TIPS, TOOLS & FREQUENTLY ASKED QUESTIONS

Have you visited "What's on at Bilkent?" pages recently?

Need a virus scanner? You can dnload F-Prot V3.10 here
If Ver.3.10 has expired, check here for a newer version
Need a utility to UNZIP compressed files?
Any download problems with Netscape?
Need/Want to upgrade your Web browser?

Useful TCP/IP tools for Windows 95/98

Virus Alert! (29 Jan, 2002) *** MyParty Virus
A new mass mailing worm (virus), called "MyParty", is at large. It spreads by exploiting a security hole in Microsoft Outlook series mail clients. The virus spreads with attched executable files named www.myparty.yahoo.com. Infected message recipients think that this is a URL at yahoo.com and click the icon hoping that they will be directed to a web page with party photographs. Instead they see a black MS-DOS screen which quickly disappears after infecting the computer.

You can clean the MyParty virus using the cleanMP utility.

Virus Alert! (28 Nov, 2001) BadTrans Virus
A new mass mailing worm (virus), called "badtrans", is at large. It spreads by exploiting a security hole in Microsoft Outlook series mail clients. It is observed that infected computers reply to unread messages, also attaching itself to the message sent out. It also installs a remote access trojan software (also called back-door programs) which listens to your keystrokes and tries to capture the users' passwords.
If you've recently seen a message like "Install error!, File data corrupt, probably due to bad data transmssion" your computer is already infected.
Infected messages usually arrive with just "Re:" in their subject field. Even if you do not specifically open and run the attachment, most Outlook configurations will try to run the attached scripts when you click on the message line and render your computer infected.
To check whether your computer is infected please check whether you have any of the following files

1. C:\WINDOWS\INETD.EXE
2. C:\WINDOWS\SYSTEM\KERN32.EXE
3. C:\WINDOWS\SYSTEM\KERNEL32.EXE

1. Rename any of the above files to xxxx.XEX
2. Start the registry edit (Start-Run -> REGEDIT)
3. Find HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENT\VERSION\RUNONCE
4. Remove any entries mentioning the name(s) of above files.
5. Reboot your computer
6. Delete the renamed files if your compuer starts-up successfully.

Virus Alert! (19 Sep, 2001) *** NIMDA Virus
A new worm virus has been discovered (18th Sep 2001) which is spreading with remarkable speed. It is exploiting some security weaknesses in IIS Servers (a certain brand of web servers) and can infect computers which visit these infected sites!

This new virus has a payload that infects your computer's settings so that it starts sending out infected mail from your computer AND WORSE OF ALL, renders your disk drive contents accessible to others.

MS-IE users are all vulnerable if their security settings have not disabled "File Download" in the Internet Security section of "Internet Options".

If your C:\WINDOWS\\SYSTEM.INI file has a line
"Shell = explorer.exe load.exe -dontrunold
then your computer IS INFECTED. You should immediately shutdown or disconnect your network cable.

Another indication of an infected system is the existence of a file called "LOAD.EXE" in the C:\WINDOWS\SYSTEM directory.

The following program will detect and remove any NIMDA virus components from your computer:

Please contact BCC if your computer is infected.

Virus Alert! (24 Jul, 2001) W32.Sircam.Worm Virus
A new worm virus has started to circulate around the globe through electronic mail. This new virus has a payload that infects your computer's settings so that it starts sending out infected attachments. It is also reported that the virus occasionally removes files from infected computers. The virus is a real nuisance and must be cleaned as soon as possible.

If you have a file named "C:\recycled/sirc32.exe", then your computer is infected. Removing this file IS NOT sufficient for disinfection.

Click here to download FixSirc.com which will remove the virus from infected computers. If you have problems dnloading ad saving the COM file, please try this ZIPped version.

To clean the virus, please download and the save the FixSirc.com program to your Desktop and then run it by double clicking its icon. Then follow the instructions on the screen. The procedure is fully automatic and comprehensive.

Please click here for more information on the virus.

Virus Alert! (23 Jan, 2001) EMANUEL Virus
A new worm virus has started to circulate around the globe through electronic mail. This new virus has a payload that infects your computer's settings so that it prevents you running any EXE applications and sends itself to addresses in your MS-Outlook Address Books. Click here removal instructions.

Virus Alert! (3rd Nov, 2000) WORM_MTX Virus
A new worm virus has started to circulate around the globe through electronic mail. This new virus has a payload that infects your computer's network modules so that it sends itself to someone you send a real e-mail message. It is quite hard to get rid of this virus and the process usually ends up with reformatting your hard disk drive(s). Click here for more details.

Virus Alert! (26th Jun, 2000) LIFE STAGES Virus
A new worm virus has started to circulate around the globe through electronic mail. This new virus spreads by exploiting some features of MS-Outlook e-mail program (again). This virus does not cause a major harm, but spreads quite fast using the address books of Outlook and IRC programs. The virus usually arrives with a mail having an attached file called LIFE.STAGES.TXT.SHS.

Please note that it does not mean that your computer will not be infected if you are using mail programs other than MS Outlook. The main damage (as known so far) caused by the virus is heavy mail traffic. Disinfection is very easy!.

We recommend that you download and run this program regardless of whether you have opened a mail message with subject "Life stages" or not. If your computer is not infected, the fix program will report this. Just download the file fixlife.exe to your Desktop (save to C:\WINDOWS\DESKTOP) and run it. Please be sure to dnload the file to your desktop!

Please be patient while the fix program runs. It may take some minutes to check your disk.

Virus Alert! (5th May, 2000) LOVE LETTER Virus
Effective 4th May 2000, a new virus has started to circulate around the globe through electronic mail. This new virus spreads by exploiting some features of MS-Outlook e-mail program. Although this virus does not cause a major harm, it renames and/or deletes certain files on the infected computer. The virus multiplies and spreads itself using the addresses in address books and hence is expected to become a wide-spread virus very quickly. The virus is usually transported by e-mail messages with phrases like "I LOVE YOU" , "LOVE LETTER FOR YOU" in the subject field and with an attached file. If you receive a message with subject/text containing such words and an attachment with a VBS extension, do not open the attached document. Outlook users are especially vulnerable to Visual Basic script files with VBS extension. For more info on the virus please see http://www.f-secure.com/v-descs/love.htm
For information on disinfection/recovery etc. please check the virus related pages at Bilkent BCC web pages.

The manual removing of LoveLetter virus could be done by deleting the following files from the infected machine:

• all *.VBS files from all the drives and from all sub directories;
• the file LOVE-LETTER-FOR-YOU.HTM from Windows System directory
• WIN-BUGSFIX.EXE and WINFAT32.EXE from Internet explorer download directory.
  

Virus Alert! (7th Dec, 1999) Explore Virus or ZIPPED_FILES Virus
Another virus spreading fast. It travels around the Net as e-mail attachments. DO NOT execute/run attached EXE files (program files) that you receive as email attachments; especially if the name is ZIP_FILES, ZIPPED_FILES or ZIPPEDFILES. Click the link above for more details and disinfection procedures.

Another November Virus Alert! (18th Nov, 1999) *** Pretty Park Worm
The attached program file is named "PrettyPark.EXE". When the attached program called "PrettyPark.EXE" is executed, it may display the 3D pipe screen saver. Once the worm program infects your PC, it will try to email itself automatically every 30 minutes (or 30 minutes after it is loaded) to email addresses registered in your Internet address book. It will also try to connect to an IRC server every 30 seconds and connect to a specific IRC channel. This connection can potentially be used maliciously.

New Virus Alert! (11th Nov, 1999) ***
Threat to MS OUTLOOK and OUTLOOK EXPRESS users!
No attachment required. The new virus doesn't rely on an attachment. Instead, all a user has to do is open an e-mai with MS OUTLOOK or OUTLOOK EXPRESSl. An embedded Visual Basic Script command attaches itself to the Outlook address book and mails the e-mail to everyone in the addresslist.

Besides being a nuisance, it doesn't carry with it any code that could damage someone's computer.

A change you can make on your Windows 95/98 settings for IMPROVED INTERNET ACCESS SPEED
You can make a minor modification in your Windows Registry to improve your Internet Access speed. The changes are for Windows95 and Windows 98 users only. You can find a step-by-step procedure with screen shots and comments here.

30%-100% performance increase is expected after the changes.

New Virus Alert! (12th June, 1999)
A new Trojan Horse class virus is circulating around the Internet as an e-mail attachment.

If you receive an e-mail message with body text

I received your email and I shall send you a reply ASAP.
Till then, take a look at the attached zipped docs.

and an attachment called zipped_files.exe please delete the message and its attachment. Do not run the program.

The Trojan Horse program searches local and networked drives (drive letters C through Z) for specific file types and attempts to erase the contents of the files, leaving a zero byte file. The targets may include Microsoft Office files, such as .doc, .xls, and .ppt, and various source code files, such as .c, .cpp, .h, and .asm.

For more information on the virus, you can refer to

http://www.cert.org/advisories/CA-99-06-explorezip.html

Virus Alert!
A new and dangerous virus has been detected on some very campus computers. If your computer is infected by this CIH virus, the virus will become active on the 26th of April and render your personal computer completely unusable. Some versions of this virus is reported to become active on the 26ths of each month. Please read the detailed description of this CIH virus and the suggested remedies by clicking here.

Guide and Tools for WEB Publishing / How To Publish Your Own WEB Pages
You will find the MS Frontpage Express WEB editor and other Web publishing related tools here. An easy to use template personal web page, brief tutorial and links to complete HTML references are also available.

Adobe ACROBAT Reader (A tool to read files with PDF extension). Click here to start downloading Acrobat Reader.
Download the executable ar40eng.exe to a temporary directory on your PC and then run this program. The installation is trivially simple; just follow the instructions. An older version (3.02) is also available here.

A DECODING Utility for MIME or UUENCODE decoded files that you sometimes receive as mail attachments Click here to start downloading the decoder
Sometimes, when a mail message which has a file attachment is forwarded (especially by the pine program in UNIX environments) attachments files are converted to a column of encoded text. This utility will help you decode and extract such files on Windows95 & 98 computers. Download the program file to a temporary directory; then run the program. Once installed on your computer; you can decode mail attachments as follows :

1. Save the encoded message to a temporary directory on your PC. You might have to save the message on the UNIX host using the pine program and then transfer this saved file to your PC using an FTP client on your PC. If you need more info on FTP programs, please click here.
2. Start Explorer (NOT the Internet Explorer), (MyComputer will work as well);
3. Find the file that you have saved your message into;
4. Right Click on the name of the file;
5. Select "Decode" on the menu you see upon right clicking;
6. The decoder will guide you for the rest.

Changing your UNIX & Network Access Password

Some useful TCP/IP tools for Windows95 (telnet client, ftp client & EUDORA mail client)

How to use a printer connected to a UNIX host from Windows 95 client computers.

How to read your mail when you are away from Bilkent

DORM-NET - Personal Network Connectivity in Bilkent Dormitories

Bilkent University Network Traffic Analysis Results

Dial-Up Connection To Bilkent Computer Network

Internet Lines Status Monitor

To Bilkent Home