> > >If any of you missed the note on "Edit-X", let me know personally and I'll >send it to you. It's a DOS program that allows you to force Eudora to NOT >show the "X-Sender" header in your outgoing email. It's a simple little >program, doesn't work correctly all the time, and is aggravating; but, it >works. > >SgtGeorge Yes, please do send it to me.. I may be slow, but eventually get there.. LOLOL ginger Mike & Ginger Woodcock/EagleRun Australian Shepherds [email protected] http://www.eaglerun1.com Ginger's WebDesign is here to help with your Web Needs, Give us a call, or email with your questions. Remember, the purchase of an EagleRun Aussie is not the end of a Transaction, it is the Beginning of a Relationship, enjoy!! :-)

Ok, Sgt George :-) "spoofing" Please explain how I do this exactly and I'm going to use my hotmail account to mail to and see.. I would never use this for the off reasons.. But, this would be the answer to being on the list where this weird guy is.. I could still post helpful things to the other listers without him causing a sceen.. I've stopped posting and only do privates because of him... Some of the listers have begged me not to leave the list.. they feel very intimidated by him as well and so they come to me.. kinda like we all do to you.. :-)... I would never misuse something like this.. I have my own list and understand the need for complete honesty.. ginger Mike & Ginger Woodcock/EagleRun Australian Shepherds [email protected] http://www.eaglerun1.com Ginger's WebDesign is here to help with your Web Needs, Give us a call, or email with your questions. Remember, the purchase of an EagleRun Aussie is not the end of a Transaction, it is the Beginning of a Relationship, enjoy!! :-)

My fonts in Eudora are set (as standard) to Arial/Courier New Small. I frequently cut from a Eudora message and paste into Microsoft Word 97 SR-1 and/or Microsoft Excel 97 SR-1. Despite the fact that these two packages are set to work in Arial the pasted information appears 1. in Times New Roman 10 FOLLOWED BY TWO CARRIAGE RETURNS 2. IN HYPERLINK FORMAT (WHEN I COPY AN E-MAIL OR WEB PAGE ADDRESS) Try as I might, I am unable to get rid of the pasted hyperlink formats. No amount of highlighting and changing from any style format to any other format (Headings, plain text, default para text....) convinces Microsoft to stop insisting that this must remain a hyperlink. How do I make it submit to MY will? In Excell it does another thing: it spreads the cell into which I paste into many subsequent ones to the right. I can go into Eudora Edit/Text/Clear Formating - but each time is a pain. Eudora Light did not used to do this. What am I doing wrong? David Lewin London

I originally sent this on 3 May 2000. If you use Eudora, AND if you haven't made the changes yet, PLEASE DO SO! I just received another notice about the problem and thought that anyone, using Eudora that has subscribed to either the EUDORA-MAIL or VIRUS-DISCUSSION Mailing List since 3 May, should see this and make the appropriate changes. Here's another URL for the same problem: http://peacefire.org/security/stealthattach/ SgtGeorge ***************Original Post*************** There is an article on ZDNet, concerning a "security hole" in QualComm's Eudora Email Browser. Please log on and read it. QualComm says it will "fix" this security risk in the next update. http://www.zdnet.com/zdnn/stories/news/0,4586,2557027,00.html To fix the problem now, here are instructions: *************** QUALCOMM recommends that users edit their Eudora.ini file and add the following line: WarnLaunchExtensions=exe|com|bat|cmd|pif|htm|do|xl|reg|lnk to their "[Settings]" section. (The default is to warn for all of these extensions except the "lnk" one.) Qualcomm has said that the next version of Eudora will warn for .lnk files as well, by default. *************** If you use Eudora's "Tools/Options/Extra Warnings" and put a check mark in "Warn Me when I Launch a Program from a Message", the above line will be added to EUDORA.INI, but it will not include "lnk" at the end. That's why you need to either add the complete line (if you don't already have it), or to add the "|lnk" to the end of an existing line. (The "|" is made by holding down the Shift key and hitting the key for the "\" backslash.) If you don't have time to log on to ZDNet and read the article, here's the gist: *************** A researcher has discovered a security hole in Qualcomm Inc.'s (Nasdaq: QCOM) Eudora e-mail program that could allow a hacker to run code on a user's machine. The exploit requires that a user open an e-mail file and click on a link in the message (usually a blue color, and underlined; it may appear as an actual URL, or it may be simply something like "Click Here", or just clickable blue underlined text). When the user clicks the link, the code (attachment - virus, worm, etc.) is executed. The trick, explained below, is to mask the warning that Eudora normally displays when a user tries to run an executable file that is sent as an attachment. The hacker would send the user TWO attachments, the executable file and a hyperlink (.lnk) that points to the other attachment. If the user clicks on that (the hyperlink), the executable code will run without Eudora displaying the warnings. *************** I suspect that Eudora is not the only email browser that has this problem. I think we'll see shortly that other browsers are susceptible to the same problem. Leave it to the hackers to find new ways to screw around with us and corrupt our files and hard drives! I just wish they would get jobs and do something beneficial for humanity for a change. SgtGeorge Listowner ***************End of Original Post***************

At 04:56 PM 05/11/2000, Mike & Ginger Woodcock wrote: *************START OF ORIGINAL MESSAGE TEXT************* No, I was using OutLook Express at the time and I actually saw where it showed my actual identity. Shoot, I can't explain it right.. but, I set up an addy with Hotmail as well as the second addy with sat.net and sent myself a note.. when it came in I saw the following and there was my name and information big as day.. I think it is properties in OL Express. It shows the exact originator.. Will Eudora do the same.. and how do I ck... ginger (snip) **************END OF ORIGINAL MESSAGE TEXT************** Ginger, I'm not sure what you mean by, "I saw the following and there was my name and information big as day." If you meant to include a list of the headers, you forgot to add them. What we got was the headers from MY previous email. As to whether Eudora will "do the same", I personally tried Eudora to send an email, where I changed the From: header to something other than my actual name and address. The email was sent and received with ONLY the fake name and address. Nowhere could I find any reference to my actual identity. Of course, as already explained, I turned off the "X-Sender" header in Eudora, so that the only identification was in the "From" header. I don't think that OL will allow you to do what I have been describing. It's not that versatile. And, it's NOT supposed to be used for tom-foolery or for chicanery. It's for the legitimate use of sending email to several different addresses and having all replies come back to one specific address. In a way, I use "Spoofing" all the time when sending email to two or more people who are accustomed to receiving email from one or the other of my several email addresses, but I want replies to come back to ONE specific address. I certainly don't use it to "hide" my true identity. If any of you missed the note on "Edit-X", let me know personally and I'll send it to you. It's a DOS program that allows you to force Eudora to NOT show the "X-Sender" header in your outgoing email. It's a simple little program, doesn't work correctly all the time, and is aggravating; but, it works. SgtGeorge

At 07:17 PM 05/11/2000, Sylvia Gould wrote: *************START OF ORIGINAL MESSAGE TEXT************* Does this take the place of a virus scanner entirely, or it an addition to a current program? Sylvia G. At 12:39 AM 5/11/00 -0400, you wrote: >Trojan First Aid Kit - A 4 Cow Anti-Virus Scanners **************END OF ORIGINAL MESSAGE TEXT************** It doesn't take the place of an AV (Anti-Virus) program, such as McAfee, Norton, etc. It's just added protection. It doesn't reside in memory and operate continuously, like an AV program. It only runs when you execute it. What the Trojan First Aid Kit does is search through your hard drive and try to find any old Trojans sitting there, just waiting. Version 2.0 looks for 141 known Trojans. The URL I sent originally will download the older version 2.0. I just checked the home page of the producer of Trojan First Aid Kit and there is now a version 3.0. The URL for this is: (Click on TFAK on the right.) http://www.kryptocrew.de/snakebyte/indexe.htm Version 3.0 detects 257 known Trojans and 9 Exe-Joiner Trojan/Worms. IMPORTANT INFORMATION: You should know that the person who wrote this program also has some files on his web site that instructs others how to write "Worms" for various Internet applications. This scares me! The person is obviously a hacker who knows how to write viruses, worms, trojans, etc., and those of you who are not "Bravehearts" might not want to download and try TFAK; however, I feel that: 1) Who better to write a Trojan finder than one who knows how to write them; 2) The program is listed on TUCOWS and is given a 4-Cow rating. For now, I would advise that you not use TFAK. I have downloaded it and will give it a try. If all goes OK, and I can find no problems on my system, I will let you know. SgtGeorge Listowner

Does this take the place of a virus scanner entirely, or it an addition to a current program? Sylvia G. At 12:39 AM 5/11/00 -0400, you wrote: >Trojan First Aid Kit - A 4 Cow Anti-Virus Scanners

No, I was using OutLook Express at the time and I actually saw where it showed my actual identity. Shoot, I can't explain it right.. but, I set up an addy with Hotmail as well as the second addy with sat.net and sent myself a note.. when it came in I saw the following and there was my name and information big as day.. I think it is properties in OL Express. It shows the exact originator.. Will Eudora do the same.. and how do I ck... ginger Resent-Date: Wed, 10 May 2000 22:24:55 -0700 X-Original-Sender: [email protected] Wed May 10 22:24:54 2000 X-Mailer: QUALCOMM Windows Eudora Version 4.3 Date: Thu, 11 May 2000 01:01:50 -0400 Old-To: [email protected] From: "George W. Durman" <[email protected]> Subject: Re: [EUDORA] E-Mail "Spoofing"?? To: [email protected] Resent-From: [email protected] Reply-To: [email protected] X-Mailing-List: <[email protected]> archive/latest/705 X-Loop: [email protected] Resent-Sender: [email protected] Mike & Ginger Woodcock/EagleRun Australian Shepherds [email protected] http://www.eaglerun1.com Ginger's WebDesign is here to help with your Web Needs, Give us a call, or email with your questions. Remember, the purchase of an EagleRun Aussie is not the end of a Transaction, it is the Beginning of a Relationship, enjoy!! :-)

At 02:10 AM 05/11/2000, Mike & Ginger Woodcock wrote: *************START OF ORIGINAL MESSAGE TEXT************* George, I'm very interested in this because I belong to a list where I was flambed several times by one particular person. He then followed me to other lists and continued the same... My ISP gave me another account to use to help retard this monster.. It didn't help because it will show up if you use email programs like OUTlook or even Pegasus I believe.. You only had to use the file tab and click on preferences or view or something and it showed the originators address and ISP.. so how will this help.. I did this because there were many on the list that wanted me to stay.. I was there to help and do alot of what you do on this list.. I wanted to be able to do it without the confusion this man caused.. It was an open list so he was not thrown off for over a year.. Is there an actual way of doing this without the identify being found out.. I always feared he would see my actual identify and start up again AND he did.. it really scared me.. ginger **************END OF ORIGINAL MESSAGE TEXT************** Ginger, chances are that a reputable server's personnel will NOT give out such information to a casual inquirer. In fact, I have emailed ISPs in the past, giving them the identification header, and asking them to investigate the user. They have never given me the actual identity of the sender, but they notified me that they did cancel his account. There's no way for your "nemeses" to find out on his own what your address is. He would have to contact @sat.net and I'm sure THEY wouldn't tell him who you were. SgtGeorge

At 11:55 PM 05/10/2000, Sylvia Gould wrote: *************START OF ORIGINAL MESSAGE TEXT************* Hi, SgtGeorge: When you say you can "simply" delete the default name and email address in the "From:" header of your email....are you saying on the outgoing email as I'm getting it ready to go? -As on this one right now?--My Eudora puts my return address there and it is non-removable as far as I can tell. I don't need to use this idea, just tried to follow through out of curiosity and wondered if I read you right. SG (snip) **************END OF ORIGINAL MESSAGE TEXT************** You need to add a line to the EUDORA.INI file, under the [SETTINGS] category: EditAllHeaders=1 Then, you can simply highlight or delete whatever is the default for the From: header and type in whatever you want. SgtGeorge

At 11:37 PM 05/10/2000, you wrote: *************START OF ORIGINAL MESSAGE TEXT************* George, I just received this as portion of a message.....have no problem sending to the lists, etc., but this person says: "What in the world are you using to write your messages? That reply came in as a binary attachment. I could not print it from Compuserve and when I tired to open it the system said it did not recognize the format. I had to exit Compuserve and emply QuickView Plus to open and print it." Since you are compuserve, maybe you can help? I have the options set for MIME. Mari **************END OF ORIGINAL MESSAGE TEXT************** I have my Eudora set on MIME also and have no problems. Sounds to me like Compuserve is back to its old tricks. That is, they have a bunch of ex-MS nonads working there and they've screwed up the programming again. Compuserve was never known as having the best people working for them. Guess close association with the AOL folks has allowed the "dumb virus" to spread to them also. George

Trojan First Aid Kit - A 4 Cow Anti-Virus Scanners Version: 2.0 License: Freeware Description: This is the first Trojan Scanner, which uses heuristics, to find new, unknown Trojans. It also contains several tools to help the advanced user to find trojans on it's own. http://www.tucows.com/virusnt.html#tfaknt Thought you might be interested in this one. Haven't downloaded it yet, but will do so tonight and let you know how it works. SgtGeorge Listowner

Ok. Thanks, George. Mari At 12:48 AM 5/11/00 -0400, George W. Durman wrote: >At 11:37 PM 05/10/2000, you wrote: >*************START OF ORIGINAL MESSAGE TEXT************* >George, >I just received this as portion of a message.....have no problem sending >to the lists, etc., but this person says: > >"What in the world are you using to write your messages? That reply came in >as a binary attachment. I could not print it from Compuserve and when I >tired to open it the system said it did not recognize the format. I had to >exit Compuserve and emply QuickView Plus to open and print it." > >Since you are compuserve, maybe you can help? > >I have the options set for MIME. > >Mari >**************END OF ORIGINAL MESSAGE TEXT************** > >I have my Eudora set on MIME also and have no problems. Sounds to me like >Compuserve is back to its old tricks. That is, they have a bunch of ex-MS >nonads working there and they've screwed up the programming >again. Compuserve was never known as having the best people working for >them. Guess close association with the AOL folks has allowed the "dumb >virus" to spread to them also. > >George > > >============================== >Search ALL of RootsWeb's mailing lists in real time. >RootsWeb's Personalized Mailing Lists: >http://pml.rootsweb.com/

At 09:43 PM 05/10/2000, George W. Durman wrote: *************START OF ORIGINAL MESSAGE TEXT************* I know that many of you Listowners also maintain web pages at Rootsweb, and elsewhere, as companions to your Lists. Of course you use many different graphics programs for producing your headers, banners, icons, etc., but for those of you who use Paint Shop Pro (PSP), I thought you might be interested in knowing that there are two VERY useful Newsletters, to which you may subscribe, that will open up a whole new world of making graphics with PSP. (snip) **************END OF ORIGINAL MESSAGE TEXT************** Forgot to mention that there is also a List at Rootsweb for PSP. To subscribe: [email protected] Enjoy, SgtGeorge

> George, I'm very interested in this because I belong to a list where I was flambed several times by one particular person. He then followed me to other lists and continued the same... My ISP gave me another account to use to help retard this monster.. It didn't help because it will show up if you use email programs like OUTlook or even Pegasus I believe.. You only had to use the file tab and click on preferences or view or something and it showed the originators address and ISP.. so how will this help.. I did this because there were many on the list that wanted me to stay.. I was there to help and do alot of what you do on this list.. I wanted to be able to do it without the confusion this man caused.. It was an open list so he was not thrown off for over a year.. Is there an actual way of doing this without the identify being found out.. I always feared he would see my actual identify and start up again AND he did.. it really scared me.. ginger Mike & Ginger Woodcock/EagleRun Australian Shepherds [email protected] http://www.eaglerun1.com Ginger's WebDesign is here to help with your Web Needs, Give us a call, or email with your questions. Remember, the purchase of an EagleRun Aussie is not the end of a Transaction, it is the Beginning of a Relationship, enjoy!! :-)

Here's an interesting item from ZDNet: *************** What is Email Spoofing? By Tom Merritt Email spoofing is the practice of changing your name in email so that it looks like the email came from somewhere or someone else. Spoofing is generally used by spammers as a first defense against people finding out who they are. It's also used by general malcontents to practice mischievous and malicious behavior. Spoofing can be a legitimate and helpful tool for someone with more than one email account. I spoof regularly from my ISP-provided email. For instance, you have an account, [email protected], but you want all replies to go to [email protected] You can spoof yourself so that all the mail sent from the isp.net account looks like it came from your purplemonkeys.com account. If anyone replies to your email, the reply would be sent to [email protected] This is also helpful if you temporarily use a Web-based email account but want the replies to go to your regular email address. Remember that spoofing anyone but yourself is absolutely and undeniably illegal. You should not ever spoof anyone else, not even in fun. To change your email identity, go into the mail preferences of your email client, or Web-based email host. Look for fields about identity. They will normally default to your email address and your name. You can change them to whatever you want. *************** This is from me, SgtGeorge: Now, you can do as suggested above, or, you can simply delete the default name and email address in the "From:" header of your email and replace it with whatever you want. I'm not suggesting that you do this, just sending the item to let you know how those d***ed SPAMMERS do what they do. And, the same thing works for those who would send viruses. I just sent this identical email to myself, but changed the "From:" header to: "The Phantom" <[email protected]> I received the email back and it was from: "The Phantom" <[email protected]> Without any clue to my real name and email address. But, normally, when the headers are expanded, there will be a line, "X-Sender" that will identify the actual sender. Using a small free DOS utility that works for Eudora, called "Edit-X", I was able to keep the "X-Sender" line from showing up in any email I send; thus, I could send the same email to anyone and they would have no NORMAL way to find out who sent it. Now, the reason for this email: SPAMMERS, and other lowlife creatures, do this all the time. But, there is still a way to find out WHO actually sent the email, if you contact the appropriate server, and, if they will cooperate!!!!! If you look at the "expanded" headers, that is, ALL the headers of any given email, you will find a header, "Received: from....." In that header, the sender WILL be identified. Here's what that header looked like in the email I sent to myself: Received: from 0015523864.Subscriber (ts005d10.kno-tn.concentric.net [206.173.4.214]) by newman.concentric.net (8.9.1a) id WAA22463; Wed, 10 May 2000 22:28:39 -0400 (EDT) Look at: 0015523864.subscriber (ts005d10.kno-tn.concentric.net [206.173.4.214]) That says that the sender (me) originated the email through the "concentric.net" server, and that the connection originated in Knoxville, TN. The "0015523864.subscriber (ts005d10" can be used by Concentric.Net to determine who I am. You and I can't tell who "0015523864.subscriber (ts005d10" is, but Concentric.Net can! That's why, when we receive SPAM, or receive an email containing a virus attachment, we HAVE to look at ALL of the headers. Case in point: Melissa Virus Melissa sends email to randomly selected addresses in your address book. It then selects an address from the address book to put in the "From:" header. You get a virus-containing email "supposedly" from so-and-so. But, it didn't really come from that person. Looking at the "Received: from..." header will show you the SERVER of the person whose system is infected. The part that I extracted and showed above will let Concentric.Net know from which subscriber the email actually originated. It's getting so we all have to become "experts" in order to thwart all the SPAMMERS and viruses that abound today. Yes, it's aggravating, and, yes, it makes for more work than most of us want to do, but, I'm afraid it's something we're all going to have to learn, sooner or later. Regards, SgtGeorge George W. Durman Knoxville, TN VIRUS-DISCUSSION List Administrator

George, I just received this as portion of a message.....have no problem sending to the lists, etc., but this person says: "What in the world are you using to write your messages? That reply came in as a binary attachment. I could not print it from Compuserve and when I tired to open it the system said it did not recognize the format. I had to exit Compuserve and emply QuickView Plus to open and print it." Since you are compuserve, maybe you can help? I have the options set for MIME. Mari

I know that many of you Listowners also maintain web pages at Rootsweb, and elsewhere, as companions to your Lists. Of course you use many different graphics programs for producing your headers, banners, icons, etc., but for those of you who use Paint Shop Pro (PSP), I thought you might be interested in knowing that there are two VERY useful Newsletters, to which you may subscribe, that will open up a whole new world of making graphics with PSP. 1) PSP Power, which started a little over a month ago. You may subscribe to this newsletter here: "For information on subscribing to pspPower, visit the Web site at http://www.pspPower.com/" 2) Tip World's Paint Shop Pro Newsletter. Subscribe here: "Register at Topica here: http://www.topica.com/register" I hope you don't think this too off-topic, but I figure any help anyone can get, when it comes to managing companion web pages, would be welcome. For anyone who is interested, and who would like back issues of both Newsletters, please contact me at my private email address: [email protected] DISCLAIMER: I have no interest in PSP, financial or otherwise, other than being a very satisfied user. SgtGeorge

Hi, SgtGeorge: When you say you can "simply" delete the default name and email address in the "From:" header of your email....are you saying on the outgoing email as I'm getting it ready to go? -As on this one right now?--My Eudora puts my return address there and it is non-removable as far as I can tell. I don't need to use this idea, just tried to follow through out of curiosity and wondered if I read you right. SG > >This is from me, SgtGeorge: > >Now, you can do as suggested above, or, you can simply delete the default name >and email address in the "From:" header of your email and replace it with >whatever you want. > > >I just sent this identical email to myself, but changed the "From:" header to: > >"The Phantom" <[email protected]> > >I received the email back and it was from: > >"The Phantom" <[email protected]> > >Without any clue to my real name and email address.

At 5/9/2000 08:53 PM -0700, you wrote: >yes, but.... (isn't there ALWAYS a "but"?) > >on re-starting Eudora after the fatal error, it worked fine again (without >replacing eudora.ini) so it is not likely to be a corrupted file. > >DL It still could be, David. I had a corrupted .ini file a short time ago. I had intermittent problems - sometimes Eudora worked fine, other times it didn't. Once I re-did the file, I was fine - no problems. <knock on wood> <g> Sandy Walroth Carawind Aussies & Shelties Greensburg, PA Westmorelend Co. Obed Trn Club [email protected] Great Lakes Australian Shep Club http://freepages.pets.rootsweb.com/~carawind/