLY***, from what i heard. If
>it deletes IO.SYS and MSDOS.SYS, then you lose all communication with
>your computer, and youre computer loses all commication to you. And
>MSDOS.SYS is one of the most important parts of your PC!
Important..? Matt dont say things you know nothing about.
A few hundred k's defining the code behind the interrupts virtually freely
available everywhere. Just copy them back to the system.
For any questions, problems, I'll be happy to help:
Ralf
nieuwen at xs4all.nl
12. Re: WARNING!
-----Mensaje original-----
De: Robert Craig <rds at EMAIL.MSN.COM>
Para: EUPHORIA at cwisserver1.mcs.muohio.edu
<EUPHORIA at cwisserver1.mcs.muohio.edu>
Fecha: Lunes, 05 de Octubre de 1998 02:25 a.m.
Asunto: Re: WARNING!
molasses wrote:
> That last program Nate sent, "snake.exe", will delete all Windows
> files on your computer.
> DO NOT RUN THIS FILE!
I'm sorry that Nate's actions have reached this level.
We might be able to ban his e-mail address from the list, but
I'm sure he'd get a free e-mail address from somewhere
and come back in disguise.
If anyone wants to take legal action against Nate (i.e. his
parents), let me know. He apparently lives in the
same province of Canada as me, and there are very
few Brooman's in the phone book.
Can you please call them (Chile is a bit far from Canada) and tell them
what their &%$·!!" son has done? And tell them to don't ever come with
him to Chile... I'l be waiting at the airport!
I really don't care if he's 12 or 70... he's just a big pain in the ass.
Regards,
Daniel Berstein
daber at pair.com
13. Re: WARNING!
Nate's personal :
(taken from http://www.broomancomp.home.ml.org/ )
Markdale, Ontario OFFICE
81 Grayview Drive
Markdale, Ontario, NOC 1HO
CANADA
Telephone: (519) 986-2601
Fax: (519) 986-2488
E-Mail: nateb at log.on.ca
If someone lives near... please kick him hard!
.
BTW from http://www.log.on.ca/users/nateb/ you can see he's a stupid
Nazi too.
14. Re: WARNING!
This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.
------_=_NextPart_001_01BDF091.538BCEFC
charset="iso-8859-1"
Robert wrote:
> I'm sorry that Nate's actions have reached this level.
> We might be able to ban his e-mail address from the list, but
> I'm sure he'd get a free e-mail address from somewhere
> and come back in disguise.
Nate designs a program to DESTROY EVERYTHING on our computers and mails it
out to us, sticking around to see the result. How do we respond to this
attack?
"Someone should tell his parents."
Give me a break. We haven't even heard from the poor folk who actually lost
EVERYTHING on their machines yet. They probably are still wondering how to
rebuild their machines.
> If anyone wants to take legal action against Nate
> (i.e. his parents), let me know. He apparently lives
> in the same province of Canada as me, and there are
> very few Brooman's in the phone book.
Sign me up. Take the maximum legal action against him.
-- David Cuny
------_=_NextPart_001_01BDF091.538BCEFC
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Diso-8859-1">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
5.5.2232.0">
<TITLE>RE: WARNING!</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=3D2>Robert wrote:</FONT>
</P>
<P><FONT SIZE=3D2>> I'm sorry that Nate's actions have reached this =
level.</FONT>
<BR><FONT SIZE=3D2>> We might be able to ban his e-mail address from =
the list, but </FONT>
<BR><FONT SIZE=3D2>> I'm sure he'd get a free e-mail address from =
somewhere</FONT>
<BR><FONT SIZE=3D2>> and come back in disguise.</FONT>
</P>
<P><FONT SIZE=3D2>Nate designs a program to DESTROY EVERYTHING on our =
computers and mails it out to us, sticking around to see the result. =
How do we respond to this attack?</FONT></P>
<P><FONT SIZE=3D2>"Someone should tell his parents."</FONT>
</P>
<P><FONT SIZE=3D2>Give me a break. We haven't even heard from the poor =
folk who actually lost EVERYTHING on their machines yet. They probably =
are still wondering how to rebuild their machines.</FONT></P>
<P><FONT SIZE=3D2>> If anyone wants to take legal action against =
Nate </FONT>
<BR><FONT SIZE=3D2>> (i.e. his parents), let me know. He apparently =
lives </FONT>
<BR><FONT SIZE=3D2>> in the same province of Canada as me, and there =
are </FONT>
<BR><FONT SIZE=3D2>> very few Brooman's in the phone book.</FONT>
</P>
<P><FONT SIZE=3D2>Sign me up. Take the maximum legal action against =
him.</FONT>
</P>
<P><FONT SIZE=3D2>-- David Cuny</FONT>
</P>
</HTML>
------_=_NextPart_001_01BDF091.538BCEFC--
15. Re: WARNING!
Guys, looking at Nate's various pages, I gained a sneaking suspicion
we are not dealing with a 12 year old at all, more likely a warped
young adult. Now he is even feeding us some names and addresses, but I
would not trust a single word the creep has ever uttered. Be careful.
jiri
16. Re: WARNING!
> Hey, it only ran for a sec before i stopped it...i haven't shut my
> computer off yet--should i reinstall windows or what?
> > That last program Nate sent, "snake.exe", will delete all Windows
> > files on your computer.DO NOT RUN THIS FILE! Hopefully other
> > Euphorians are smarter than me, and have already ignored the
> > file. -molasses PS Now can we throw him off?
I hope this gets to you in time. No, you MAY not have to reinstall
Windows. First, see if you still have the MSDOS.SYS and IO.SYS and such
files because it also kills them (sometimes?) apparently. Be aware you
may have to tell Windoze to let you see hidden files for this. If you
DO have them, you might be alright. It would be time to make an orderly
backup of any programs you've installed, the system directory and a few
other dirs - anything under windows that you need, really. Remember if
you have win95, you need to back up your registry too for this. Then
you can re-install Win and do a restore. If you DO NOT have the files
in your root dir, then all might still not be lost if you have any
system disk. Simply booting from it then using a sys command MAY work.
Once again, though, after that, it's time to re-do windoze. It may not
prove to be necessary, but it's probably a good idea. Hope this helps
you.
\/\/ood/\/\age (somebody who's good enough at killing his computer that
he's gotten good at fixing it by accident)
17. Re: WARNING!
Now, my complete system is down. I had the SNAKE.EXE program run freely, bec=
ause I got distracted away from the PC when I started it up, and when I came=
back bad stuff had happened. Does this mean I've lost everything? If so, I =
have this system recovery CD, but it will format my HD and make the PC look =
like it did from the retailer. Is it possible to get back what I've lost (pr=
obably everything)? I write from work now, I do not have access (to anything=
) at home, so to get in touch write me at
euarchive at hotmail.com
Yes, I know. I'm a stupid $=A3!#, but us norwegians tend to be naive. The wo=
rst part is that I've maybe lost all my programming.
Einar
18. Re: WARNING!
>Now, my complete system is down. I had the SNAKE.EXE program run
>freely, because I got distracted away from the PC when I started it up,
>and when I came back bad stuff had happened. Does this mean I've
>lost verything? If so, I have this system recovery CD, but it will
format
>my HD and make the PC look like it did from the retailer. Is it possible
>to get back what I've lost (probably everything)? I write from work now,
>I do not have access (to anything) at home, so to get in touch write me
>at
>
>euarchive at hotmail.com
>
>Yes, I know. I'm a stupid $=A3!#, but us norwegians tend to be naive.
>The worst part is that I've maybe lost all my programming.
Okay, good news: It shouldn't be too hard to get your source code back.
Bad news: Binary files are a lot tougher.
Here's my theory (not tested, but should work):
What you need to know, is that the only thing that anything happened to
is the FAT. The files still exist, but they are overwritten as soon as
new data comes to replace it. You need a hard disk viewer program, so you
can look at the contents of the hard drive directly. (I think one come's
with the Norton tools stuff.)
If you can download or get a hard drive veiwer, try to not put anything
on your home computer. You may overwrite something important. (Like
Hayes! 
Chances are, though, that what will be overwritten is some
data file from somewhere else, but why chance it? You'll either want to
put the veiwer on a DOS boot disk, or get another hard drive (borrow a
friend's or find a real cheap and small one from somewhere) and boot it
as master and slave your nuked disk to it.
Using the veiwer, run a search or something for certain Euphoric text.
(Look for comments or lines of code you remember) This will take a while,
but you should be able restore files as you find the information. Once
you have restored all the important text files you can find (you probably
won't be able to find binarys very well, so they are gone), you can
install software again.
You could probably install DOS or something without risking too much
code, if you have to.
Hope this helps. I've sent this to the list so hopefully others can try
the same thing. (Remember: These veiwers only work (for creating files)
with Win95 unloaded and having run the LOCK command to allow direct disk
access.)
___________________________________________________________________
You don't need to buy Internet access to use free Internet e-mail.
Get completely free e-mail from Juno at http://www.juno.com
or call Juno at (800) 654-JUNO [654-5866]
19. Re: WARNING!
- Posted by Matt Z Nunyabidness <matt1278 at JUNO.COM>
Oct 08, 1998
-
Last edited Oct 09, 1998
he won't be writing back...someone informed his parents and killed him
_________________
When it comes to programming languages, Euphoria is a cut above
matt1278 at juno.com Euphoria programmer
Webbers: <A HREF="mailto:prezsoft at juno.com">prezsoft at juno.com</A>,
president of SoftCo. All virus proggers should die horrible deaths™
___________________________________________________________________
You don't need to buy Internet access to use free Internet e-mail.
Get completely free e-mail from Juno at http://www.juno.com
or call Juno at (800) 654-JUNO [654-5866]
